a link for xfotos2006.zip appeared in MSN chat window during a convo.
Scans found no virus but when the zip was opened xfotos2006.exe was created and copied itself to win32 system folder.
It also started running as a Process but not as an Application.
Also according to the registry Avast! was running it on startup.
I believe I’ve removed all instances of this program from my PC.
Anyone know what it was?
I can’t find any relevent references to it on Google
Which one? With Standard Shield? Which is your sensitivity level: High or Normal?
Where were you extracting the files? Is a real zip or the first archive was an executable?
What do you mean? That just it does not have a window (GUI)?
How?
Which one? With Standard Shield? Which is your sensitivity level: High or Normal?Avast!v4.7, sensitivity normal, right clicking file then selecting scan from menu
Where were you extracting the files? Is a real zip or the first archive was an executable?I created a subfolder and downloaded the .zip, scanned the zip, extracted the .exe, then scanned the .exe (using the right click menu option in Win Explorer)
What do you mean? That just it does not have a window (GUI)?I do not recall deliberately running the exe but I checked Task Manager anyway and found it running in Processes but not in Applications
How?I searched in Explorer for all instances of 'xfotos' and deleted them, then used RegCleaner 4.3 to remove the entry from the Startup list