First I would like to thank tweakXP.com for allowing me to become a member of this forum and I want to also thank bettyjss who gave my web site and my posting at Lavasoftsupport to help one of your members Frank Lavallee to rid his system of the Win32 BI Application issue.

The post was: http://tweakxp.com/forum/forum_posts.asp?TID=2700&get=last

Now I want to warn your members of the newest variant of the Win32 BI App.  First the Win32 BI App is a variant of the VX2/Blackstonedata transponder spyware.  Around June of 2003 a new variant the host.dll hit the Internet and was named after the site: Stop-Popup-Ads-Now.com which acted like the old variants vx2.dll, IEHelper.dll, MSView.dll, etc.

Around July 2003, I found a popup for a Net Turbo Internet Accelerator that listed the business as Better Internet Inc. Upon further investigation I found that they also advertised a clean getaway and a My Panic Button.  I also found they had a copyright that stated they were a unit of Direct-Revenue (now removed from the pages).  Direct-Revenue.com listed 3 senior staff members (also removed now) that were the Blackstonedata/VX2 group.

When popups began advertising cleangetaway and mypanicbutton and now net turbo, the code added a win32 bi app in the registry for uninstalling the software which the code is contained in the payload.inf in the windows or winnt\inf folder.  If you run a spyware detection and removal software and the VX2/MSview is found and the add/remove programs contains a win32 bi app, you only needed to uninstall and then reboot the computer and the host.dll would then be removed along with the rest of the objects.

That was ok until last week when I found another product at abetterinternet.com called Flash Talk (Please if you really want it, please go to www.flashtalk.com as it is free of any spyware and is the real thing that you need to pay to use). 

Popups from Better Internet Inc. for the Flash Talk have still yet another new transponder variant - bi.dll along with the win32 bi app in the add remove programs.  Problem is if you have the host.dll with a win32 bi app and you then installed the Flash Talk, you would have a second win32 bi app in the add/remove programs but since there can only be one payload.inf you would not be able to uninstall the first one you installed as the code in the payload.inf will only remove the newest one installed.  This would leave the other spyware to be removed with a good removal program if detected but will leave a dead win32 bi app in the add/remove programs which is harmless.

I am currently working on how we will be able to resolve this new issue if it should arise.

Now: How did I get this spyware installed on my computer?  There is 2 known ways as of this writing.

1. Clicking on a popup install box from Better Internet Inc. for My Panic Button, Internet Accelerator, Clean Getaway, or Flash Talk.

2. Directly from their sites:  cleangetaway.biz or mypanicbutton.com.  Net Turbo and Flash Talk, I have not found a site that you can install the last 2 by as of yet.

Now a little bit about my self.  my site webhelper.netfirms.com is where I am compiling a history of 3 major groups, The VX2 corporation Transponder gang, the Lop.com group, and Trek data.  The first VX2 aka better internet inc aka direct-revenue I am also studing their variants as I find them and generate solutions for removing them.

Again thank you for allowing me here and I will try to help keep the members up to date on what to watch out for.