Virus warning from our 'puter guy...

[slodave]

That was supposed to be an example.

[J P Stein]

Originally Posted by azasadny

Whatever this malware is, it's got to be on some well known websites, not the "bad" places. My father got his from a bogus UPS email with an attachment and a friend's daughter got it from "normal" browsing. It used to be that you could stay away from the "bad" sites and avoid this malware, but not any more...

I prefered the "seedy areas" term.

[Teutonics]

So are there any good ways to avoid this or minimize the impact? Or am I playing Russian roulette every time I surf?

I use FF with NoScript, and knock on wood have been lucky so far. My wife was not so lucky last year with the Antivirus 2011 (or whatever it was). If she got it once, she will probably get it again...

For the experts, is there a way to run a virtual environment or something to isolate the browsing? Then if it was compromised you deleted the VM and start over from another copy of the VM. Is there a way to do that, or something similar?

[javadog]

I'm no expert but I told you how to do just that, in post #9 of this thread. Plus, it's free.

JR

[J P Stein]

Originally Posted by javadog

I'm no expert but I told you how to do just that, in post #9 of this thread. Plus, it's free.

JR

So, what (if any) downsides are there to download or run Sandboxie? What is Cost for the un-free version?

[javadog]

No downside that I have seen.

No idea what it costs, since the free version works just fine.

JR

[CurtEgerer]

Originally Posted by javadog

I'm no expert but I told you how to do just that, in post #9 of this thread. Plus, it's free.

JR

I gave it a shot over the weekend. Very easy to download and install. Works seamlessly. But the program is not intuitive for non-computer experts like myself. Very frustrating, for instance, to figure out how to get downloaded items 'out of the sandbox'. Uninstalled it for now. I need a Sandbox for Dummies version, I guess.

[Teutonics]

Originally Posted by javadog

I'm no expert but I told you how to do just that, in post #9 of this thread. Plus, it's free.

JR

Hmmm... I'll look again. I didn't see a free version. If I can get it working that's awesome!

[gr8fl4porsche]

The sandbox is located in the c drive. Ex) download something then go to c: sandboxie: user: drive: c: downloads. Hope that makes sense.

[RWebb]

doesn't Chrome provide this? it asks about every download that "might harm your computer"

or is Sandbox something more?

[masraum]

Originally Posted by J P Stein

So, what (if any) downsides are there to download or run Sandboxie? What is Cost for the un-free version?

There is none as far as I've been able to tell. The free version gives you plenty of functionality. The pay version seems to give you some more functionality, but I don't need it.

Originally Posted by CurtEgerer

I gave it a shot over the weekend. Very easy to download and install. Works seamlessly. But the program is not intuitive for non-computer experts like myself. Very frustrating, for instance, to figure out how to get downloaded items 'out of the sandbox'. Uninstalled it for now. I need a Sandbox for Dummies version, I guess.

IIRC, after going through the tutorial, there are a few locations where Sandboxie assumes that you will want to migrate downloaded stuff out of the sandbox and onto your PC right away, like "downloads", the "desktop" and "my documents". So if you download something to one of those locations, I think Sandboxie is supposed to ask you right away if you want to "recover" those files. I think the normal options are "Recover to same folder" meaning that if you saved to "desktop" that after recovery, the file will show up on the regular desktop. The other option is "recover to any folder" which I assume gives you the ability to put the file anywhere.

It's not hard, but you definitely need to go through the tutorial. It's a fairly short and mostly easy to follow series of web pages.

Originally Posted by Teutonics

Hmmm... I'll look again. I didn't see a free version. If I can get it working that's awesome!

I downloaded the version from here. As far as I can tell, it's free. I certainly haven't paid for it.

Sandboxie - Download Sandboxie

It's very easy to get working. When you install it asked me if I wanted to open firefox in a sandbox and it did. It even sticks an icon on your desktop to click to open a browser in a sandbox.

[MysticLlama]

The easiest way to not get this is to either close the popup with alt-f4, or right click the browser window in the task bar and close it. Killing the process will also work, or just rebooting.

Hitting the X on the popup doesn't work because it's part of the image and the window is drawn without an actual close X on it, so then you're clicking on the malware.

I've had it spring up a time or two and haven't had it take hold.

The important thing is to get your hands away from the keyboard and be careful about what you hit, even hitting the space bar can let it execute.

And always run an up to date system obviously.

