Virus Alert

[Tennessee Hayre]

Thought I would let everyone know that I was surfing the web about 10 days ago and clicked onto a site looking for .357 mag info and found a .357 site that claimed to have a live video on it to view. It ask me if I wanted to run or save the page, so I clicked run because I don't save anything to my hardrive unless I trust the site and an advertisement program called (AntivirusXP 2008) started scanning my computer, so I tried to stop it and did so, but it took over my computer with, pop ups adds for their software. I could not delete the program. I ran a scan and found a much to my surprise found a (worm), and a (troj horse)in my c: drive. Everytime i would try to go on the web it would take me to their site. So it highjacked my entire computer. I had to buy me another hardrive and just yesterday got it all installed and everything re-loaded. what a nightmare!!. I just wanted to let you all know if you see that program anywhere on the web (AntivirusXP 2008) watch out. I can't remember the gun site or .357 mag site as it was labeled or I would report it. All I did was run the video and it saved it's self. Their was no video!!!

[CBinNH]

Same thing happened to me. I had my hard drive reformatted. (thank goodness for computer weenie nephews) It seems OK now but I lost some documents/files & am still reloading several years worth of free software as I find need. Some people really need to find constructive things to do with their skills/freetime instead of vandalism. Chris

[Ysabel Kid]

Personally, I think we should string up all computer hackers/virus-makers. After a good dose of extremely painful torture!!!

[Tennessee Hayre]

You know I was thinking the same thing While I was in my chair just staring at my computer screen ,watching it jump up and down and move left and right about as fast as a machine gun on rapid fire, I was also thinking about what I would do to that hacker if I could get my hands on them. I was thinking really bad things!!They were not just saying buy the product, they were saying buy my product or else. A friend of mine said it best. He said it was like going to an ATM machine and someone putting a gun to your head and saying give me your money or else you dont get your computer back.

[edwardyoung]

A guy at work brought me his laptop with this Antivirus XP 2008 on it. He didn't have his restore CD or any money for software; but I was able to get rid of it by downloading Super Antispyware. http://www.superantispyware.com/ It's a free download. Thought it might help someone.

[mikld]

I too got ripped by Antivirus XP 2008. Same process; tried to watch a video (not 357) and Antivirus took over. Progressivly got worse to where I could not even boot up my computer. Had a new hard drive installed. Just getting back to where I was two weeks ago.

[dsmith512]

Switch to Kubuntu Linux and stuff like this will not happen ever.

http://www.kubuntu.org

[gunslinger598]

Same type of thing happened to me looking at a horse web site.

It installed a trojan caused a lot of problems. I was able to get online though and look up the virus and get a tool to fix it. It's been about 2 years so I've forgotten the details.

[Hobie]

Hey, that happened to me, too. I guess I'm a nut for shooting video but I must have been on a site that did it automatically. I never accept such software.

First I opened the task manager and stopped all the processes. Then I went to the add/delete programs and removed the program. Then I ran my AV scan. Then I rebooted. All done. Sounds simple but it took me over 5 hours.... Those stupid punks should become eunichs in some Chinese toy factory...

[Tennessee Hayre]

WOW, and here i thought i was just the only one to be stumped by antivirusXP 2008. Who are these people, and how can we report them. or stop what their doing. Has to be away.

[electro]

I think I ran into the same website with the Anti-Virus XP 2008 pop-ups this week on a Google search. I immediately shut down the computer and rebooted. I guess the AVG virus scan and the Spybot programs I am running must have caught the problem.

[rjohns94]

This happened to me just last night. I was looking at some info for reloading brass shot shells. thanks for the link Removed 18 files that were affected. Startup program had to be repaired. I hate when this happens. Just don't see the thrill in it.

[Grizz]

I run a linux box. Puppy linux is very light weight and runs on old hardware. I installed firefox, thunderbird, and skype. I do almost all my surfing from this box and it doesn't even have a hard drive. It uses a flash memory card on the ide bus. No MS windows. Very low key. Very reliable. And I can replace the whole thing by popping a half-gig card into the adapter. It makes old boxes useful and protects my working compluters from those attacks by keeping the experimentation off of them.

http://puppylinux.com/blog/ if you want to read up on it. You don't even have to install it to a drive. You can run it from a CD drive, and you can even save your sessions to that drive. There's nothing to hack !!

