Computing.Net > Forums > Security and Virus > VX2/? What is this? Am I secure??

Computing.Net: Over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to sign up now, it's free!

VX2/? What is this? Am I secure??

Reply to Message Icon

Original Message
Name: Tazzyluck
Date: December 30, 2003 at 00:15:56 Pacific
Subject: VX2/? What is this? Am I secure??
OS: XP
CPU/Ram: 2200+/480
Comment:

VX2/?:user settings
HKEY_USERS\S-1-5-21-809299238-3646181656-3495054330-1006\Software\Destiny

This continually comes up at various sites I visit. What is this exactly and what is it doing on my computer? Is it harmful?

Ty to anyone that responds! I really appreciate your help!!



Report Offensive Message For Removal


Response Number 1
Name: code47
Date: December 30, 2003 at 02:28:03 Pacific
Reply: (edit)

VX2 tracks the Web sites that users visit and reports that information back to the company, which adds it to a database tracking each user. Worse yet, VX2 collects information from the on-line forms that users fill out. VX2 promises that it won't collect anything sensitive - like credit card numbers or passwords - but the only contact information available for the company is a Hotmail address and a PO box in Las Vegas.


Report Offensive Follow Up For Removal

Response Number 2
Name: code47
Date: December 30, 2003 at 02:30:39 Pacific
Reply: (edit)

Removal instructions

Use "Find..." to locate VX2.dll on your system. Note the path where it is installed (e.g. C:\Windows\VX2.dll)
Select Start > Run, and type the following:

regsvr32 /u "C:\Windows\VX2.dll"

replacing C:\Windows\VX2.dll with the path you noted earlier. (You should then see a message window such as "DllUnregisterServer in C:\Windows\VX2.dll succeeded.")

Delete VX2.dll

have fun : )


Report Offensive Follow Up For Removal

Response Number 3
Name: John Wallace
Date: December 31, 2003 at 07:29:17 Pacific
Reply: (edit)

VX2 is more sinsister than your average spyware - it is designed to use free space on ppl's comp as server space. You will have a VX2.dll file in yourr registry which you will have to find and delete


Report Offensive Follow Up For Removal

Response Number 4
Name: xgoldman
Date: January 2, 2004 at 19:31:59 Pacific
Reply: (edit)

Everytime I run check with SpyBot, VX2/? keeps coming up. I keep fixing it/delete VX2/?, but it comes back again a while later.

I have read the other postings and tried to remove the VX2.dll. But it is not found on any of my hard drives (I have 3 drives). Yet it keeps coming back. I checked to see if it is hidden, but I have "show all files" under IE options.

Does anyone have a fix for this. Please Help.



Report Offensive Follow Up For Removal

Response Number 5
Name: Nerdz
Date: January 4, 2004 at 14:49:15 Pacific
Reply: (edit)

Yep, exact same problem here. No VX2 files found in any of my hard drives and the regsistry but it continues to come up when spybot runs, even after I just ran it a few minutes ago.

I have Spybot, Adaware, Norton Personal Firewall, and my regular Norton anti-virus. The registry key HKEY_USERS\S-1-5-21-809299238-3646181656-3495054330-1006\Software\Destiny keeps returning even after I delete and reboot the system. This is getting to be really an annoyance. It also keeps popping up a "page not found" page everytime a open and close my browser.

I also observed in my netstat that port 3531 keeps connecting to various sites so I just put this port in my blocked port services with my Linksys VPN/firewall.


Report Offensive Follow Up For Removal


Response Number 6
Name: iceblue
Date: January 6, 2004 at 08:28:59 Pacific
Reply: (edit)

VX2 betterinternet - Difficult to remove this pest. (see also any notes on look2me)

NOTE: To show the 'Hidden' attribute files, first make sure that in Folder Options > View hidden and operating system files are set to show. http://www.xtra.co.nz/help/0,,4155-1916458,00.html

Also, set Folder Options and Search to find and show all files. Extract it and then run the vbs
Show all XP Search files
http://mjc1.com/files/mo/Show%20&%20Find%20All.zip


Download this tool:
http://www.kraftig.com/InstallFile/#download "Installfile"

Extract to the root drive C:\ for easy navigation (In it's folder!)
In the C:\Installfile folder RightClick and make new text document.
Type in it:
test
Save it as (save as *all files from the drop box) spyware.dll

Next, save the entire contents of the quote box (save as all files again ) as fix.reg

QUOTE
REGEDIT4[-HKEY_CURRENT_USER\Software\Look2Me] [-HKEY_CLASSES_ROOT\CLSID\{DDFFA75A-E81D-4454-89FC-B9FD0631E726}][HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]"{DDFFA75A-E81D-4454-89FC-B9FD0631E726}"=-[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]"{D3BE1580-F0D1-11D7-A2EE-0020780711A5}"=-


Double click on 'WinstallFile.exe' in the folder and in 'Sourcefile' browse to the location of the C:\WINDOWS\System\msg{D3BE1580-F0D1-11D7-A2EE-0020780711A5}0115.dll

In 'Destinationfile' navigate to the spyware.dll in 'Installfile' folder.
(result should be: C:\Installfile\SPYWARE.DLL)

Click 'Add to list'. If you get "no errors found.." -Reboot!!

Upon restart, navigate to 'Installfile' folder and DoubleClick on 'fix.reg' Answer 'yes' to the merge prompt.
Check your taskbar toolbar and uncheck any 'ghosts'/extra check marks or quick launch if present.

Check on the spyware.dll to be 320kb in size. if so, delete it.


Report Offensive Follow Up For Removal

Response Number 7
Name: xgoldman
Date: January 8, 2004 at 22:44:53 Pacific
Reply: (edit)

Mr. Iceblue

I am so thrilled to see that you have replyed to my cry for help. I have read your postings for other problems and the user' reply thanking you for fixing their problem. I am confident that your suggestions will get rid of my VX2/? problem.

I have followed your directions line by line and then got stuck at the following line :

"Double click on 'WinstallFile.exe' in the folder and in 'Sourcefile' browse to the location of the C:\WINDOWS\System\msg{D3BE1580-F0D1-11D7-A2EE-0020780711A5}0115.dll"

I cannot find such a file on my hard drive. I have searched all my hard drives. There are many files with "msg" in the filename, but none with "msg{" filename. Appearantly I cannot move ahead until this problem is addressed.

Please continue to help. Thank You in advance.


Report Offensive Follow Up For Removal

Response Number 8
Name: MichaelAC
Date: January 29, 2004 at 10:49:51 Pacific
Reply: (edit)

I had the same problem. I checked the CLSID starting with DDFFA and it pointed ot c:\windows\system32\msg117.dll. I followed the instructions above and removed msg117.dll with WinstallFile and the crap went away. Thanks guys!



Report Offensive Follow Up For Removal






Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home








Do you have your own blog?

Yes
No
I did before
I will soon


View Results

Poll Finishes In 4 Days.
Discuss in The Lounge
Poll History




Data Recovery Software