VX2.cc Description:

VX2 is an IE Browser Helper Object. It monitors web pages requested and data entered into forms, sends this information to its home server, and opens pop-up advertisement windows. It also has the capability to update itself and install other software. There are two variants of this parasite with different file and internal names, but both work identically.

Also known as: Blackstone Data Transponder. Was also distributed under the name NetPal by netpalnow.com, but the software now available there is the newer NetPal parasite which isn't the same code., NetPal, Sputnik (name used by VX2), VX2 RespondMiter.

Variants:

• VX2.a
• VX2.b
• VX2.c
• VX2.Clean Get-Away
• VX2.d
• VX2.e
• VX2.f
• VX2.MSView
• VX2.My PanicButton
• VX2.new variant
• VX2.Respondmiter
• VX2.SiteHelper

VX2.cc Automatic Removal:

Using Spyware Doctor to detect and remove VX2 AUTOMATICALLY!

VX2.cc Manual Removal:

Contrary to VX2's claims there is no entry to remove VX2 in the standard "Add/Remove Programs" Control Panel item.

VX2 installs itself into your System directory and is called either "IEHelper.DLL" (Transponder variant) or "VX2.dll" (RespondMiter variant). Before you can delete this file you will need to deregister it. Enter the following command from the command line for Windows 95/98/Me:

"%WinDir%\SYSTEM\regsvr32.exe" /u "%WinDir%\VX2.dll"

Or for Windows NT/2000/XP:

regsvr32 /u "%WinDir%\VX2.dll"

That's for the RespondMiter variant - for the Transponder variant, write 'IEHelper.DLL' instead of 'VX2.dll' above.

After doing this and restarting the computer you can delete the file. There will also be some keys in the registry under HKLM\Software\Transponder or RespondMiter, which you can clean.

1. Kill these running processes with Task Manager:
   programfilesdir+\clean get-away\cgetwy.exe
   programfilesdir+\clean get-away\deletelockedfiles.exe
   programfilesdir+\my panicbutton\deletelockedfiles.exe
   programfilesdir+\my panicbutton\mypbtn.exe
    
2. Unregister these DLLs with Regsvr32, then reboot:
   msview.dll
   programfilesdir+\clean get-away\cleanhistories.dll
   programfilesdir+\clean get-away\psapi.dll
   programfilesdir+\my panicbutton\cleanhistories.dll
   programfilesdir+\my panicbutton\psapi.dll
   systemroot+\system\ehelper.dll
   systemroot+\system\kernellos.dll
   systemroot+\system\sitehlpr.dll
   systemroot+\system\vx2.dll
   systemroot+\system32\3lviewer.dll
   systemroot+\system32\3vviewer.dll
   systemroot+\system32\3zviewer.dll
   systemroot+\system32\6eo4svc.dll
   systemroot+\system32\6fo4svc.dll
   systemroot+\system32\6uo4svc.dll
   systemroot+\system32\sitehlpr.dll
   systemroot+\system32\vx2.dll
    
3. Remove these registry items (if present) with RegEdit:
   HKEY_CLASSES_ROOT\clsid\{00000000-5eb9-11d5-9d45-009027c14662}
   HKEY_CLASSES_ROOT\clsid\{ef100607-f409-426a-9e7c-cb211f2a9030}
   HKEY_CLASSES_ROOT\clsid\{ffd2825e-0785-40c5-9a41-518f53a8261f}
   HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{00000000-5eb9-11d5-9d45-009027c14662}
   HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{ffd2825e-0785-40c5-9a41-518f53a8261f}
   HKEY_CLASSES_ROOT\typelib\{11cc62b2-65f2-4a82-b332-5de4e8384422}
   HKEY_LOCAL_MACHINE\clsid\{00000000-5eb9-11d5-9d45-009027c14662}
   HKEY_LOCAL_MACHINE\clsid\{ffd2825e-0785-40c5-9a41-518f53a8261f}
   HKEY_LOCAL_MACHINE\software\classes\clsid\{00000000-5eb9-11d5-9d45-009027c14662}
   HKEY_LOCAL_MACHINE\software\classes\clsid\{ffd2825e-0785-40c5-9a41-518f53a8261f}
   HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{11111111-1111-1111-1111-111111111111}
   HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{20000273-8230-4dd4-be4f-6889d1e74167}
   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{00000000-5eb9-11d5-9d45-009027c14662}
   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{ffd2825e-0785-40c5-9a41-518f53a8261f}
   HKEY_USERS\.default\software\microsoft\windows\currentversion\internet settings\zonemap\domains\vx2.cc
   HKEY_USERS\.default\software\microsoft\windows\currentversion\internet settings\zonemap\domains\vx2.cc\*
   HKEY_USERS\.default\software\microsoft\windows\currentversion\internet settings\zonemap\domains\vx2.com
   HKEY_USERS\.default\software\microsoft\windows\currentversion\internet settings\zonemap\domains\vx2.com\*
   HKEY_USERS\s-1-5-21-2333004253-142840635-331808302-1009\software\destiny
    
4. Remove these files (if present) with Windows Explorer:
   bc777.html
   msview.dll
   profilepath+\desktop\clean get-away.lnk
   profilepath+\desktop\my panicbutton.lnk
   sitehlpr.inf
   systemroot+\system\ehelper.dll
   systemroot+\system\kernellos.dll
   systemroot+\system\sitehlpr.dll
   systemroot+\system\vx2.dll
   systemroot+\system32\3lviewer.dll
   systemroot+\system32\3vviewer.dll
   systemroot+\system32\3zviewer.dll
   systemroot+\system32\6eo4svc.dll
   systemroot+\system32\6fo4svc.dll
   systemroot+\system32\6uo4svc.dll
   systemroot+\system32\sitehlpr.dll
   systemroot+\system32\vx2.dll
    
5. Remove these directories (if present) with Windows Explorer:
   programfilesdir+\clean get-away
   programfilesdir+\my panicbutton

More Removal Instructions for Adware/Spyware Programs - 'V'