Spyware attached to ES?

[Guest Fletcher James]

I just finished a half-day session removing Troj/BDoor-CPK and related trojan downloaders, from a desktop PC. The symptoms were that the user would do a Google search, and a couple of minutes later, an IE window would pop up, offering to search a dozen other sites. If they visited Travelocity, then an alternate travel site would pop up.

 

When we traced things back, we discovered that the infection started exactly at the time (to the minute) that the user had installed an update of ExpressScribe from the NCH site, on April 7th. Of course we cannot rule out the possibility that some other web action was the cause, rather than the ES install, but I though we ought to post this to the forum.

 

Has anyone else encountered similar problems associeated with ES? If so, please contact me directly -- fjames@levitjames.com -- and I can point you in the direction of getting your PC cleaned up (it's not easy!)

 

Fletcher James

President

Levit & James, Inc.