Member Avatar for dlh6213
dlh6213 27 Posting Maven

See this bulletin from Microsoft for complete details:

  • 1 Contributor
  • 0 Replies
  • 114 Views

Dani AI

Generated

As posted the Microsoft advisory, below is a concise, practical checklist that fills the gap between "read the bulletin" and actually protecting or recovering machines. These steps are deliberately general — they apply to Sober-family worms and other email-spreading executables — and avoid vendor-specific instructions the original post already links to.

Immediate steps to contain infection:

  • Disconnect the PC from the network and Internet (unplug Ethernet, disable Wi‑Fi).
  • Do not open any suspicious messages or attachments on any machine that shares the same mail account.
  • On mail clients/servers, suspend the affected account or stop the mail service to prevent outgoing spam.
  • Work from a known-clean machine for all remediation tasks that require the web (downloading tools, changing passwords).

Cleaning and verification:

  • Update antivirus signatures on a clean machine, transfer updates if needed, then run a full scan or use an up-to-date rescue/boot CD from a reputable vendor.
  • Boot the infected PC into Safe Mode for scans or use offline rescue media if the malware prevents normal operation.
  • Check common persistence points (startup folders, Scheduled Tasks, services and Run keys such as HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKCU\...\Run) and the Hosts file for tampering.
  • If automated tools cannot fully clean the machine, restore from a verified clean backup or rebuild the system. After cleanup, change all credentials from a different, clean device and enable MFA where possible.

Prevention and follow-up:

  • Keep OS and applications patched, disable Autorun for removable media, block executable attachments at the mail gateway, and use layered AV/antimalware scanning.
  • Scan other machines and review sent-mail/SMTP queues for propagation. Monitor accounts used on the infected PC for fraud.

Cautions: avoid manual registry edits unless confident, and when in doubt prefer restoring a clean image. The Microsoft advisory linked by is a useful technical reference — follow vendor removal tools and guidance where available.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.