Mrs B down loaded a audition pack for a theatre production the other night via sendspace.com.
Immediately after that Internet explorer diverted to a web page called easy life. Suspicious we did some looking in to it. IE and google chrome are basically hijacked so any web searches and shopping you do seams to go through this easy life. They then use that data to hit you with spam. And much as I like tinned horse meat...I didn't want this.
It seams that this easy life is a new company who have chosen to use this method to get on the radar. Posts on forums seam to have started since Christmas.
More research pointed to two new folders in C:/ program files/easy life and c:/program files/browsetobuy. A file called s protector.dll had been created and this was the malicious bit.
I used this thread in
www.bleepingcomputer.com to get advice on how to clean the machine but this thing is so new most virus software is missing it. I eventually deleted the folders manually, reset the default home page and uninstalled chrome.
If search for files containing easy life of browsetobuy some files are still showing up even though the folders are empty so I am not convinced its cleared yet. I spent 5 hours on it last Friday....I need to do a bit more yet until I am happy!
