We already knew this about Mailskinner.
Recently new sites have been found to bundle the NaviPromo/EGDAccess Rootkit

go-astro.com
gorecord.com
sudoplanet.com
internetgamebox.com
web-mediaplayer.com
messengerskinner.com

http://www.geekstogo.com/forum/index.php?a...p;showentry=251

Regards,

Pieter Arntz
MS-MVP Windows Security

Thanks very much for the heads-up, Pieter!

I'm going to pin this as a sticky

Thanks CJ

Removal for those has been added to my BFU.
I'm gonna fine-tune it tomorrow after lots of coffee and chocolate.
And see if we can find some more of those.
Our friends from Zebulon have been a big help.

Take care,

Our friends at Zebulon forums are a wonderful bunch of folks, dedicated to the community and the fight against malware and I send my heartfelt thanks to them for their contributions in this war on malware. And to you, dear Pieter, a box of chocolates!

Thanks for the sweets.

I edited the first post to add another source of the malware.

Regards,

Edited again to add MessengerSkinner, reported by Malekal_morte

Sir Pieter "Metallica",

Love your very informative site. http://metallica.geekstogo.com/

(I had just sent an e-mail to my cousin to visit there also,)

I had been running through almost all the links to find helpful places,
I am a member at castlecops also, I came across an error in the listings:

(this is the only place I could find where you might get an email from me, sorry for buzzing you here.)

Zupe's list of LSP's (O10)

http://castlecops.biz/LSPs.html

The link should be .com.

Thank you very much for all of hard work in helping fight the adware and other malice on the
world wide web. All of our computer are safer with people like you and those who run sites like this.

Thanks for the heads up.

I'll keep a lookout for these sites.

LT