There's a new breed of adware out there and Norton, Microsoft, Ad-Aware and few have a handle on it.

It's very intrusive and replicates rather deviously. It puts a file called bdao...etcetera.exe on the windows folder as a system file. To see it you have to adjust your 'advanced' folder options not to view just normal and hidden items, but SYSTEM files as well where these have been placed.

My system was infected and I'm running a rather extensive array of firewall protection and "immunization". It added something on the order of 145 different Registry key changes in one fifteen second swoop.

At the moment of infection the adware started popping up with talking commercials. "Great software is only a click away!" I pulled the plug as soon as I heard it, but it was too late.

All the ads it pops up are "fake ads"- in other words it's not really ad-ware designed to sell products, but rather is manufactured by folks who sell protection to consumers just by irritating them.

The mafia has a modern day equivalent in the antivirus community. Different programmer groups are subcontracted and paid money from the sale of product. This money goes into continual R&D. In this case R&D means development of new adware programs.

After the moment of infection it helps to do a chronological order of modified files at the date of infection. The amusing thing was that some of the files were dated 1977 and 1997. So one can't catch all changes just by date.

When you run MSCONFIG, you'll find NEWFRN.exe and BDAOXC...something or other..exe added to your start-up items until you delete them. As SYSTEM files in use they wont let you delete them conventionally and so you need to make 'advanced' changes to view system files and then rename them and drag them to your desktop. Restart the computer and delete them.

The package add a number of BHO (Browser helper objects) to the browser and so the ads pop up in the browser on the top and bottom of the page currently displayed. Not all are pop-ups or pop-unders.

After a few weeks, I'm sure they'll "release" the registry numbers into their various definition updates. I'm not getting pop-ups, but I merely crippled the package. I'm sure there are still waste products in the system.

Not a fun way to kill a few hours.

;-)