http://www.dslreports.com/forum/r20213441 en Sat, 28 Nov 2009 01:05:22 EDT Sat, 28 Nov 2009 01:05:22 EDT http://www.dslreports.com/forum/remark,20213441 Kiwi : Apparently is not a false positive...

"The malware determines the location of the current Windows folder by querying the operating system. The default installation location for the Windows directory for Windows 2000 and NT is C:\Winnt; for 95,98 and ME is C:\Windows; and for XP is C:\Windows.
%Temp% is a variable location and refers to the directory designated for temporary files. The malware determines the location of the current Temp folder by querying the operating system. A typical path is "C:\Documents and Settings\\Local Settings\Temp", or "C:\WINDOWS\TEMP".
If the current day is the 9th, it adds the following text to the infected file:

"This file is infected by Html.Lame!"
"What a virus! ;)"

Cheers]]> http://www.dslreports.com/forum/remark,20213441 Sun, 23 Mar 2008 17:39:14 EDT http://www.dslreports.com/forum/remark,20213403 anon : Maybe CA AV removed it initially. Thats why you did not find it again on the scan. I dont have this product so cant offer much more help. Are there any logs/quarantines/etc to look at?]]> http://www.dslreports.com/forum/remark,20213403 Sun, 23 Mar 2008 17:31:46 EDT http://www.dslreports.com/forum/remark,20213286 jbryan : I got the following message from my CA Anti Virus real time scanner progrm today. I ran a full system scan and CA does not find it. I tried searching for this on c drive and cannot find it anywhere. Any suggestions?

3/23/2008 13:39:23 PM File infection: \Device\HarddiskVolumeShadowCopy6\PAGEFILE.SYS is infected with JS/Lame.A virus. ]]> http://www.dslreports.com/forum/remark,20213286 Sun, 23 Mar 2008 17:07:51 EDT