VIRUS ALERT!

Hey everyone!

I just got hit by a virus, and thought it might be a good idea if I
gave everyone a heads up so they don't suffer through the 5
hours that I had to, to get rid of it.

This virus I believe is quite recent, so it would be a good idea to
update any anti virus\spyware programs you have.


It attacked my computer while I was surfing google, and the
moment it hit, my computer turned off. So I turned it back on,
wondering what had happened, and after it started up, this
warning appeared.


Being a clever WERD, I was somewhat suspicious that I would get
this warning, considering that Windows Firewall had been off at
the time.
So I clicked on the link it offered, making sure to be offline at the
time, so it wouldn't do anything bad if this was a virus.

It tried to take me to this site.


My suspiciouns were aroused and I was pretty sure this was a
trojan. So I got online on my laptop, and did some research.
And it WAS!
I found a tutorial about how to take care of it, so I spent the
next 5 hours downloading, and running anti spyware programs.

Heres the tutorial link.
http://discussions.virtualdr.com/showthread.php?t=236229

So I ran superantispyware and it detected these three files.


After that it seemed alright to connect to the internet and update
malware bytes, so I did, and then ran that and found 3 files
named fake.security alert.

So I deleted those, and everything seems to be fine now ^_^


If you get infected with this trojan, make sure to run all of your
scans in safe mode, because I'm pretty sure it was interferring
with the scans when I tried to run them normally.

I hope no one else gets infected, but just in case you do, this
should help.

WERDNA

can you be a little more specifc about the "while surfing google" bit?

is that a legitimate version of borland c++ builder you have installed?

I love it when people find a virus on their PC and proceed to capitalize the thread title in sheer panic... Especially when the naughty bit of code in question is 5 years old, which to me, would probably make it to any default virus definition list nowadays! :D

If the virus was a brand new one, then yeah, let us know...

Dabz

couldnt you have print screend the images instead of taking a camera to the screne?

That first screenshot isn't even Windows Security Center. Its a popup designed to trick you into downloading and installing software you don't want -oldest trick in the book. It wouldn't call a virus by its name and refer to it as 'software' for a start, and it certainly wouldn't prompt you to download and activate protection.

The viruses you found were likely there all along as a result of using a knock-off copy of Borland C++. The popup just prompted you to go and look for them.

Thanks for the warning anyhow. Very thorough of you. I don't see the borland C++ anywhere though? Unless it's the cbuilder?

Hmm, if Windows firewall tells you that you have a virus then you definitely should know you're being fooled.

Ooops and many others.

I've had my borland C++ for awhile now, so I don't think that
was the problem, although it is slightly suspicious that one of the
virus components was in the C++ folder.
I got my Borland C++ from a SAMS teach yourself C++ in 24 hours
book, so I think its legit.

Here is what I was searching on google.
http://www.google.com/search?hl=en&q=Tecra+m5+keyboard+repair&btnG=Google+Search&aq=f&oq=

I wasn't even at any of the sites, the virus just hit me while I was
looking at which link to click.

The fake security alert files were downloaded to a temporary google
folder, altough I don't remember exactly which one, because lol I
deleted my Malware log :(


Also Norton Antivirus couldn't detect this when I scanned and it didn't
block it in the first place either, so I don't think this would be found
on a default virus defenitions list. Especially since it took two anti
spyware programs to find all of it.
I think this experience has really made me realize just how useless
Norton is ^_^

I'll have to upgrade to Nod32 or F-secure as quickly as possible I think.

If it took antispyware programs to uninstall it, it probably wasn't a virus and those other programs wouldn't do much about it either. Unless of course your copy of Norton is a suite package in which case yeh stop paying them.

This is very similar to what happened to me Saturday morning. I was casually browsing,... nothing but "safe mainstream" sites.

I left the computer a bit for lunch, and when I returned I noticed a file "a.exe" on my desktop. I certainly didn't put it there, so I was a bit alarmed immediately. I dumped it in the trash and tried to do few searches. Shortly after this, all hell broke loose on my system. My browsers (both FF and IE) were completely hijacked. Any attempt to reach certain websites was re-routed to some "OMG YOUR COMPUTER IS INFECTED! CLICK HERE TO FIX!" type of website.

edit: forgot to mention that my computer was doing the same shutdown thing that you described. Right before I noticed the a.exe file.

Fortunately, I had just done a full backup about 2 weeks ago, so I decided to nuke everything. I formatted the drive and re-partitioned things a bit,...something I've been wanting to do for a while but never got around to it. This seemed like as good a time as any.

Anyways, I'm all back up and running now, but I hate not knowing where this bugger came from. I use AVG, and was mostly up to date on things. (A full scan of AVG didn't pick anything up though, even after the trouble started.

I should probably get one of those 'anti-virus programs'.. No wait, I'm using linux so I don't need one.

;)

Yeah there's no software for linux. Not even viruses work on it. ;)

Funnily enough, they work using wine.

WEREDNA: Come on guy, wise up and smell the coffee. Norton security is no security ;)

OK, it does pick up viruses and other malware, but it's an absolute dog of a system. Treat yourself to a dose of ESET's NOD32. You don't need the entire NOD32 system (firewall etc), just the anti-virus.

hehehe.

Oh, theres plenty of software, just no endless bottomless pit of corporate shovelware.
Most viruses dont work because they are not allowed to ;)

Who really wants to protect his browser should use a sandbox like sandboxie. (freeware, Windows 23bit only)

Or use Opera, instead of FireFox or (spit) Internet Explorer. Doesn't prevent you getting infected, but it does reduce the chances. Turn Javascript off if you really want to.

Yeah I know I need to get NOD32, Norton is just so useless :(

A sandbox is certainly a nice idea, but with my dial up, I probably
couldn't download it, LOL.

WERDNA