<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
This AM a staff member had "Live Security Platinum" taking over her
PC.<br>
I think this is a relatively new variant.<br>
Staff accounts don't have admin status.<br>
<br>
Short story is:<br>
Running as an Admin<br>
Spybot didn't see it on a scan.<br>
Downloaded Malwarebytes which found and fixed it.<br>
<br>
Part of the log is:<br>
<br>
Registry Values Infected:<br>
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel
(Hijack.ControlPanelStyle) -> Value: ForceClassicControlPanel<br>
<br>
Files Infected:<br>
c:\programdata\7531cc92006afe3c0052668bf875ef60\7531cc92006afe3c0052668bf875ef60.exe
(Trojan.LameShield)<br>
<br>
c:\Users\staffuser\AppData\LocalLow\Sun\Java\deployment\cache\6.0\51\18da3ab3-213c42ba
(Trojan.LameShield)<br>
<br>
<br>
My point is, no s/w will find or protect against everything.<br>
<br>
<br>
<div class="moz-signature">-- <br>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="content-type">
<title>Email Signature</title>
<pre class="moz-signature" cols="80">R. W. (Bob) Neeper
<a href="http://sunbury.cool-cat.org" target="_blank">Community Library</a>
44 Burrer Dr. <a href="http://maps.google.com/maps?q=40.243961,+-82.863007">Map</a>
Sunbury, Oh 43074
Tel: (740)-965-3901
<a href="http://info.cool-cat.org"><img style="border: 0px solid ; width: 100px; height: 107px;" alt="cool-cat.org" src="cid:part3.00020408.01080903@oplin.org"></a></pre>
</div>
</body>
</html>