Virus WarningThis will definitely save some headaches

I just added that same email to my antiscam blog a few minutes ago, after it was forwarded to me by a friend.

Edit: Where you've typed "link removed.com" at the bottom of your post - the link to the zip file is still there.

Edit again: The link's been removed

Good share.

I find myself opening less and less emails these days, especially when I know; I didn't buy any Asian entertainment products... lately

Back to the editor:

Well after sleeping on this here is the outcome.

This is what happened.

As outlined in my original post, I clicked the link containing the infected file that is disguised as a link to an invoice and uploaded it to my Docs folder. When the file is clicked it doesn't open but it goes into action and it will not allow you to delete it in the normal way. Fortunately my anti virus program stopped it from doing whatever it was supposed to. The only problem I could see was that the Anti virus was flashing a huge red warning sign telling me that it had prevented it from running each time it tried and that became extremely annoying, as well as the fact that something has intruded into the machine. The computer seemed not to be affected in anyway. If it had not been stopped from running I've no idea of what it would do. I was tempted to let it run but caution prevailed since the computer is on a network. I tried three mala ware programs but they saw nothing.

If you try to delete the original folder it will not let you, you receive a message telling you it is busy. I managed to delete it by waiting for the Anti virus to tell me it had stopped it from running get a few delete clicks in at that time and finally zapped it.

But it wasn't finished; it had placed two files I mentioned before in a separate folder.
I found the folder by running Hijack This and reading the report. The files end with "windefender.exe and google.exe. It was pure luck that being familiar with most of the folders on my computer these looked unfamiliar and were in the Hijack This report. When I clicked on them I saw that they had just been created confirming that they were nothing to do with windefeder that is associated with xp.

My assumption is that the windefender.exe file allows the google.exe file to do its thing, whatever that is, but I'm not sure about that.

I tried using Hijack this to delete or repair these files but they were impervious to any attempt to delete them in anyway. Always giving an error message that they were busy or being used to run a program.

Since that was not working I gave up and went to bed... This morning when I booted the computer it locked up completely. It began loading windows and then shut down. Strangely the screen saver came on and was seeing the mouse but nothing else.

This is where the impossible became simple. With no alternative left I booted in safe mode got a bright idea and ran a restore to the day before. The restore saw the files and renamed them and end of story. Being renamed they couldn't work and since I was lucky enough to have deleted the original download there was nothing to re-install them.

I ran a search on C: drive and found them (the newly renamed files) in c:/windows/prefetch I copied them moved the copies to another folder just in case and zapped the original.

The outcome is the computer seems to be faster than before, probably because of all the anti mala ware runs I did.

So it was that simple.

Cheers
Milton

When opening mail from a foreign sender, always proceed with caution. If
you have a gut-feeling about the email, do not open it. Even though people
have an anti-virus, it will not fully 100% prevent the attack.

Using a hardware and software firewall can definitely help prevent such attacks
from occurring as you are able to set rules (Input and output).

Thanks for the heads up though...

I'm sure this will serve as a reminder for most.

Jake Gray