04-13-2012 03:36 PM
> New variants are continually appearing, so that one for last week or even yesterday
> is different enough to get past AV software at times.
Good point. And in such cases the question is "what vulnerability on your computer does it then use to get access?"
So in addition to keeping MS Windows updated, also check:
Java (ver 6, update 31; 1.6.0_31-b05)
Adobe Reader (9.5.1)
04-13-2012 05:08 PM
Yes, it seamed to open/close and run correctly. No, no detection.
Please read carefully
1. Please download aswMBR hxxp://public.avast.com/~gmerek/aswMBR.exe to your desktop. (replace the hxxp with http)
Double click the aswMBR.exe icon to run it
it will ask to download extra definitions - ALLOW IT / Yes
Click the Scan button to start the scan
On completion of the scan, click the save log button, save it to your desktop and Please attach the log in the post back
Download OTL hxxp://oldtimer.geekstogo.com/OTL.exe (change the hxxp to http) save it to your Desktop.
Double click on OTL.exe to run it. Right click OTL.exe and select run as administator for Vista and Win 7.
Click the Scan All Users checkbox.
Change file age to 60 days
04-13-2012 06:55 PM
It appears you have a file using a Alternate data Stream, that is pretending to be a email, I am trying to figure if all the shortcuts created around the same time on the desktop also belong to it.
04-14-2012 06:25 AM
Read all of this message first
Download Combofix http://www.bleepingcomputer.com/download/anti-viru
Doiwnload the attached CFscript.txt, Now drag the CFScript.txt into the ComboFix.exe
****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****
Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.
04-15-2012 05:17 PM
Uninstall Firefox completely, if will ask if you want all the data removed to, Do so (yes), So its's like Firefox has never been installed.
We will use Internet Explorer for awhile from now on until cleaned up. I will remove the ADS later