This is one badass squirrel.
I am tired. I stayed up last night fixing a friend's computer, which had become infested with spyware. I say infested and I really mean it - this thing was absolutely chock full of the stuff. I don't think I've ever seen it get so bad - there seemed to be more bad applications there than good ones (certainly the "run at startup" section of the registry was less than half the size by the time I had finished). Goodness only knows what they had been doing with it to get it in that state.
In computer folklore there is a story about two programs called Robin Hood and Friar Tuck which would act together to prevent either of them from being terminated. Well, it seems that spyware authors have discovered this technique. Not only that, but if you try to rename one of the exe files (so the other process can't restart it when it's terminated) the other process will create another copy of itself, with a random name, in your Windows\System32 directory. That, ladies and gentlemen, is true evil. I've never even seen this behaviour in a virus. The only way to get rid of it is to have a specially written app that will find all of these processes in memory and kill them all at once (fortunately, such apps exist - seems I'm not the first person to try to get rid of this thing).
At least I've got all my Christmas shopping done (I just hope it all arrives in time).
