AntiSpy Soft...

[johnhannibalsmith]

...has anyone had the pleasure of meeting this dandy little critter that hijacks your browser and declares every single application as "infected" - directing you to the one website that you can somehow get to - the one that purports to sell AntiSpy/Virus Soft so you can "fix" all of these reported viruses?

It has taken the better part of a couple hours to get anywhere extracting this little beauty from startup, registry, browsers, etc...

...it actually almost convinced me that something was actually really wrong when I first saw it, but alas, all the brilliant programming in the world to hijack a computer and these goofs still can't phrase their terrifying error messages using proper grammar, syntax, punctuation, capitalization...

[gregrph]

I've had the displeasure. I knew enough NOT to fall for it. Not sure how I got it in the first place. I've seen Super AntiSpyware 2010, etc. Malwarebytes Anti-Malware is a great program for removing this along with Hijack This. Get help with HJ though if you're not sure what you are doing. Many online communities can help.

...has anyone had the pleasure of meeting this dandy little critter that hijacks your browser and declares every single application as "infected" - directing you to the one website that you can somehow get to - the one that purports to sell AntiSpy/Virus Soft so you can "fix" all of these reported viruses?

It has taken the better part of a couple hours to get anywhere extracting this little beauty from startup, registry, browsers, etc...

...it actually almost convinced me that something was actually really wrong when I first saw it, but alas, all the brilliant programming in the world to hijack a computer and these goofs still can't phrase their terrifying error messages using proper grammar, syntax, punctuation, capitalization...

[johnhannibalsmith]

I've had the displeasure. I knew enough NOT to fall for it. Not sure how I got it in the first place. I've seen Super AntiSpyware 2010, etc. Malwarebytes Anti-Malware is a great program for removing this along with Hijack This. Get help with HJ though if you're not sure what you are doing. Many online communities can help.

I'm in the process of what has been a nearly three hour scan thus far using Malwarebytes' tool - but I think I got rid of most of the offenders when I started in Safe mode, ran msconfig, and turned off the proxy server scam in the browser. But, I'd rather go for overkill than assume I've done anything right.

I'm sort of dreading rebooting and seeing if it returns - I've managed to avoid nearly everything that's come down the road and like you, I have no clue where I picked this doozy up as I don't stray very far out of bounds ever. Thanks for the tip on HJ if I've missed something. :ThmbUp:

[bigmack]

You have brought in one of the most stubborn entities of all the viruses. The grammar is poor as they are written in Eastern block countries and have your computer at the ready to become a zombie.

You can run scan after scan, and I highly recommend Super Anti Spyware, but even still you will more than likely have remnants of a very nefarious nature.

If you can, back everything up and do a clean install of your operating system. Not to be an alarmist but it's actually a good thing to do every year or so.

[letswastemoney]

Couldn't you have just done a "system restore" and take your computer back to the state it was in before the virus?

I did this on a friend's laptop once. It had the same exact symptom of a program trying to convince her she had viruses.

I went into her system restore program, set the laptop to go back 3 days or so....and the laptop looked exactly how it looked 3 days ago before she ever contracted the problem.

[letswastemoney]

The only problem with "system restore" is that you will lose anything you saved or downloaded after the date you took the state of the laptop back to.

But if anyone wants to try that method sometime...it should work.

[Tom]

Funny you should post this thread - I got that hit Thursday at work.
Not sure what it was, our systems guy took car of it. I could not open any programs. It was trying to get me to buy a program/

[Tom]

The only problem with "system restore" is that you will lose anything you saved or downloaded after the date you took the state of the laptop back to.

But if anyone wants to try that method sometime...it should work.

Should you be making a new SR point say every week?

[Robert Goren]

Should you be making a new SR point say every week?With Microsoft me or later, it should be being done automatically after 10 hours of use 24 hours which ever comes first. It can solve a lot of virus problems, but not all. I do not know if it would solve this one. This virus tried to get on my computer a couple of days ago and Norton blocked it.

[chickenhead]

I got a call on the special Red family IT support phone the other night from my brother in law whose laptop had exactly this. After trying to embarrass him by first telling my sister to tell him to stay off all Asian Fetish Porn Sites from now on (my only payment), we tried system restores, no love. So I gave him exactly the line Mack suggested -- clean install, baby. Worked like a champ, and he was happy. Easier than fighting it.

