Crazy ORZ - begone!

In the past few days, my Grisoft AVG started interrupting my work and browsing with alarming pop-ups saying "THREAT DETECTED!"

I immediately ran a full test scan (a long one), and was somewhat surprised that the test results showed no infection.
And yet the pop-ups continued to pester me... until today.

Because I never had any malware before - and because Grisoft is phasing out their wonderful free AVG program (updates will only be available until June 28) - at first I suspected that it was a cunning device by Grisoft to lure more paying customers. (Not nice of me, I know, I am very contrite.)

Then I ran one of my favourite (and regularly updated) applications: Spybot Search & Destroy.
Nothing.

Then I ran a full test at PC Pitstop (the OLD battery, I find it much better than the new Overdrive version)...

Aha!

There was no mention of any virus or malware on their list of programs and processes running on my PC - but there was an "unrecognised" program: ORZ.exe.

I ran a search to find out more about it.
It turned out to be a keylogger - a Trojan.

Aghh!

Not stopping to waste anger on my faithful daily "protectors" (AVG and S & D), I ran another search to find out how to remove it. A quick look at the various forums (I know: it should be fora, but this is not time to engage in dead-language speak, please!) showed that millions of computers have been affected by it since late May and (especially) early June - and the one thing that kept popping up was the supposed inability to remove it effectively.

There is nothing I enjoy more than a challenge - especially if I know I can win, relying on my own resources.

But it wasn't that difficult at all.
Here's what I did:

I used the Windows "search" function to find the EXE itself.
It was - as Orz is supposed to be - located in the Temp folder.
Obviously, I clicked on it and selected "delete".
It didn't work.

So I thought of renaming it - specifically, changing its extension.
I did: I changed it to BMP (don't ask why, it was the first one that came to mind).
And then, I tried to delete it again.
It didn't work. The file was reported to be "in use".
(It figures!)

So I renamed it again, this time to DOC.
Then I opened the newly created "document" and deleted everything in it (it wasn't actually readable, as you can imagine).
then I tried to delete it.
Again, it didn't work.

So I did what you should NOT do (unless you're a dreadnaught hothead fool like myself, obviously) and opened the register (prompt command REGEDIT). I searched for "ORZ.", found a few entries, carefully read their data (location ettc.), and deleted them.

Then I emptied the "bin" and ran another search on my PC, to find any other possible files with the name ORZ.*

There was the ORZ.doc (previously BMP) again!

So I did what I should have done many minutes earlier: I opened the Device Manager (hit CTRL + ALT and DEL at the same time) and checked the list of running processes...
There it was: ORZ.exe, as if I had never renamed it!
I terminated the process.
Then I tried deleting the renamed ORZ bugger - and this time, of course, it worked.

Then I emptied the trash again and ran another search to find any ORZ. files on my PC.

None were found.
And the AVG has been keeping quiet ever since, too: no more pop-ups, no more "threat detected".

I hope you find this rambling of some use.

And remember: if you're looking for advice on removing ORZ today but you only find this entry a week from now, thank Google snaily crawl for it...




IMPORTANT:

I am NOT recommending anyone to proceed as described in this entry. If you do so and something - anything - goes wrong, do not blame me.