Virus warning from our 'puter guy...
 

As many here know, I'm a computer illiterate. I use a local guy for computer service, etc. Here's a cut & paste from his latest newsletter about a tricky virus that needs a heads up:

"Virus Alert
Right before Christmas we have several customers who have been hit with some pretty bad viruses.

One really bad one is called the Win7 Virus. It tries to look like Windows security, but it is not. These viruses are so bad we have had to reload several systems. It makes repairing it with our normal tools and processes almost impossible.

Remember, do not touch any weird windows or pop ups with your mouse. If you try to close the window by clicking on the X, that virus will own your computer.

Hit Control/Alt/Delete all together, then go to task manager, and select the window, and choose end task."

The Win 7 antivirus 2012 malware is horrible. I had a client get the xp version recently and it deleted files related to networking and registry entries. My laptop, running 7, was hit with it earlier this week and it's pretty much hosed. I've done everything but an in place install and worse case, full reinstall.

MSE is useless against it as are most other programs.

Yeah.....got the pop-ups but never opened them. Just getting rid of the pop-ups was bad enough for a semi-puter literate soul.

Normally I don't post the usual email "virus alerts" I get....but this one seemed worth posting the warning.

It seems that Ctrl-Alt-Delete is your only friend in this case.

Yeah, my daughter managed to get it on one of my dev PC's last weekend.

It can be removed but doing so totally hoses the registry and you lose all app associations.

It basically associates .exe with itself so no matter what app you try to run it opens the malware.

Easiest fix I found to avoid reinstalling the system is to remove it, create a new user account then migrate the user data from the infected one to the new one.

Not quite. It'll come back when you restart. There is a way to clean this one, but the steps have to be followed. Time for me to adapt. My old tricks for removing the previous versions no longer work.

One hint, but I did not get to try it, is to set your computer clock ahead by 7 days. It's reported that it will uninstall itself when this is done.

It's easy to fix the exe association. A lot of files needed for networking have their permissions removed. I had to go into the system32/drivers folder and put them back. On XP, it deletes AFD.sys and it's registry entries.

Restarting did not help in my situation.

Look into running a sandbox. I do this and have had no virus issues since I started. Part of your disc is quarantined and that's where you run a web browswer. Get a virus? Delete the contents of the sandbox and you're done.

Sandboxie - Sandbox software for application isolation and secure Web browsing

JR

Nice for home users. Not so much for the business clients.

Malwarebytes worked for me

http://forums.pelicanparts.com/off-topic-discussions/647728-windows-vista-antispyware-2012-a.html

1. Get a good anti-virus program. I use the free version of avast.
2. Never use Internet Explorer for your web browser.

The Win antivirus gets by everything. :) It also doesn't care which browser you use.

Just curious if any of you have any idea where/how your computers were infected.

For me, I think based on some of the file creation dates I found, it was when I was cleaning a clients pc.

It's network aware and scans for computers on the same network.

Time for me to isolate a network at home for this.

I'm gone for now. Taxiing to take off from Las Vegas and heading to Death Valley.

If and when it gets to me, I will pick this unit up and toss it as far as it will fly. I got it out of the trash, held on to it in case. Well, the in case happened last year and my computer with all my stuff sits on the floor behind me.

I know I can last the rest of my life on older castaways. In fact, really all I need is older castaway HD's. Or out of date crap from overstock.

Afet having been enamored with computers for 15 years, I now find they are really, really boring time sucking machines.

Thanks for the warning Paul, but if I suddenly disappear, you'll know what happened.

I had one earlier this year on our neighbors laptop. It had some autoclose sequence on the task manager. It also would move the cursor if you got near certain things. Really tough. I had to use Combofix and then Malwarebytes.

Hello from Death Valley.

The 2011 and prior versions were easy to get rid of with combo fix and MB. 2012, not so much.

Glad you made it!

I got this and lost all my file associations. I was able to get rid of the "virus" itself with Malwarebytes, but the damage is done. It completely cleared my desktop. In order to run any applications, I have to go to "My Computer", and find the application file in the appropriate folder, right click on it, and choose "run as administrator".

Can anyone help me get the file associations back? Heck, I even tried to install a copy of XP over the top of this Vista just to start over and I even got an error when booting from the Windows CD!