I haven't seen this pop up in quite some time. I run MS Security Essentials because it works pretty well and it's lightweight. I went years without running anything with no major issues. 99% of the time, no matter what someone says, they clicked on something.

[SeanPizzle]

Originally Posted by azasadny

Timely thread as I just cleaned this piece of malware from my father's PC last night. He had everything patched and up-to-date and MSE was updated and running, but the malware got past it. Fortunately, we used a restore point from the day before and that cleaned it up. I then manually updated MSE and updated it and it found the malware and cleaned it up. What a mess that could have been!!

This is how I handled it as well. Restore point from a few days prior and updated Spybot Search and Destroy and MSE. No problems since.

[CurtEgerer]

Re: Sandboxie. I think it's a great concept and I want to use it. I just don't want to have to learn to use it Properly written software these days should need little, if any, instruction. It seems like I had to go thru 2 or 3 pulldown sub-menus and then keep going back to the confusing tutorial to figure out that "recovery" actually means 'remove your download from the sandbox'. Then there were all sorts of other clickable items with warnings that you would permanently lose things.

All I want Sandbox to do is 2 things: Provide an isolated area of my computer to safely browse the interweb and provide a simple one-touch button to retrieve my downloads from the box. I don't want 10 pull down menus and a de-coder ring to figure what these computer geeks are talking about. I'll probably try it again when I've got half a day to kill to learn the system.

[LSA]

Originally Posted by azasadny

Whatever this malware is, it's got to be on some well known websites, not the "bad" places. My father got his from a bogus UPS email with an attachment and a friend's daughter got it from "normal" browsing. It used to be that you could stay away from the "bad" sites and avoid this malware, but not any more...

A few of my users have been getting these emails as well as others claiming they have invoices attached, I'm very glad our firewall locks these attachments.

[72doug2,2S]

I hope I never get this, but here's a question. We have a music server and wireless.

If anyone is on my wireless are they considered part of the network?

There are Kindle's, Ipods, PlayStation 3, laptops, an internet TV and one deskop using the internet with file access to the music server.

Where should this sandboxie software be?

[javadog]

Originally Posted by CurtEgerer

Re: Sandboxie. I think it's a great concept and I want to use it. I just don't want to have to learn to use it Properly written software these days should need little, if any, instruction. It seems like I had to go thru 2 or 3 pulldown sub-menus and then keep going back to the confusing tutorial to figure out that "recovery" actually means 'remove your download from the sandbox'. Then there were all sorts of other clickable items with warnings that you would permanently lose things.

All I want Sandbox to do is 2 things: Provide an isolated area of my computer to safely browse the interweb and provide a simple one-touch button to retrieve my downloads from the box. I don't want 10 pull down menus and a de-coder ring to figure what these computer geeks are talking about. I'll probably try it again when I've got half a day to kill to learn the system.

It shouldn't take you 10 minutes to figure it out. With mine, I click on a desktop icon to load a browser window, which opens in a sandbox. Any window or tab I open from that point on opens in the sandbox automatically. When I download a picture or whatever, it automatically pops a up a window to recover it. That's one more click.

That's it. It ain't hard.

One downside that I recall now is when you delete the contents of the sandbox, any user names or passwords that the system remembers will be lost and have to be re-entered the next time you visit any site that requires them. Of course, I don't dump the sandbox unless I suspect I have a virus, so that could be months and months without needing to re-enter anything.

It really is that easy.

JR

[masraum]

Originally Posted by 72doug2,2S

I hope I never get this, but here's a question. We have a music server and wireless.

If anyone is on my wireless are they considered part of the network?

There are Kindle's, Ipods, PlayStation 3, laptops, an internet TV and one deskop using the internet with file access to the music server.

Where should this sandboxie software be?

The Sandbox software will only install on Windows PCs.

Yes, anything on the wireless would be considered a part of your network. The Desktop and laptops will be where you would want sandboxie.

