Help -- SKYNETAVE.EXE replicating on XP boxes

Factual Questions
1

We have a couple XP boxes here at work that crash a few minutes after startup.

The chief symptom, other than the BSOD of course, is a process named “skynetave.exe” that replicates itself again and again until the machine bluescreens with a driver error.

I’ve searched Google and McAfee and Symantec and Slashdot and SDMB, and found no instances of that name, except for a usenet post by one poor French fella this morning who appears to be having similar problems if I interpret the french correctly (translation sites are blocked here…)

Can someone help me understand what the h-e-doublehockeysticks is happening here?

I’ve suggested to the users to search their registries for instances of this process name and delete all of them, but so far I have not heard back.

First Sasser and now this…

I’m glad I’m still running WinNT4.0…

2

A search on Sophos.com on just the string Skynet seems to indicate that your machine might be infected with a netsky variant.

3

It’s a version of Sasser: http://www.sarc.com/avcenter/venc/data/w32.sasser.d.html

Users have to kill the process, update windows from http://windowsupdate.microsoft.com and then download a cleaning tool. Don’t clean it without updating or you’ll get infected.

Good luck. We’re dealing with it at work now. You can find some of our tools at http://www.siena.edu/antivirus/viruses/sasser.asp.