The trojan-downloader installing the rogue is also registering a LSP Hijack that blocks some sites, displaying an error message in the brower:
Restricted Site!
This web site is restricted based on your security preferences.
Your system is infected. Please activate your antivirus software.
Hijackthis symptoms:
O10 - Unknown file in Winsock LSP: c:\windows\system32\helper32.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\helper32.dll
Sites blocked by this Malware are:
facebook.com
youtube.com
myspace.com
live.com
craigslist.org
wikipedia.org
ebay.com
blogger.com
amazon.com
twitter.com
go.com
bing.com
flickr.com
wordpress.com
photobucket.com
weather.com
nytimes.com
linkedin.com
pornhub.com
mapquest.com
foxnews.com
hulu.com
livejasmin.com
youporn.com
digg.com
adultfriendfinder.com
mywebsearch.com
rapidshare.com
redtube.com
ask.com
tube8.com
imageshack.us
livejournal.com
thepiratebay.org
xvideos.com
godaddy.com
mozilla.com
washingtonpost.com
monster.com
bbc.co.uk
bebo.com
guardian.co.uk
Do not delete the LSP File without unregistering it, you will break the Internet connection !
If your PC is infected with Internet Security 2010, use MBAM to remove the infection.