Thanks,

JA

I can, but when I get back home tomorrow evening.

If you opened any of their pop-ups I can't help.
Once I got the pop-ups I couldn't do much of anything even in safe mode....except...
If you have Vista, hit the start icon on the bottom left.
Go to backup & restore system.
Follow the instructions that come up.
I got nailed on Dec 26 (Merry Christmas MFer) but restored the system to Dec 1.
It apparently buried the SOB. It takes a couple hours to run.
Good luck.:D

It's that time of the year again....my subscription for my Anti Virus is up.

Norton and Mac Affee suck so bad that I would buy a MM motor first.

Trend has been relaible but this last year....it sucks too.

What's the buzz on the better all around protection?

The freebies don't do the job either......

It got past our eset nod 32 and infected our win 7 machine

I just got nailed again. I had downloaded anti-malware in the interim and the bug went right through it. The nasty SOB is agile. Re-did the restore bit and it was sitting on it.......s***. I was able to get around it tho & do the restore.....I dunno exactly how tho as Paul said, I'm computer illiterate also.....but stubborn.

umm, a Mac? :eek:

Knew that was coming.....I once gave a thumb drive to some MAC wanker, he downloaded some files and it had a virus on it when I uploaded the files on my laptop......he laughed until I backhanded his ass....I also told his boss I didn't think it was funny.

Zeke, going to the same porn site again?

Microsoft's free stuff seems to work pretty well.

Microsoft Security Essentials - Free Antivirus for Windows

I've converted from Trend Micro to this stuff including my wife and mother. I also have them using Firefox instead of IE.

uh huh...

OS X Lion Includes Serious New Security Vulnerability | MacTrast

OS X

Apple OS X Vulnerability: Advanced Persistent Attacks - Security - Vulnerabilities and threats - Informationweek

Mac OS X security myth exposed - Techworld.com

Researcher Rates Mac OS X Vulnerability 'High' - Dark Reading

AppleInsider | Security firm warns of Java vulnerability in Mac OS X

Mac OS X Lion Password Vulnerability: Sleep Mode - Security - Vulnerabilities and threats - Informationweek

I read those, but have yet to know anyone who has had problems with any of them. And I know a *lot* of Mac users. Most of it is FUD (notice who reports them - companies that make "anti-virus" software). Viruses and malware on the windows side however are as common as stupid comments from politicians.

Yeah, that 2004 article is certainly up-to-speed on the current state of things :D

Timely thread as I just cleaned this piece of malware from my father's PC last night. He had everything patched and up-to-date and MSE was updated and running, but the malware got past it. Fortunately, we used a restore point from the day before and that cleaned it up. I then manually updated MSE and updated it and it found the malware and cleaned it up. What a mess that could have been!!

I was hoping that you wouldn't notice the date on that one. I did find try to put the articles from 2011 at the top of the list.

I think the key isn't that OSX is completely secure and Windows is Swiss cheese. I think the important point to remember is that if you want to catch as many folks as possible you target the biggest group which would be Windows users that use MSIE.

If you want to recruit as many bots as possible to launch attacks, or if you want to phish as many PCs as possible or if you want to wreak as much havoc as possible, you'll attack the most common OS and browser. That's why Windows gets the bad wrap, because more folks use it so more folks target it.

I was curious, so I installed this on my quad core Win 7 64bit machine. I'm impressed with how transparent it is. I'm going to play with it some more.

Marketshare.....I always like to tweak the MAC users on that factoid. Crooks don't like MACs, just you Birkenstock wearing poopyheads with uglee toenails.....

You've really got a way with words and people there fella. :D

I bet you read that Dale Carnegie book, How To Win Friends and Influence People!

Just having fun with 'static.....

Yeah, I know. I may not have 21677 posts, but I didn't get here yesterday.

As I said, the thing is agile. A week ago the restore thing started up right off the bat and ran, this time the normal function was blocked. There just happened to be a "go around" that I stumbled over to make it work. The efinturds that wrote the bug are updating it as we speak it seems....the antivirus folks are sucking wind on getting their products working on it.

May there be a special place in hell for people like the "efinturds"...:mad: