"Li'l Abner" <blvstk@dogpatch.com> wrote in message
news:Xns9F0ADD39EC6A9butter@wefb973cbe498...
> Not really new, just a new name. In either Safe or Normal mode it boots
> directly up to splash screen with "Clean This" on it with only one place ot
> click. I forget what that was but I didn't click it.
> This was in XP SP3. I got around it by booting inSafe Mode and picking the
> Administrator account which let me in. Then I checked the registry to see
> if the shell\open\command had been tampered with. It hadn't.
> Then went to Documents And Settings\User\Application Data and looked for a
> three lettered exe file. Sure enough, it was "gog.exe". I renamed it and
> was then able to download MBAM, install and run it. It found one
> Trojan.FakeAlert and one other lesser thing.
> Rebooted into Safe Mode Users Account, ran MBAM again. Found nothing.
> Then to Normal Mode, ran MBAM and SAS both.
> Seems to be OK now. I'm running a full scan with Avira but don't expect to
> find anything much.
>
> Google "Clean This" and the first hit is "How to delete Clean This virus".
> That's computing.net (Tom's Guide Tech Support).
>
> Go get 'em Dave! :-)

It's sad that those that should know better continue to "dumb down"
and call everything a virus.

Aside from that, good recovery from that trojan outlined above.