Seeing this comment more than 10 Years later, I want to thank you (better late than never :-D)
And yes, Kaspersky Teams do have their minds at the right place indeed, no matter how many disinformation or global politics campaigns are ran against it.

Hi Hexdieno,

This threat was discovered quite a while ago. All reports we ever prepared on Flame were published on Securelist. You can try searching this tag: https://securelist.com/tag/flame/. If the information you search isn’t there, most likely, it is nowhere.

However, I am looking for deeper technical details about the initial discovery process.

Specifically:

What concrete technical indicators first led to Flame being identified (e.g., anomalous network traffic, memory artifacts, unknown modules, forensic disk findings)?

Was the initial detection based on network telemetry, incident response imaging, behavioral analysis, or reverse engineering of samples provided by the Iranian CERT?

Are there any published forensic logs, packet captures, hashes, or technical write-ups describing the exact moment or method of identification?

I am not looking for high-level summaries, but for technical documentation describing the original detection vector and forensic process that led to the identification of Flame.

Hi Georgi,

Here’s what you can do:
– If you have a backup made before the infection, use it to restore the system;
– Clear your browser’s password storage. Moving forward, use a password manager instead of storing passwords in browsers;
– Reset your email account passwords, and those for all services linked to email;
– Install an internet security solution and run a full system scan.

We recommend installing Kaspersky Premium and performing a full system scan. Once you have the scan results, you can contact support for further instructions or additional assistance.

I believe my computer may have been infected with the malware which is described in this article.

A few days ago I downloaded the game Norland from dodi-repacks[.]site. After installing it, suspicious activity started.

My email account was accessed without permission. Password reset codes were requested. Some accounts were taken over, including LinkedIn and Instagram. Someone also accessed my contact lists.

I removed some malware but I am not sure the system is clean.

I would like expert advice:
1. Is full Windows reinstallation required?
2. What forensic steps should I take before reinstalling?
3. What data should I preserve for analysis?

Any guidance would help.

Thank you.

Hi Mark,
Feel free to use the md5sum, sha1sum and sha256sum hashing tools in your malware analysis.