Symsight Rootkit / Spyware

I apologize if this turns into a long post -

I remove spyware from my customer's computers on a daily basis. I work in a small town computer repair shop, so I see an unbelievable amount of spyware, and have become very efficient at removing just about all of it. I've been struggling with one customer's computer for a while, and I finally figured out the source of the pop-ups.

A standard cleanup removed a decent amount of spyare from the computer. WinFixer, New.NET, Vertimundo, a bunch of others. After all of this cleanup Ad-Aware, Spybot, AVG, MS Antispyware, Trend HouseCall and several other found zero items on the computer. However, when IE was started it was joined by two or three pop-ups.

Then I ran SysInternal's RootkitRevealer

The log provided by RootkitRevealer follows.

It appeared as though a program called Symsight was the source of the pop-ups. As of this posting a Google search for Symsight returns zero results.

I used ERD to remove the Symsight program folder and files, the ipsilink.sys and dbnio804.exe files, and remove the related registry entries.

The pop-ups are now gone.

The only pop-ups I can remember that were associated with this program were inqwire.

If I can think of any more I will post them.

 

I looked back at my google search history and found that most of the pop-ups caused by symsight appeared to be from the following domains.

inqwire.com
softwareonline.com
softwareprofit.com
yieldmanager.com