I actually did most of those steps the other day, plus I also went thru the registry and deleted all references to IMG-0012.zip.
One thing - make sure you don't delete ALL lsass.exe files though - the one in \windows\system32\ is actually a system file that you need.
I didn't post results back here cos I wasn't sure it was dead - but after a couple of days I think I can say the virus has gone away for good.
]]>
http://beta.twelvestone.com/forum_thread/view/36473#579982
2007-09-14T12:10:47+00:00Reply by tenPlus 2007.09.14, 10:56AMOriginally posted by: Deus Ex Machina people still use MSN messenger?
hell yeah. The more successful young middle management people in the company use it for what it is - instant messaging. If they need to make an urgent request to a colleague at another company they just IM them. Emails are now regarded as snail mail - they get answered when they get around to it or are used as formal documentation. IM's are what get answered to right away. ]]>
http://beta.twelvestone.com/forum_thread/view/36473#579970
2007-09-14T10:56:25+00:00Reply by BOBBYLOVEVILLE 2007.09.13, 08:21PM
http://beta.twelvestone.com/forum_thread/view/36473#579747
2007-09-13T20:21:29+00:00Reply by Deus Ex Machina 2007.09.13, 07:51PM
http://beta.twelvestone.com/forum_thread/view/36473#579721
2007-09-13T19:51:06+00:00Reply by X-DUD!!!11~~ 2007.09.13, 06:43PM ]]>
http://beta.twelvestone.com/forum_thread/view/36473#579678
2007-09-13T18:43:23+00:00Reply by mperazac 2007.09.13, 06:39PM Try this:
STEP 4
Remove "Windows Sharing" from exceptions tab of Windows Firewall
STEP 5
Set registry data:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control]
"WaitToKillServiceTimeout"="20000"
]]>
http://beta.twelvestone.com/forum_thread/view/36473#579674
2007-09-13T18:39:30+00:00Reply by X-DUD!!!11~~ 2007.09.12, 05:49PM Yeah, I'm that l33t.
Or so I thought... :O
File C:\Documents and Settings\Jody\Local Settings\Temp\nsiCA8.tmp\touchanswer.exe is infected with probably a variant of Win32/TrojanDownloader.Agent trojan.
Where der fark did DAT come from!? ]]>
http://beta.twelvestone.com/forum_thread/view/36473#579265
2007-09-12T17:49:13+00:00Reply by DontBogartMe 2007.09.12, 11:15AM
http://beta.twelvestone.com/forum_thread/view/36473#579186
2007-09-12T11:15:03+00:00Reply by DontBogartMe 2007.09.12, 11:13AM
http://beta.twelvestone.com/forum_thread/view/36473#579184
2007-09-12T11:13:40+00:00Reply by JimmyTheGent 2007.09.12, 10:46AM
http://beta.twelvestone.com/forum_thread/view/36473#579182
2007-09-12T10:46:22+00:00Reply by DontBogartMe 2007.09.12, 10:41AM What it does is send your MSN Messenger contacts a message saying something like 'Hi, I'm going to post this photo of us to my myspace, what do you think?' then it sends you a ZIP file.
In that ZIP file is the virus.
Yeah it was indeed a bit stupid to just open that file, but it came from a trusted contact and it seemed reasonable enough - the wording of the message is quite good.
After realising I'd been had - I scanned the original file with AVG, but it said it was ok.
There isn't much info I can google at the mo - I've seen a few things, but nothing so far works. If anyone else gets it, and finds a solution that actually works, post back here?
*waits for the 'get a mac' suggestions... ]]>
http://beta.twelvestone.com/forum_thread/view/36473#579181
2007-09-12T10:41:11+00:00
]]>