But wait, there's more! You can install Puppy to a thumbdrive, boot from that, and that's your whole compluter, right there in your pocket. You can boot any PC that's set up in BIOS to select a USB drive before the hard drive. Puppy won't touch your hard drive if you don't want it to. I can run it on my 64 bit Athlon with 4 gigs of ram. It will read and write NTFS files so you can use a partition on the hard drive to save your settings and data if you want to, still booting from the thumbdrive. It is also a fantastic rescue disk because you can access the drive at low levels and weed out stuff that shouldn't be there.

PM or email me if you need help getting started. Or if there's interest, start a thread here. Puppy is a little tricky to get started using, but it's rock solid reliable.

I've been doing this for several years and almost never surf or do email from the big box. Save the earth from super-volcanos, glaciation, deforestation, earthquakes, and asteroids, compute green!

[Hobie]

That's neat Grizz.

[AJMD429]

A guy at work brought me his laptop with this Antivirus XP 2008 on it. He didn't have his restore CD or any money for software; but I was able to get rid of it by downloading Super Antispyware. http://www.superantispyware.com/ It's a free download. Thought it might help someone.

I had that same one hit my work computer, and am STILL dealing with repercussions.

Of course, in the good old days, you could just CLONE your entire computer periodically to another hard drive, including the operating system, so you could just literally put that backup drive on the main cable and boot up and go, but now the stupid (smart, actually) software knows what you're up to and makes it impossible.

I guess it is something to do with the software (Windows XP) reading your specific machine ID or something and not wanting you to be able to just copy it onto another machine vs. buying another copy. Anyway, for a non-computer-geek like me (I'm a doctor geek and gun geek), it makes life difficult.

Sometimes I wonder if the antivirus-software people might not be the ones who write and turn loose the viruses so they can be there to 'help' us fix it. I suppose if the download was free, that isn't likely, but maybe too many years of watching the government CREATE problems then offer us the 'solutions' for a price (in dollars or freedom, or both), has left me too suspicious!

[Grizz]

A guy at work brought me his laptop with this Antivirus XP 2008 on it. He didn't have his restore CD or any money for software; but I was able to get rid of it by downloading Super Antispyware. http://www.superantispyware.com/ It's a free download. Thought it might help someone.

Of course, in the good old days, you could just CLONE your entire computer periodically to another hard drive, including the operating system, so you could just literally put that backup drive on the main cable and boot up and go, but now the stupid (smart, actually) software knows what you're up to and makes it impossible.

Doc, not so exactly. Check out this free image making option:

http://lifehacker.com/software/geek-to- ... 292972.php

I have not used this method, but I have used some of the tools that this system uses. You have to burn the dl as an iso, not a copy. Then experiment with it, I think you'll appreciate the results.

Regards,

Grizz

[piller]

Can we take the people who make viruses and just revive the old Apache methods of punishment? The Apache were rather inventive in their ways to make people think twice about crossing them. I would be happy to cheer on someone who would cause a hacker the same amount of pain they cause to innocent victims.

[Tennessee Hayre]

I assume you mean the wagon wheel roast thing, in slow spin

[piller]

That might be a good start. Sticking cactus thorns under their nails and lighting them comes to mind, too. The stretched wet rawhide tied tightly about the head with the hacker left in the sun for the leather to shrink and dry may not be mean enough.

[Boreman]

I had the same problem with Antiviris2008XP, finally got rid of it by using a free utility called Spybot Search & Destroy. This utility was very easy to use and found some other "bad" things in my system I didn't even know was there.

[Grizzly Adams]

Well Antivirus 2008 is now 2009. This is a bad boy that mimics an antivirus program. IT however is the virus! It has swindled millions of folks by getting them to purchase the upgraded version no less!

