I read up on Kardphisher and found out that I had a newer version that was much nastier then the previous version. I kept trying to feed it bogus info but it kept calling me out on it. Finally I got it to accept some fake info a cc# of all 6's and it tried to send it away to wherever my personal info would have gone, but since I can't connect to the internet it would just sit there for longer then I could stay and watch it. I would leave and come back later to it saying it couldn't connect and if I wanted to Retry. I found I could just minimize the window at this point and have access to my desktop icons. From there I could run Smitfraudfix which would enable my taskbar and task manager. I then started scanning with all my antivirus programs. Avast, Ad Aware, and Spybpt S&D. I found I had Virtumonde among others and did what I could with those programs to remove them. Then more recently I scanned with Vundo Fix (which found nothing) and Malwarebytes. Scanning with all of these programs removed many of the symptoms (but I'm not convinced the stuff is gone. I remember Virtumonde being particularly stubborn from a previous run in, but it hasn't showed up in a scan recently) but nothing affected Kardphisher. I followed the advice for manual removal outlined here...
But could only find the registry entry related to the task manager being disabled, and nothing else. I became very frustrated as it was finals week at school and I had to leave my computer alone for few days while I went to school and worked.
Today through the task manager, I found that the process related to Kardphisher was called msoobe32. Then I deleted the msoobe32 file, from the startup tab in msconfig I disabled two msoobe32 startup items and deleted the related registry entries. A couple of startups later I have a slightly longer then normal start up, the Kardphisher window never pops up, but neither does my desktop or task bar. I can bring up my task manager, and from there run programs, but that's where I decided to stop since my roommate now has a computer and I can get on frequently enough to ask for help.
Edited by Orange Blossom, 11 February 2013 - 04:27 AM.
Deactivate link. ~ OB