From: Jeff Shultz 

On Thu, 13 Jan 2005 22:22:42 -0500, Geo wrote:

> "Jeff Shultz"  wrote in message
> news:pan.2005.01.14.02.38.32.741358{at}shultzinfosystems.com...
>
>> Anyone notice that there seems to be a new and rather resistant version
>> of CoolWebSearch out there now? I've run into it a couple times now.
>> cwsweeper doesn't see it, Ad-Aware might see it, but can't kill it.
>
> No but I ran into a new bot that's damn impossible to kill using remover
> programs. usb2.exe or something like that, the tcpview program
> http://www.sysinternals.com/ntw2k/source/tcpview.shtml shows dozens of
> ports open and the process as "hidden", I only found the exe
by searching
> for file dates around the time of infection. Nasty bugger. I posted about
> it in another post in nthelp I believe.
>
> Geo.

Lovely. I've also found a version of VX2 that appears to be impossible to remove.

--- BBBS/NT v4.01 Flag-5