Possible new spyware/worm

An odd case here:
XP2600 box running XP Home SP1, IE6 wouldn't load, but was showing under processes in Task Manager, but only using 8Mb or so of memory.
I cleaned off a lot of junk with Adaware and Spybot, installed AVG and got rid of everything it found, mostly trojans. IE6 still wouldn't load.
Hijack This showed a funny file, msbl.exe in the log. Windows let me delete it but the file and the registry key were re-created on each boot.
It turned out to be another file, mslb32.dll which was responsible for this. This file wouldn't delete. I only found the mslb32.dll file by looking at files in the system32 folder by date to see what else had the same date stamp as the msbl.exe file and looking in a text editor at the file contents. I have no idea of the origins of these two files, Google turned up a very few links with little to be gained from them.
I eventually fixed it by deleting the files in safe mode command prompt and dumping the registry key again.

Snippet of HijackThis log:

F0 - system.ini: Shell=explorer.exe C:\WINDOWS\System32\msbl.exe
F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\System32\msbl.exe

Adaware, Spybot, AVG and Trend Micro's Housecall all missed this little horror.

I'd be interested to hear if anybody else has seen this particular beastie before. Nothing else appeared to be affected, only IE6. Maybe this will save some of you some time, I certainly used enough of my time cleaning this box !

While that may be a new kind of spyware, the tactic of loading something else with the default shell in those ini files is an old virus trick...thought XP didn't use those anymore! Oh well, yet another place to look for crap again...thanks for the heads up!

http://www.computing.net/windowsxp/w...um/110053.html

Quote:

---

Originally Posted by dogwoodwind

http://www.computing.net/windowsxp/w...um/110053.html

---

Welcome to WD dogwoodwind .

Thanks for link :thumbs:

So this could be a nasty Virus :sad:

Google's indexed this thread now. My work is done and the answers are there for all the world to see. I'd still like to know what the little beggar is and who is responsible for it though.
A couple of Google links suggested it might be from 180 Solutions nCase, but that puts in a file named msbb.exe and is easily dealt with by Adaware or Spybot.