Read all about it, and tips on removing same:
http://www.2-spyware.com/remove-antivirus-2009.html

http://www.bleepingcomputer.com/malware ... virus-2009

[J Miller]

Thought I would let everyone know that I was surfing the web about 10 days ago and clicked onto a site looking for .357 mag info and found a .357 site that claimed to have a live video on it to view. It ask me if I wanted to run or save the page, so I clicked run because I don't save anything to my hardrive unless I trust the site and an advertisement program called (AntivirusXP 2008) started scanning my computer, so I tried to stop it and did so, but it took over my computer with, pop ups adds for their software. I could not delete the program. I ran a scan and found a much to my surprise found a (worm), and a (troj horse)in my c: drive. Everytime i would try to go on the web it would take me to their site. So it highjacked my entire computer. I had to buy me another hardrive and just yesterday got it all installed and everything re-loaded. what a nightmare!!. I just wanted to let you all know if you see that program anywhere on the web (AntivirusXP 2008) watch out. I can't remember the gun site or .357 mag site as it was labeled or I would report it. All I did was run the video and it saved it's self. Their was no video!!!

Well guys, even knowing about this virus didn't stop me from stepping in the bear trap. I did the same thing Tennessee Hayre did, run a video, and slam bam boom I'm dead in the water. We got most of the virus out of this tower with the anti virus programs but that AntivirusXP 2008 is still in there trying to turn itself on. We can't get rid of it. Tower is still running for now, but we are going to have to take it to our techs for a clean out.
Our AGV anti virus program has recently refused to update itself, and won't hold manual updates more than a few hours, it didn't even know this virus hit.

Watch out guys.

Joe

[Grizz]

Might be mighty helpful if those sites could be posted here, not as URLs, but so they can be avoided by the rest of the guys.....

[J Miller]

Might be mighty helpful if those sites could be posted here, not as URLs, but so they can be avoided by the rest of the guys.....

Grizz,
I would post it but I was surfing along brainlessly when I found a video with Jessica Biel in it I thoughtt might be interesting, and don't even know where I was.

Joe

[Blaine]

AVG = +1 from me...... It's killed everything so far and I've never had to replace any lines of code.

[Old Ironsights]

This AntiVirus2009 not only tries to install itself through bogus videos, but some other sites try to push it as a script as well.

One of the drafters here was smart enough to call me when he got the popup and I had to use Task Manager to kill the Explorer Process since there was no way to cancel it without clicking on a script window (bad idea). Avoided the install that way.

If ANYTHING pops up in Explorer (dunno about Firefox/Mozila) that says Antivirus 2008 or 2009, hit Ctrl-Alt-Del IMMEDIATELY, select Task Manager then find and shut down Explorer. Don't even try to close the window by clicking on somthing. Just kill the Explorer Process completely.

[J Miller]

Grizzly Adams, OI;

Can these anti virus programs be downloaded to disc then installed on the infected computer?
Every time we go on line with it we get pop ups that try to download more of the virus.

As far as hitting C-A-D and shutting down Explorer it's too late for that now.

I'm on our old Win 98 box now, the other one is setting off to the side.

Joe

[Old Ironsights]

Grizzly Adams, OI;

Can these anti virus programs be downloaded to disc then installed on the infected computer?
Every time we go on line with it we get pop ups that try to download more of the virus.

As far as hitting C-A-D and shutting down Explorer it's too late for that now.

I'm on our old Win 98 box now, the other one is setting off to the side.

Joe

Yeah. Most of them can be downloaded onto your W98 box and put on a USB or CD to run on the infected machine.

Boot the Infected machine into "Safe Mode" WITHOUT Network support then run the software.

[dr walker]

I had an issue with this a week or so ago, It took me 12 hours of dickering to get things straightened out. The darn thing had changed setting in my registry and had taken control of my computer. I dont really know what I did to fix it but I did end up getting the trojans off with AVG. I was infected while on the savage rifle forum.

[J Miller]

Grizzly Adams, OI;

Can these anti virus programs be downloaded to disc then installed on the infected computer?
Every time we go on line with it we get pop ups that try to download more of the virus.

As far as hitting C-A-D and shutting down Explorer it's too late for that now.

I'm on our old Win 98 box now, the other one is setting off to the side.

Joe

Yeah. Most of them can be downloaded onto your W98 box and put on a USB or CD to run on the infected machine.

Boot the Infected machine into "Safe Mode" WITHOUT Network support then run the software.

OI,

How do you boot Win XP Pro into safe mode? Then get it out?


Joe

[Old Ironsights]

Grizzly Adams, OI;

Can these anti virus programs be downloaded to disc then installed on the infected computer?
Every time we go on line with it we get pop ups that try to download more of the virus.