Be like water, my friends.

And, stay thirsty.

[bigmack]

It can solve a lot of virus problems, but not all. I do not know if it would solve this one.
SR ain't going to polish off little devils like that. These Bolshevik types write viruses with system restore at the top of the list to thwart.

True blue, clean install every year or so works wonders. It's like having a new system.

Chick - "Stay thirsty my friends"

Dig the campaign. The most interesting man in the world. His 2 cents has overturned Supreme Court decisions, his tree house has a finished basement...

8Bc0WjTT0Ps

[ArlJim78]

he lives vicariously...through himself

[Robert Goren]

he lives vicariously...through himselfSo do I, darn it.;)

[fast4522]

This is going to come as a real shock to you gents but the people who program these worms are the people who have legitimate businesses in this country selling software that fixes the problem. The larger problem is there are so many services left on for developers to make useful programs. When you turn some of them off and remove others that you will not use your half way there. Much can be stopped by shutting everything down and not answering anything that looks legitimate providing the enable for the latch to begin. You restore your computer to 100% perfect state, remove a few things you will never use then make a image if the perfect system including Office or what have you, then make the image with Ghost 2003. FTA because you have it beat and at this point you know it.

[tupper]

The only problem with "system restore" is that you will lose anything you saved or downloaded after the date you took the state of the laptop back to.Don't do a system restore until after you boot a Linux live CD and backup all of your data files onto another drive. Very simple, easy and safe.

The latest "Opera" version of Macpup Linux was just released: www.youtube.com/watch?v=AAljSNALFrM (http://www.youtube.com/watch?v=AAljSNALFrM)

[gregrph]

Couldn't you have just done a "system restore" and take your computer back to the state it was in before the virus?

I did this on a friend's laptop once. It had the same exact symptom of a program trying to convince her she had viruses.

I went into her system restore program, set the laptop to go back 3 days or so....and the laptop looked exactly how it looked 3 days ago before she ever contracted the problem.

The problem with many virii(sp?), trojans, etc is that a copy will get placed where it will get picked up with a restore point. This is especially true with the very nasty, difficult to remove viruses. If yousanitize your system, then use a restore point, the virus comes right back. The best thing to do is turn off system restore first. That will prevent it from re-appearing. If you can't do a scan in regular operating mode, then reboot to safe mode and try, then do another one regularly. Better to run a few different scans and have them come up clean than to be still infected. I like Malwarebytes Antimalware and Hijack This! and then to finish off any scans with CCleaner to sniff out any leftover registry stuff. Good luck!

[Marshall Bennett]

The only problem with "system restore" is that you will lose anything you saved or downloaded after the date you took the state of the laptop back to.

But if anyone wants to try that method sometime...it should work.
I've done a system restore on a couple of occasions after receiving malicious crap and all I lost were updates from that past day for windows and norton . How much could one download in that short time that would be lost that you couldn't reinstall ?

[kitts]

Hijacked twice in two weeks recently with this crap. Fortunately, AVG managed to help but it is not the malware grabber that Webroot is. I bought Webroot through Amazon for about $50 and it works great for me.

[Canarsie]

I've been using this program for a real long time and it has saved me. Having said that there's been no need for a restore in quite some time. But when I needed it boy what a lifesaver it was. $50 is a pretty good deal imo.

http://www.acronis.com/homecomputing/

[Rwahi1]

I never browse the web without Geswall. It sandbox everything from the web.
Any item that you run as isolated, it's offspring are isolated too. For instances I had downloaded something online. It was an installer for a program (Opera I think). It asked me if I wanted to run it isolated. I did and it proceeded to install. Once it was done, opera.exe and a few other exe were all isolated w/ the geswall Big G. Even when I unzip or extract something geswall asks me if I want that isolated as well. Once you trust or run the program un-isolated, thats it. What I normally do is download it isolated and then run it through MBAM or Asquared. If I'm really paranoid I run it through Jotti. http://www.gentlesecurity.com/

If you want check out this review on youtube. http://www.youtube.com/watch?v=PBKNH...eature=related. It might help you understand it a little better.

