Vista - Infection Resolving Team

Wow you are insanly locked down haha it seems like you should have like the worlds secrets locked on your computer haha. That is very good for you though.
Everyone,
There have been some talks about a very strange rootkit that will make your taskbar glitch and will have your task manager pop-up uncalled for.
Has anyone else heard about this?
I also think i might have it.
Ben

Hmm...never heard of that. When you say your taskmgr pops up uncalled for, what excatly are you doing before it? Is there a pattern?

No it just comes up. I did a scan with Spybot and found a red highlighted cookie called tglit. I think the creator might have made that short for Taskmanager Glitch, very rookie but they did it. I removed it and checked my windows defender to see what was running and there was nothing suppicious. Hasnt happened since last night(when i did this) so i think everything is all set.
It was quite a weird one though. Very annoying but nothing harmful at all. I have no idea how it got in though.
Any ideas Fm?

Ive never heard of that before. I am running scans myself now

I am worried that these things can get past real-time protection but are detected by scans, what gives?

If your protection is running in real time then it is "scanning over files" constantly. It obviously cannot be scanning 2 files at once so maybe the malware, ect... can detect this and sneak past ur system when it is in the middle of another scan.
There are some insanly complex virus that i dont think many people understand how they work.
Ben

Hey everyone,
There is a solution i was wondering if anyone else knows about.
If there is a virus, go to windows defender, click tools, and choose show programs.
There was that whole PC Antivirus 2008 scandle. The Rouge Trojan is very hard to get rid of. I got it (kind of intentionally) so i could solve it. I got a ton of help from other people on here. But the best way was to view the programs from defender. When you do see a program you dont know or not sure if you started, right click on it. Choose "open file location". I found the virus i had and also opened the files. They were the virus files i am sure. I choose to run a scan with Comodo, SPybot, and MalwareBite. They all came back that the files were safe and not infected. I did not believe it though. What i did was try and delete the files. They were locked. It said they were being used even though i told the program to stop in windows defender. I use unlocker all the time, so i rigt clicked on the files (which were located in a google folder in my common files. I deleted all google files the minute i did my fresh PC restore.) and chose to unlock the files. When i did this, it was locked onto all the programs i was running and had run that computer session. So i highlighted over them all, went down to the bottom, and killed all processes. The processes were killed but none of the programs i was using stopped. The files had made the files have a clone which it was attached to. I used eraser to delete the files so there would be no trace of them on my HD. The Trojan was conqured.
Anyone else do this?
Ben

Have you tried booting from a USB key as a system disk and then killing the virus.

roy69,
I already killed the virus. I did this about a month ago. I am completely clean. I just wanted to know if anyone else did this.

Hey everyone i was just reading an articale in Maximum PC and it was how a hacker works.
It said that people will make an iframe to a website. Instead of going to the original website, you will be redirected to a fake website that is an EXACT replica(they probably just copy the source code). But i want to know is how they can redirect you. If you are going to a website, how can someone take you somewhere else. Did they hack the original? Or do they stop the traffic and pull it to there own site. I just want to know how this works. Remember, we are here as the good guys and i trust everyone on this site to do the right thing and not do anything to ever harm anyone. I want to know how they do it in general. I dont need steps on how to do it, that would be just wrong
Thanks again,
Ben

Hey, I have done that before (for testing purposes) and parked domains that are typos to things like gooogle.com or hotmsil.com etc.