Sheesh, just caught "XP Security 2012"

[Mosca]

Be careful out there. I consider myself super-savvy on this stuff. I got it from a link on CNN's main page, a link to a local news station.

Microsoft Security Essentials shut down both browsers (I'm at work). I restarted in Safe Mode, used System Restore to go back to yesterday, and right now I'm running Malware Bytes (recommended for this infection by Bleeping Computer).

Tell you what, I can see how this can catch you easily. It sets itself to go off every time you click a .exe file, and it integrates itself into the MSE popup. If the graphics were just a little more professional looking I might have been snagged, but I know what's guarding my computer already and I knew I didn't have that one.

 

[klpca]

I did that to myself at work a couple of weeks ago. I wasn't practicing safe searching (just clicking link after link looking for a certain court case) and up it popped. At least it happened while I was doing legitimate work!

 

[timeos2]

You must also turn OFF system restore or it will keep returning as it hides in there. In safe mode run smitfraudfix.exe (you download that) & then malwarebytes. It's nasty - one of the worst
Good luck .

 

[Mosca]

I've done a restart and rescan, John, and it looks to be OK now. But yes, absolutely you are correct. It hides in System Restore.

This one is called Win32/Patchload.P

Piecing together the scanlogs, it looks like MSE caught it halfway through its install. After the restore, Malware Bytes removed files, but didn't find any registry entries for it. If it were still hiding in System Restore the registry entries would have shown up in the scan after the restart, so I think I'm clean now. Fingers crossed, though, as always with this stuff.

 

[timeos2]

Hope it got caught in time. It doesn't hurt to download & run the smitfraudfix anyway - it finds all the hiding spots.

Glad to hear you seem to be OK.