What a good article
Thanks for writing such a good article, I too have seen this on several computers and marvelled at how well written it was, other things I saw this malware do once installed
1) disconnect ethernet adapters
2) display a "your machine is infected" screen when you browse to any web site
3) suppress opening AVG Free and Spybot
4) Fake blue screen of death's (ctrl+alt+del and then cancel to get back to your desktop)
In the end I downloaded malwarebytes ant-malware and installed that (first killing the antivirus 2008 process in task manager) Malwarebytes successfully detected and removed over 20 malicious files from one machine.
The user claimed to have been infected after clicking a link in a spam about a reciept for airline tickets that I know has massively been doing the rounds.
Once again what a good document.
Biting the hand that feeds IT