As far as hitting C-A-D and shutting down Explorer it's too late for that now.

I'm on our old Win 98 box now, the other one is setting off to the side.

Joe

Yeah. Most of them can be downloaded onto your W98 box and put on a USB or CD to run on the infected machine.

Boot the Infected machine into "Safe Mode" WITHOUT Network support then run the software.

OI,

How do you boot Win XP Pro into safe mode? Then get it out?


Joe

To start the computer in safe mode

From the "OFF" state, press the power button then, before the "Loading WIN XP" screen press F8.

You will get a series of options.

Use the arrow keys to highlight the appropriate safe mode option, and then press ENTER.

If you have a dual-boot or multiple-boot system, choose the installation that you need to access using the arrow keys, and then press ENTER.

Do NOT choose "Safe Mode with Networking" or "Last known Configuration".

You will get a 640x480 VGA windows screen with access to basic functionality to run/load anti-malware. You can also (I suggest) do a System Restore back to a week ago (before the malware was uploaded, then REBOOT IN SAFE MODE and run the anti-malware. That usually gets you a better "cleanup".

M$ Notes:

In safe mode, you have access to only basic files and drivers (mouse, monitor, keyboard, mass storage, base video, default system services, and no network connections). You can choose the Safe Mode with Networking option, which loads all of the above files and drivers and the essential services and drivers to start networking, or you can choose the Safe Mode with Command Prompt option, which is exactly the same as safe mode except that a command prompt is started instead of the graphical user interface. You can also choose Last Known Good Configuration, which starts your computer using the registry information that was saved at the last shutdown.

Safe mode helps you diagnose problems. If a symptom does not reappear when you start in safe mode, you can eliminate the default settings and minimum device drivers as possible causes. If a newly added device or a changed driver is causing problems, you can use safe mode to remove the device or reverse the change.
There are circumstances where safe mode will not be able to help you, such as when Windows system files that are required to start the system are corrupted or damaged. In this case, the Recovery Console may help you.

NUM LOCK must be off before the arrow keys on the numeric keypad will function.

[J Miller]

OI,

Thanks for the help. We'll get on it as soon as we can.

Joe

[J Miller]

OK, we now seem to be running into another brick wall.
Downloaded the spydoctor and tried to install it on the '98 tower. We then get a block saying that it is for Windows 5.0 or higher.. ??????? We thought that Win '98 was higher than 5.0 and the others are coming up saying that it needs to be 4.0 or higher...HUH???

Mrs J Miller

[Old Ironsights]

No, Win 98 is not "5.0". It might work on ME but probably requires 2000 or XPsp1

Just copy the installer to a CD and try running it on the XP box in safe mode after doing a system restore.

[Tennessee Hayre]

I can't believe so many folks have been infected by this virus, I to don't recall the site I was on when my system was infected. I purchased (Norton security) and loaded it on my system, so now I hope it helps. I have been told it is one of the best virus and spyware programs. I hope so, it cost me about $60 dollars. I used the free AGV program when I had the virus and while it found the virus it could not remove it...

[Hobie]

I run McAfee but that didn't stop this thing from doing a number on me. I just had to reinstall IE7 to get it to run. Sometimes it would be running two and was maxing out the CPU usage. SLOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOW!

I used Safari to get around so that I could reinstall IE7. I guess I have about 7 hours into repair now...

[Tennessee Hayre]

I saw that program when i was searching for virus softwware, but decided to go with Norton. I think no matter what we use the SHIIIIIIIIt HeAAAAAAAdss, who have developed this program are very smart, and seems to be a step ahead of all the other programers who work for the legal companies. This hacker is very educated and should be found and proscuted. I am going to continue to try and find this person or company and once ID'ED file charges....He or she thinks they are too smart to be found, But as the old saying goes anyone can be gotten to... ( Time is on my side).A friend of mine writes software programs for multimillion dollar company's and we have dedcided to do everything in our power to find these people and put them out of business. Any info anyone has reguards to this software company ANTI-VirusXP 2008/2009will be must appreciated

[Grizz]

here's a question: what browsers are getting hit; or: which ones aren't ???

[Tennessee Hayre]

Mine is Microsoft Internet exployer

[Tennessee Hayre]

Guess I can't spell: (Microsoft Internet Explorer)

[J Miller]

here's a question: what browsers are getting hit; or: which ones aren't ???