[headhawg]

I never browse the web without Geswall. It sandbox everything from the web.I agree that using a sandboxed browser really helps potential malware from being launched. I use Sandboxie myself.

[Rwahi1]

If you want check out this review on youtube. http://www.youtube.com/watch?v=PBKNH...eature=related. It might help you understand it a little better.

That youtube address is wrong! I am sorry.

This is the right one. http://www.youtube.com/watch?v=PBKNHBl-yos&feature=related

[johnhannibalsmith]

Just now, I received a redirect while jumping forums and I have never seen this - a full screen RED block with the following all over it:



This website has been reported as unsafe
www.paceadvantage.com

We recommend that you do not continue to this website.
Go to my home page instead

This website has been reported to Microsoft for containing threats to your computer that might reveal personal or financial information.

More information

This website has been reported to contain the following threats:

Malicious software threat: This site contains links to viruses or other software programs that can reveal personal information stored or typed on your computer to malicious persons.

Learn more about phishing
Learn more about malicious software
Report that this site does not contain threats
Disregard and continue (not recommended)


I'm using a different CPU than the one that got hit the other day - this one runs Win7 and I've only been using it for a couple of months during the daytime - so I'm not familiar with all of the new Windows 7 alerts and securities. Now I'm gun shy that everything and anything could be some hoaxy malware just hoping I make the wrong move... Has anyone gotten this alert surfing here?

[JustRalph]

you are infected

http://www.2-viruses.com/remove-fake-warning-this-site-has-been-reported-as-unsafe


sounds like you have another computer that is infected

[johnhannibalsmith]

And yet another attack this evening on the original computer... this is getting tiresome... I keep finding the alleged culprit file, but there's clearly something else harboring around waiting to strike again... I'm going to have to try some of the other recommended software I see.

[johnhannibalsmith]

you are infected

http://www.2-viruses.com/remove-fake-warning-this-site-has-been-reported-as-unsafe


sounds like you have another computer that is infected

Thanks for that link Ralph - I'll get to tackle that one on Wednesday or Thursday... this crap is maddening.

[JustRalph]

spybot is my fav


and it is free

[bigmack]

I'm going to have to try some of the other recommended software I see.
You'll still have diabolical remnants of infection. You're fighting insects after a week in the wild and you're just now buying a can of Raid. Seeds have been planted & you got the bad bug & all the little eggs.

Take to the bank the fact your systems need to be shown virgin territory again.

They're soiled down to the core.

[johnhannibalsmith]

You'll still have diabolical remnants of infection. You're fighting insects after a week in the wild and you're just now buying a can of Raid. Seeds have been planted & you got the bad bug & all the little eggs.

Take to the bank the fact your systems need to be shown virgin territory again.

They're soiled down to the core.

What is your advice on a clean install?

I've got so much shit to back up and don't use an external drive of any kind... hell, I'm not even sure that I have the system discs around here... may take a day's worth of digging...

I know it's probably a great idea at this point, but I've accumulated so much data based crap that I use for work/racing that I'm terrified to jump in the deep end without a life preserver.

And then I convince myself that it would probably take a week or so tops before I'm back at square one with this shit as pervasive as it seems to be...

[tupper]

... hell, I'm not even sure that I have the system discs around here... may take a day's worth of digging...

I know it's probably a great idea at this point, but I've accumulated so much data based crap that I use for work/racing that I'm terrified to jump in the deep end without a life preserver.A Linux live CD (http://news.cnet.com/8301-13554_3-9988099-33.html) can:
- Access and backup your data.
- Find and remove malicious files without interference/pop-ups (it's immune to viruses).
- Access the Internet.
- Burn CDs/DVDs.

Best of all -- it's free.

[Grits]

You'll still have diabolical remnants of infection. You're fighting insects after a week in the wild and you're just now buying a can of Raid. Seeds have been planted & you got the bad bug & all the little eggs.

Take to the bank the fact your systems need to be shown virgin territory again.

They're soiled down to the core.

Mack, you're right. Absolutely bottomline.

