Musings on P/C fix

The first time this computer picked up the Poweliks trojan seems to have been closely related to having visited RedStates website. I did not correlate that thought until yesterday when, once again, after visiting that site and clicking on the link about Christmas being on December 25th.

It was an almost instant degradation of through put on the computer, sluggish to the point uselessness. Checking the System Processes didn't show anything like the first infection where it was swamped with COM Surrogates all running at the same time. Instead, there were just a couple of Explorer and Windows 7 utility programs that seemed to be hogging the CPU and memory with a vengeance.

After verifying that they are legitimate system files it still made no sense why they had to run for prolonged periods. Malware did not detect anything but Windows Security Essentials, this morning, detected the trojan Powessere. That virus was then quarantined and destroyed but the system was not improved which is what sent me back on the trail of Poweliks. Poweliks operates in the Registry and in virtual memory, thereby leaving no files or evidence of its existence when you shutdown and restart the computer.

This time, Poweliks has decided to bury itself with names of legitimate system files! Ending the process threads should have solved the CPU problem, had those applications been legitimate applications. Instead, they simply morphed into some other file name and kept on churning away! Very clever. You can't destroy what isn't there.

RogueKiller is particularly effective in ferreting out Poweliks and, once again, it found it, destroyed it but an instant re-scan found the virus still there. The solution to getting rid of the virus, this time, was to run RogueKiller, let it find the virus, then open System Processes and shut down the process tree of the suspect files, that ends the opportunity for Poweliks to regenerate into another name variant before you have a chance to destroy the version discovered with RogueKiller.

The only way to be somewhat confident the trojan is actually gone is to restart the computer in Safe Mode (press the F8 key while the computer is restarting, not non-stop but quickly, at least once per second.) The computer will offer several options for starting up, choose Safe with Networking, then when the Windows screen desktop comes alive, right click on RogueKiller and let it scan the computer again and it should be able to eliminate the trojan.

If others have visited RedState and not had a sluggish experience, it probably is unrelated to the website. For that matter, so many websites now have so much trash running on them with scripts, adware and plug-ins that browsing has become tedious so most of them seem a little slow now, compared with 10 years ago.

The vendor for RogueKiller is Adlice.com. I can vouch for the efficacy of their application, at least specifically to Poweliks.

Curiously, many of the big name anti-virus softwares are reported to have not picked up on this trojan. That is almost certainly as a result of the malware programmers constantly modifiying their own code in response to the anti-virus programmers responses.

 There is big money in pusing adware through, against internet browsers, pop-up blockers and such. Ordinary internet users, and even trolls like me resent being bombarded by unsolicited advertisements, subscription offers and re-directed links to liberal porn