Anti - antispyware

[Carlos]

Hello dear people,
Just one our ago i did find a virus in my computer.
It was not detected by my firewall, antivirus nor the
antispyware. Why? I do not know.
I will love to send you the file named systr.dll, located
at \windows\system32 over a XP enviroment, it cames with
a file called 39.exe which disappear once it was
installed. It modifies the bahaviour of the internet
explorer and give some messages related to update the ms-
antispyware.
Ok it is enouhg. i am really tired to fight and i will go
to bed.
As you can see i am not a hacker or something "great"
like that i just had some patience.

 

[Bill Sanderson]

Carlos - here are a couple of URL's for sites that will allow you to submit
this critter to multiple Antivirus vendors at once:

http://www.virustotal.com/flash/index_en.html

http://virusscan.jotti.org/

 

[Steve Wechsler [MVP]]

Hello dear people,
Just one our ago i did find a virus in my computer.
It was not detected by my firewall, antivirus nor the
antispyware. Why? I do not know.
I will love to send you the file named systr.dll, located
at \windows\system32 over a XP enviroment, it cames with
a file called 39.exe which disappear once it was
installed. It modifies the bahaviour of the internet
explorer and give some messages related to update the ms-
antispyware.
Ok it is enouhg. i am really tired to fight and i will go
to bed.
As you can see i am not a hacker or something "great"
like that i just had some patience.

Carlos,

systr.dll is identified as CWS.Aff.Winshow.6:
http://www.richardthelionhearted.com/~merijn/cwschronicles.html#winshow

Apparently it's being used to infect IE and then for IE to get you to
install a malicious file ("update"). If that's the case and you still
have the systr.dll, could you compress it to .zip format, name it
sample.zip, password protect it, email me the file, and the password,
please. I'll get it to MS.

Thanks,

Steve Wechsler (akaMowGreeN0
MS-MVP 2004-2005
Windows Server - Software Distribution
Windows - Security