New Malware Infection

Had a client with a system that was infected with an new strain of malware. It was identified as Trojan.Win32.Genome.arbx and was infecting the svchost.exe.

The system was running Windows XP Kaspesky Antivirus 2011. The client complaint was that the system had been locking up and running slow. Initial contact with the system was remotely.  Initial check show that the Kaspersky was was running and the database were up to date.

I checked  the task manager and found 6 iexplorer processes running without a user interface. Attempts to kill the process would restart a new process.  I updated Malwarebytes, Ran a scan Continue reading →