New experience

Hi guys!
I experienced Trojan/Spy first time in my life. When I was chatting with my friends, I got an instance message saying “We have a party tonight. Please join with us. Click this for more information: http:/ /nl-school.org” from one of my friends ID. I accidentally clicked on it. My computer infected with a Trojan svhost32.exe.
1. The homepage in the IE is changed to "nl-school.org".
2. Every time I log into yahoo messenger it is automatically sending out messages to all the names in the friends list with the link ......."check this link nl-school.org".
3. My MSN nickname changed to “Jeyaram – myglobal-news.com”.
4. Registry editor is disabled.
5. Task manager is disabled.
6. The options in the IE - Tools- Internet options - general tab- use blank, use current, use default options disabled.
7. Whenever I open MSN/Yahoo messenger, some box type windows open and close.
8. My computer all the way got stacked.
9. When I click on anywhere, a small menu displayed.
10. Screen shot button didn’t work.
11. I have run the ewido avg anti spy ware and could not find anything. I have ZA and AVG antivirus installed. Also, when I am not connected to the net, I get a pop up message “Program trying to access nl-school.org, which connection to use.”
If you got the same problem, start the computer in safe mode and system restore turned off. And run your anti-spy program. Now I recommend “Ad-Aware SE Personal”. Or use yahoo anti-spy. Yahoo anti-spy is very simple and efficient program. Yahoo anti-spy won’t work for this Trojan, if you don’t update.
Download Yahoo! Anti-spy!!
Is the Trojan/Spy gone and the computer is safe now??
Is it safe to use the yahoo messenger now (without sending the unwanted links to the friends list)?????

If you get any messages like this; be carefully.
"

• oh my god , I've won a 20000 used lottery http://myglobal-news.com/?id=winning_list . Come to my house tonight for a party !! ><
• have you ever seen such a silly man like this ? http://nsl-school.org?id=stories )
• Now you can avoid some critical online viruses by updating Windows . Click here to know how to Update your Windows : http://myglobal-news.com?id=update_windows <<
• Breaking news : Mr G.Bush's son is kidnapped by terrorists !!! http://myglobal-news.com?id=1423 !!

"
I don’t know!! Please post your comments. If you know any thing more about this spy post that also as comment.
__________________________________________

Well opening nsl-school.org drops svchost.exe and svchost32.exe (made in VB and UPXed) in ur windows directory.
If you open the page in mozilla / opera, its full of adbrite ads.
It can be considered a good case of social engineering by bgohil7@yahoo. com
as he wrote nsl-school.org as a link in his post. Reading this post many woulr open up nsl-school.org and get infected if they use IE.
nice one dude.
Some details that i figured out :
it uses msinet.ocx and web browser control for communicating with websites or downloading more file.
the programmer of this malware has these folders -
E:\Lucky\My Document\Visual basic 6.0\Downloader\
the VB project was saved as termex.vbp
it also drops taskkill.exe in windows\system32 folder
taskkill is used by program to end programs like Antiviruses etc.
It kills all anti trojan and anti virus tools.
makes a script c:\killav.bat to kill antiviruses
It accesses http://giftshop.vn/update.txt where the malware writer will put commands or url from which trojan would update itself.
Its spreading well - http://www.alexaholic.com/nsl-school.org...
besides it disables taskmgr and regedit too
it accesses myglobal-news.com and probably autoclicks ads
the Module1.bas has subroutines like KillAV() and Killenemy()
it downloads italiandirectory.com/termex/ho... which is renamed as svchost32.exe
also downloads italiandirectory.com/termex/ho...
the malware author also has registered the domain mytermex.com
I think the malware should be named "Termex" as far as the programmer wished.
I will post more if i find about this. We can easily nab this criminal as he left the names of websites/domains he bought.
more coming soon
happy hacking
lobbyshake
_______________________________________________
Spyware, Adware, Trojans, Malware, Dialers, Popups Scanners:
http://www.download.com/ad-aware-se-pers...
http://www.ewido.net/en/download/...
http://www.javacoolsoftware.com/spywareb...
http://www.download.com/bazooka-adware-a...
http://www.javacoolsoftware.com/sgdownlo...
http://www.safer-networking.org/...
http://www.download.com/hijackthis/3000-...
http://www.emsisoft.com/en/software/down...
Online Scanners:
http://www.webroot.com/consumer/products...
http://www3.ca.com/securityadvisor/virus...
http://www.pandasoftware.com/products/ac...
http://www.bitdefender.com/scan8/ie.html...
http://www.windowsecurity.com/trojanscan...
http://www.kaspersky.com/virusscanner...
http://www.spywareguide.com/onlinescan.p...
http://housecall65.trendmicro.com/...
Spyware, Adware, Trojans, Malware, Dialers, Popups Scanner Lists:
http://www.softpedia.com/catlist/104...
http://www.download.com/adware-spyware-r...
http://www.majorgeeks.com/downloads31.ht...
http://www.filehippo.com/software/antisp...
http://www.soft32.com/s/windows/security...
Antivirus:
http://www.grisoft.com/
http://www.avast.com/
http://www.free-av.com/
Antivirus Lists:
http://www.softpedia.com/catlist/1...
http://www.download.com/antivirus/3150-2...
http://www.majorgeeks.com/downloads29.ht...
http://www.filehippo.com/software/antivi...
http://www.soft32.com/s/windows/security...
Firewall:
http://www.zonelabs.com/store/content/co...
Firewall Lists:
http://www.softpedia.com/catlist/97...
http://www.download.com/firewalls/3150-1...
http://www.majorgeeks.com/downloads34.ht...
http://www.filehippo.com/software/firewa...
http://www.soft32.com/s/windows/security...
IP Blocker:
http://prdownloads.sourceforge.net/peerg...
Browser:
http://www.mozilla.com/firefox/...
Email, News, RSS:
http://www.mozilla.com/thunderbird/...
System Cleaner:
http://www.ccleaner.com/
System Cleaning List:
http://www.softpedia.com/catlist/98...
http://www.majorgeeks.com/downloads12.ht...
http://www.filehippo.com/software/cleani...
System Info:
http://www.softpedia.com/catlist/92...
http://www.majorgeeks.com/downloads9.htm...
http://www.soft32.com/s/windows/system_u...
_______________________________________________
Thanks: Yahoo! answers