Several days ago, something destroyed my desktop in less than two minutes. Done. I don't know if it was an infection or a virus. Everything crashed, locked up, froze . . . whatever in the hell you wanna call it. I don't know.

I called my pc guy, "come get it."

I don't fix pc stuff, I pay him to fix it.

He took it with him . . . . called me and said it was a mess, that everything needed to be scanned and removed and it would take a couple of days. A trojan infection had really done a job. It remained in the hospital on his bench while I was out of state at the Arkansas Derby.

After I got back home, he returned it, plugged everything back in, and the bitch still isn't right. Its better, but everything is slow to load, and trying to go to google for anything is still a nightmare of advertisements. Plus, out of nowhere it appears someone has added the search engine, BING. Where'd that come from?

Having a mess still. 4 days in "sick bay" and $100.00 later, an ongoing mess.

And for JohnHannibal, yes, I too got the "PACE ADVANTAGE, this site is infected warning"; right before everything crashed.

I called my pc guy once more, yesterday, "come get it, again."

Maybe I'll write another check . . . for another $100. I don't know. But I do know I won't hang with too many more of 'em. Last time it was "an infection". This time I'm told its "a virus." Me--I think the thing's got terminal cancer. And unlike humans, I don't have to keep writing checks or wait for it to die.

After today's trip back to the hospital, if it doesn't come back well--I'm gonna walk out my back door, drop the whole damn thing in my trash container, roll it to the street for the garbage guys to pick up, and go to Best Buy or Office Depot, and buy a damn 'nother one.

This has happened before. Sick computers never fully recover, and you're dead on the money with your summary, Mack.

Holding my breath, here, on my laptop, hoping it remains intact.:faint:

[Robert Goren]

I hate to say this, but it sounds like everything is infected. Every program, every file, everything. Even if you get a new computer, if you try to put anything from the old computer on it, you back in the same boat. I know it may be tough to discard everything on the computer, you may have no choice. JMO

[Grits]

I hate to say this, but it sounds like everything is infected. Every program, every file, everything. Even if you get a new computer, if you try to put anything from the old computer on it, you back in the same boat. I know it may be tough to discard everything on the computer, you may have no choice. JMO

Thanks Robert. The only thing that I need to retain on my computer are photographs, and all of those are safely backed up on discs. Too, they're on my laptop. I don't work on my computers, nor do they have anything to do with my business. Those computers are at the office.

I do know, though, that this is happening EVERYWHERE to many folks, daily, right now. I don't go to numerous websites, the computer is simply, a vehicle for horseracing. That's the primary use. If I didn't need past performances, I'd probably never turn another one on.

It sure ain't the easiest place for conversation, as I've indicated many times.

Thanks again for the reply, appreciate it.

[wilderness]

After I got back home, he returned it, plugged everything back in, and the bitch still isn't right. Its better, but everything is slow to load, and trying to go to google for anything is still a nightmare of advertisements. Plus, out of nowhere it appears someone has added the search engine, BING. Where'd that come from?

Your computer guy added these items and either an update or another software (possibly an AV).

Most of these shops are charging top dollar for removal of virus/malware in the $100-200 dollar range. One of their primary solutions is a complete restore of your OS (Windoze or otherwise), with all the updates, whether you desire them or not. Some of these updates are not even necessary for specific computers or users. They simply do the restore and allow MS to automatically add the updates (while the tech is working on another project).

When taking a computer in for repair, the customer needs to be quite specific on what data they desire protected/retrieved and to what degree they desire their OS restored.

For a short while, I had a shop that charging one-fourth the fees of all in the surrounding area and he was light years in skill above all his competitors. He charged $35 to remove all virus/malware, and in most instances an complete OS Restore was not neccessary, THUS there must be some software out there, that the majority are not aware of!



I called my pc guy once more, yesterday, "come get it, again."

Maybe I'll write another check . . . for another $100. I don't know. But I do know I won't hang with too many more of 'em. Last time it was "an infection". This time I'm told its "a virus." Me--I think the thing's got terminal cancer. And unlike humans, I don't have to keep writing checks or wait for it to die.


Once again!

When taking a computer in for repair, the customer needs to be quite specific on what data they desire protected/retrieved and to what degree they desire their OS restored.

