Danny B

My 8yr old boy was chatting to one of his mates on Messenger when his mate *appeared* to say to him install this (link now removed) and foolishly he clicked on run and nothing appeared to happen so he thought nothing of it.
When he next launched IE it went to a different homepage and then he called me to have a look.
After a quick look at the .exe it doesn't appear to be detected by Mcaffe so I'm wondering what the hell it is as when ever he chats to anyone on MSN it is sending fake messages asking them to install it and saying how good it is etc.
The PC has now gone nuts after a reboot and keeps dropping out halfway through chats etc.
Feckin kids, I knew I should have removed him from the admin group..

Any ideas anyone? I have purposely left the link for any kind souls to download and check with their virus guards, PLEASE DO NOT EXECUTE IT!!

Cheers


ps- Now I know why I have a Mac

Danny B

Oh, I should mention that the messages it is sending on my behalf seem to rotate but always have the link in the message.
The icon looks like a proper microsoft package which makes things worse.

JackClark

It's a new, but known threat, email me on Monday and I'll either make sure you recieve an update or send you a fix. jack_clark@mcafee.com

p.s. can you remove the link please, we have a sample.

Danny B

Thanks Jack, I will contact you tomorrow. I don't know if you are aware but it also disables the McShield service.
I am running Mcaffee Virus Scan V4.5.1 SP1 virus defs 4.0.4557 which didn't detect it.

JackClark

I'll get you an extra driver on Monday.

Danny B

Hi Jack,
I have e-mailed you from my work e-mail address.

Cheers
Dan

JackClark

All done, detection and removal in tonights update. Thanks for the sample.

Danny B

Cheers, it has now been detected and removed

Thanks for the help

JackClark

Great to hear, I'll let the lab know.