My virus protection software caught it on two consecutive occasions. It shows as a fake Microsoft link that transfers the virus if you click on the link. It acts like a cookie and is recognized by the virus protection software which removes it with a reboot.