As a side-note!
Most users today are mouse-click-crazy and are without clue as to what websites are considered "reputable" (there are many, many, many websites that no person with any sense should visit.)

[Grits]

Wilderness, thanks so much for your reply!

Right now, I'm irritated as this should not be. When my pc came back with all of these added updates I'd not been seeing, I kept saying to myself, "geez, what on earth is the deal?" Java, and others, a few times a day.

My pc guys knows I'm hot, as I talked with him twice Friday, told him I'd call him back on Monday if things weren't better. I worked with it through the weekend, struggling, and called him back yesterday morning and told him, as I said, "come get it again."

One thing he did tell me, "I can't guarantee, if I try again to get everything back to its original state, that the same virus or infection won't come right back a month from now. These guys overseas, with nothing better to do everyday, are coming up with all manner of wrenches to throw in your pc."

Too, as you said, one of his men put it on the work bench along with several others, let it do its thing while he was involved in other work. Then, he put it in his truck, returned it to me. Trusting him, as he's done work for me for years, he gave me his bill, and I wrote out his check.

I'm thinking now he's making a killing off of me, and others he serves in this 3 city and county area with "repairs" that may be adding problems. I outright asked him about the Bing search engine and where it came from?" He didn't know.

I don't surf the web. I only go to a few horseracing sites, news organizations, gardening, and travel sites. No funky stuff--porn ain't my deal, darlin'.:faint:

Anyway, thank you a lot for your reply. You've given me some questions to pose to him.

One question Wilderness, my pc is Windows XP, my laptop is Vista. Would the fact that the pc is XP, and not the newer Vista have any bearing?

[Houndog]

Spyware/Malware in my own experience is far more difficult to remove than a computer virus. Everyone seems to have an anti-virus program but they may not catch some of the newer trojans and drive by Spware programs when you hit an infected website.

I like to use a multi-tiered approach.

1) I use Kaspersky Internet Security which covers the firewall; and anti-virus threats and also addresses other malware threats. It also has the ability to browse the web in "Sandbox Mode".

2) I have the resident version of Superantispyware installed as another defense againt malware. Kaspersky Internet Security and Superantispyware seem to play well together as some resident anti-spyware solutions cause conflicts with resident anti-virus software.

3) I also use Spywareblaster which doesn't do a scan but sets a "Kill Bit" for known malware/spyware programs that prevent them from being installed in the first place. It works with Microsoft IE and Firefox. It also has a setting to prevent your homepage from being changed.

4) I try to use Firefox when I can as it is less susceptible to be targeted by the malware developers than IE (especially version 6); but with the growing popularity of Firefox I expect that to change.

5) For my e-mail I use a front end called Mailwasher which allows me to examine e-mail while it is still on my ISP's e-mail server. It "learns about spam"; has black and whitelists and I can delete e-mail before it goes to my computer. Also use this with another software program called Benign (B9) which remove dangerous scripts; web bugs; etc.

This is not a perfect solution as the Malware developers can be very talented. So this is not to say I will never get infected as it can happen to anybody if the right circumstances are in place.

[JustRalph]

Grits
He updated some microsoft security items and they sometimes offer to add a "Bing toolbar" it's Microsofts search engine and it ain't half bad..........
he probably got the Bing toolbar with a security update, which you obviously needed.

Tell him to save the pictures and music and wipe the damn thing............

Johnhanniable and others..........

If you are running a network, wireless or wired and you infect one machine, you can bet you may have infected the others depending on what your security settings are. Just simply walking to another machine on your network and thinking that it should be ok, is not a given. There are many little monsters out there that will cross the network on their voyage

[Grits]

Ralph, I just finished running a Malwarebytes scan and no infections were found. Still, this deal with Google is unreal. I've never seen so much crap--I search and almost everytime I'm getting advertisements for deals for this, deals for that, you name it. This is irritating as hell.

I'm done. Forget it.:faint:

[Grits]

My pc guy came over yesterday afternoon--a house call this time. He didn't have to take it to the shop. Things are much better now. Still, Google isn't back up to normal speed . . . not as it should be. But for now, with scans, more changes in settings, ones that he knows far more about than I, it all seems to be moving much more quickly. We'll see.