From: Jnthn (n_at_yahoo.com)
Date: Sun, 23 Oct 2005 13:57:01 +0200
There's a file named ms32.sys in the root directory of my boot drive.
It's an EXE file.
After deleting c:\ms32.sys, the computer began to shut down every 15
minutes: It was as if I clicked "Turn Off" in Start > Turn Off
Computer. Every single time, "W32Time" errors were listed in the Event
Viewer. I then disabled "Automatically synchronize with an Internet
time server" in Date and Time Properties but the problem became worse:
the PC would shut down shortly after loading the desktop.
I couldn't solve the problem so I put back ms32.sys in the root folder.
The PC doesn't shut down anymore.
I unpacked ms32.sys (it was UPXed) and found the string
"http://18.104.22.168/users/serg/web/serg.jpg" in it. I downloaded
"serg.jpg" and although it has a JPG extension, it's an EXE file.
When I go to "http://22.214.171.124," CMD.EXE starts on my computer. A
"Windows Script Host" error window pops up ("There is no script engine
for file extension '.vbs'.").
Neither AVG Anti-Virus nor HouseCall online virus scanner find any
viruses on the machine. I also ran Ad-Aware.
I couldn't find the string "ms32.sys" in the registry and there's
nothing suspicious in ...\CurrentVersion\Run.