[azasadny]

Remove Win 7 Home Security 2012 (Uninstall Guide)
Posted by Grinler on December 6, 2011 • Views: 77,115
Win 7 Home Security 2012 is a variant of the 2012 name-changing rogue program that changes its name randomly depending on the version of Windows it is installed on. This guide will cover the variant of the 2012 name changing rogue called Win 7 Home Security 2012. This rogue is promoted in two ways. The first is through the use of fake online antivirus scanners that state that your computer is infected and then prompt you to download a file that will install the infection. The other method are hacked web sites that attempt to exploit vulnerabilities in programs that you are running on your computer to install the infection without your knowledge or permission.
When installed, this installs itself as a single executable that has a random name consisting of three characters, such as anm.exe, that uses very aggressive techniques to make it so that you cannot remove it. First, it makes it so that if you launch any executable it will instead start the Win 7 Home Security 2012 rogue and state that the executable you initially wanted to run is infected. It will also modify certain keys so that when you launch FireFox or Internet Explorer from the Window Start Menu it will launch the rogue instead and display a fake firewall warning stating that the program is infected. It will then display an alert that impersonates a message from the Windows Action Center stating that your virus protection is off.
Once started, the rogue itself, like all other rogues, will scan your computer and state that there are numerous infections on it. If you attempt to use the program to remove any of these infections, though, it will state that you need to purchase the program first. In reality, though, the infections that the rogues states are on your computer are all legitimate files that if deleted could cause Windows to not operate correctly. Therefore, please do not manually delete any files based upon the results from this rogue's scan.
While running, Win 7 Home Security 2012 will also display fake security alerts on the infected computer. The text of some of these alerts are:
Severe System Damage!
Spyware and viruses detected in the background. Sensitive system components under attack! Data loss, identity theft and system corruption are possible. Act now, click here for a free security scan.
Virus Intrusion!
Your computer security is at risk. Spyware, worms, and Trojans were detected in the background. Prevent data corruption and credit card information theft. Safeguard your system and perform a free security scan now.
Win 7 Home Security 2012 Alert
System Integrity Check
Warning! Sensitive data may be sent over your internet connection right now!
Threat: Trojan-PSW.Win32.Antigen.A
Win 7 Home Security 2012 Firewall Alert
Win 7 Home Security 2012 has blocked a program from accessing the internet
Internet Explorer is infected with Trojan-BNK.Win32.Keylogger.gen
Private data can be stolen by third parties, including credit card details and passwords.
Threat Detected!
Security Alert! Your computer was found to be infected with privacy-threatening software. Private data may get stolen and system damage may be severe. Recover your PC from the infection right now, perform a security scan.
System danger!
Your system security is in danger. Privacy threats detected. Spyware, keyloggers or Trojans may be working the background right now. Perform an in-depth scan and removal now, click here.
Win 7 Home Security 2012 Alert
System Hacked!
Unknown program is scanning your system registry right now! Identity theft detected!
Threat: Backdoor.Perl.AEI.16
Privacy threat!
Spyware intrusion detected. Your system is infected. System integrity is at risk. Private data can be stolen by third parties, including credit card details and passwords. Click here to perform a security repair.
Win 7 Home Security 2012 Alert
Security Hole Detected!
A program is trying to exploit Windows security holes! Passwords and sensitive data may be stolen. Do you want to block this attack?
Just like the scan results, these security warnings and alerts are all fake and should be ignored.
While running, Win 7 Home Security 2012 will also hijack Internet Explorer and Firefox so that you cannot visit certain sites. It does this so that you cannot receive help or information at sites like BleepingComputer.com on how to remove this infection. When you attempt to visit these sites you will instead be shown a fake alert stating that the site you are visiting is dangerous and that the rogue is blocking it for your protection. The message that you will see is:
Win 7 Home Security 2012 Alert
Internet Explorer alert. Visiting this site may pose a security threat to your system!
Possible reasons include:
- Dangerous code found in this site's pages which installed unwanted software into your system.
- Suspicious and potentially unsafe network activity detected.
- Spyware infections in your system
- Complaints from other users about this site.
- Port and system scans performed by the site being visited.
Things you can do:
- Get a copy of Win 7 Home Security 2012 to safeguard your PC while surfing the web (RECOMMENDED)
- Run a spyware, virus and malware scan
- Continue surfing without any security measures (DANGEROUS)
Just like the fake security alerts, the browser hijack is just another attempt to make you think that your computer has a security problem so that you will then purchase the program.
Without a doubt, this rogue is designed to scam you out of your money by hijacking your computer and trying to trick you into thinking you are infected. Therefore, please do not purchase this program , and if you have, please contact your credit card company and dispute the charges stating that the program is a computer infection. Finally, to remove Win 7 Home Security 2012 please use the guide below, which only contains programs that are free to use.