Kaspersky offers guidance on Flame

Researchers at Kaspersky have issued further guidance to anyone who thinks their PC might be infected with the Flame virus.
According to a blog post made by the head of Kaspersky’s Global Research and Analysis Team, Alexander Gostev, the main warning sign of a present or past infection is the presence of a file called ~DEB93D.tmp.
Furthermore, if the registry contains files called mssecmgr.ocx or authpack.ocx then the system is currently infected.
The virus is able to download additional software components, likened to apps, to expand its capabilities and it is thought to be derived from or inspired by a piece of software called Flexible Lightweight Active Measurement Environment.
“The FLAME software is used to measure network characteristics by deploying measurement agents and collecting data in a central database. Despite some similarities, we think that this software is unrelated as it serves different objectives,” wrote Gostev.

http://www.pcr-online.biz/news/read/...n-flame/028423