Mozilla Firefox on a Win XP Pro OS


Joe

[J Miller]

Well Antivirus 2008 is now 2009. This is a bad boy that mimics an antivirus program. IT however is the virus! It has swindled millions of folks by getting them to purchase the upgraded version no less!

Read all about it, and tips on removing same:
http://www.2-spyware.com/remove-antivirus-2009.html

http://www.bleepingcomputer.com/malware ... virus-2009

Thank you for all the tips... I went to both the links and downloaded them to my older PC, then burned them to a disc. Proceeded to install the programs on the new tower in the safe mode as recommended. The second link was the best with the link to the sight for the malwarebytes' sight. It was free and I was able to run it in the safe mode. That link was the one for the 2009 removal.
I believe that it has (I hope) removed the last of the infection. The PC Doctor on the first link is only for a scan and will not remove anything unless one buys their product. Being the money miser I am, I would rather get something for free to try it first.

Mrs J Miller

[Grizzly Adams]

That malwarebytes is a good tool. Glad ya got the little devil in the can!

[awp101]

THANK YOU! THANK YOU! THANK YOU!

I just asked my friend Mr Google about adjusting the carb on my weedeater (a whole 'nuther set of issues... ) and the only result was for a Lesco Mower website or somesuch. Well, guess what popped up when I went to that page?

C-A-D the page when I found the "X" button to close the popup didn't work and so far nothing seems amiss. DL'ed spybot and that super spyware thing in case anything goes awry.

I already run ZoneAlarm, Ad-Aware and Norton so we'll see.

[dchriz01]

This happens to me just this time! Thank you for the link. I have removed 25 files that were infected. I hate it when it happens.

[wilko]

These types of drive-by scripts are very hard to stop. they can take over your computer like that without you doing anything. Anti virus programs will NOT stop them...

clean with malware bytes and switch to mozilla firefox as your browser. Install "adblock plus" and "Noscript" and you will effectively close the door for these scripts....

i learned the hard way.... I will never use any other browser then firefox anymore...

[bobbyjack]

The viris programs are created by the companies that sell programs to rid you of them(kinda like the self surving Gov).

I had AV on mine and was thrown to the wolves,but Norton 360 did it's thing and saved my butt!

I never liked Norton before ,but it sure did work. The first thing the viris did was remove my restore icon from my screen.

Bob

[CowboyTutt]

Malware Bytes is another good free tool that purged a virus from my system before imminent total failure. The more you use your computer after your infected, the deeper it digs into your operating system. Do your self a favor and download a free copy of Malware Bytes onto your desktop and one to a CD. Then just periodically update it just before you scan with it. Its a well respected tool according to the IT guys at a Geotechnic firm I know. You shouldn't need to reformat if you catch it early enough.

-Tutt

[Hankster]

Running Windows 7.... last one I got a few weeks ago, about had me pulling last of my hair out!! But I did squash it....You need Malwarebytes antimalware, Superanti-spyware...and Spybot S&D... took ALL THREE to catch it all, Safe Mode..... and Windows Security Essentials..... Also, look at your Internet settings, it changes your normal setup to a "proxy" setting sending you to their website.... you need to change this back to "auto detect" instead of the setting they install... so you can get online and go where YOU want... if infected, you'll need to both download these, and update on another computer, then load it on a CD.. then install it onto the infected machine.... run from the disc..... once you can get back in, you can install these to you desktop, NOT the C drive, and rename the .exe file something dumb, like "laundry.exe" instead of "malwarebyte.exe" etc... as the virus seeks these particular exe files and will not let them launch, you'll have to get around them, to wipe them out. This particular "Virus" is a real pain.....but I've cleaned 3 infections this way, takes time, and a LOT of reboots, but you CAN clean it out... also, on an UNINFECTED machine, you can google the "antivirus" product by the name it's trying to run, and find up to date info on wiping them out... including tools such as "RKill" etc.... read carefully what you find, then go to it!! Now you know why the Computer "geeks" charge so much, it's a REAL PAIN!!!
As to the guys who WRITE these "programs"??? DEATH by Fire Ants!!!! You deal with a few of these infections, and you'll want to kill them YOURSELF face to face!!! LOL!!!