We have made some great progress with this new variant. We now know what it is and how to deal with it.
Please delete RootRepeal. This is a new way top use RootRepeal to delete this file:
Download RootRepeal.zip "You will need to rename RootRepeal to winlogon.exe\" and unzip it to your Desktop.
Double click winlogon.exe to start the program
and then to the Processes tab. Right-click on the randomly-named process with a name that is usually all numbers, and then click \"Terminate Process and Delete File\", which should do exactly that. Then, click Scan again. If the process isn\'t gone, or re-spawns on reboot, use \"Force-Kill Process and Wipe File\" to make sure it\'s gone.
Edited by SpySentinel, 22 July 2009 - 04:56 PM.