A Possible Virus

Moderator: admin

User avatar
dusty
Platinum Member
Posts: 21530
Joined: Wed Nov 22, 2006 6:52 am
Location: Tucson (Wildcat Country), Arizona

Post by dusty »

mickyd wrote:The 'pop up' alert you originally mentioned dusty also tried to hit me at the yahoo ER group forum. It told me the site was infected and that my PC had many various viruses. I never believe any pop up except from Norton. I will not even click on the close button on the window. Instead, I use CTRL-ALT-DEL to open task manager and close the pop window from there.
During all of this (I think), I have lost the ability to open Task Manager. CONTROL-ALT-DEL does not do it not does a right click on the Task Bar (bottom of the screen).

I get a very momentary hour glass and then nothing.
"Making Sawdust Safely"
Dusty
Sent from my Dell XPS using Firefox.
User avatar
kameljoe21
Gold Member
Posts: 100
Joined: Sat Jan 02, 2010 12:36 am
Location: 4L13N Ranch, Joes, Colorado
Contact:

Post by kameljoe21 »

@heathicus
what do you know about the windows defender scam
i think i have cleaned it out
but the real question is how it was able to block me from gaining access to the main window
when it happen it started like this
i rebooted my system
and after the welcome screen it faded the background and showed me this popup type thing saying that my system was sending mass emails that were infected ( i know this to be not true since i use no email programs other than gmail witch i use via firefox )
and it took some time to cancel it out and temp disable it till i could find the source and get rid of it
what im not sure of is how it was able to lock me out of my own computer
i have never seen anything like it before
http://s853.photobucket.com/home/kameljoe21/allalbums
194X Spiegel 4.5" Jointer M600 NO460
1947 ShopSmith 10E S#9074
1957 McCulloch 55 Chainsaw
1955 Mall General Purpose Chainsaw
1952 Farmall H S#368935
1985 Honda 125M ATC
2006 Honda CRF 50 F
1978 Packard Drill Press M#120F-IND
195x Delta Table Saw S#AY4575
1997 Craftsman Chipper M#247797851
1982 Ariens Snow Blower M#ST504
194x Duro 30" Scroll Saw S#B07132PL
194x John Deere #5 Sickle Mower
19xx Antique Modified 3PT Hay Rake
------------------------
Gold Member
Posts: 397
Joined: Fri Jan 01, 2010 2:10 am

Post by ------------------------ »

When my computer got infected, I went to Mcaffe and downloaded their free 30 day trial to clean it up. And then cancelled the Mcaffe. No problems since and it was free!!
User avatar
etc92guy
Gold Member
Posts: 263
Joined: Mon Aug 25, 2008 10:15 pm
Location: Hartland, WI

Post by etc92guy »

Dusty - Can't say for sure from here, but you may have a damaged OS. Like Heathicus and others said, it's easy to get suckered in on this. These types of virus's can appear as wallpaper, a program that won't go away, or even a Internet Explorer warning bar. Do a click and you may be done, depending on how deep the nasty buries itself.

I'd recommend copying your My Documents to a jump drive, scan that, then pull out the OS CD's and try and do a repair. If that doesn't do it your going to have to do a full blown install.

Heathicus - I've run Avast! Free for a little over a year now. Great product. 4.x did the job. 5.x is running now. The only thing that bothers me is it's eastern block based. Call it remnants of cold war fever.;)

kameljoe - Thats a new one to me. Sounds like you got one that loads in the early stages of the OS load. Another way to handle this is throw the OS into safe mode ( press F8 while booting ). This allows you to look around the system files and do manual eradication if you have the instructions. It will allow you to download MalwareBytes and others, but MalwareBytes won't run in safe mode, so you have to reboot to normal and then battle the windows to get it running. Or say nuts to it and repair or re-install the OS.
Craig
Hartland, WI
-Mark 5 "Greenie" S/N 342238, Manuf. mmm/mmm 1957, Acq. Oct. 2008, Joiner S/N M067266
-10 E/ER(?) S/N Unknown, Joiner 4E S/N 40051
User avatar
heathicus
Platinum Member
Posts: 2648
Joined: Wed Oct 22, 2008 1:02 am
Location: WhoDat Nation

Post by heathicus »

I haven't had any problem getting MalwareBytes to run in safe mode. I've run into viruses that would delete the MalwareBytes EXE file as soon as I installed the program so safe mode was the only way I could get it to run. In fact, my standard procedure with really bad infections is to install MalwareBytes from a flash drive in safe mode and run a full scan fixing whatever it finds, then reboot into normal mode, update MalwareBytes, and run another full scan.

I also have a flash drive that I can boot into WinPE and run several utilities or perform a clean OS install. I keep meaning to see if I can add MalwareBytes to that, but just haven't done it yet.
Heath
Central Louisiana
-10ER - SN 13927, Born 1949, Acquired October 2008, Restored November, 2008
-10ER - SN 35630, Born 1950, Acquired April 2009, Restored May 2009, A34 Jigsaw
-Mark V - SN 212052, Born 1986, Acquired Sept 2009, Restored March 2010, Bandsaw
-10ER - SN 39722, Born 1950, Acquired March 2011, awaiting restoration
User avatar
dusty
Platinum Member
Posts: 21530
Joined: Wed Nov 22, 2006 6:52 am
Location: Tucson (Wildcat Country), Arizona

A Possible Virus

Post by dusty »

This virus crap is a real nuisance. I have had computer problems before but nothing as irritating as this is. I have made some headway but it is beginning to look like I have to reload the OS, as has been recommended.

Right now I am operating is a mode where I have elected to ignore all the warnings. They keep popping up and I just click them off. The purpose has been to see what else is adversely effected. At times the system is extremely slow but works if I am patient. At other times, like now, it almost seems like it is fixed.

I do get this one warning whose personality I have not been able to alter.

[ATTACH]7884[/ATTACH]

If I change to IE, I won't get this but I do have to operate in a mode where I must opt to ignore security alerts in order to get on the web.

I am learning a lot but unfortunately I will forget most of what I do learn once I get the system back to normal.
Attachments
Reported Attack Site (Small).jpg
Reported Attack Site (Small).jpg (29.39 KiB) Viewed 3051 times
"Making Sawdust Safely"
Dusty
Sent from my Dell XPS using Firefox.
User avatar
joedw00
Platinum Member
Posts: 1957
Joined: Thu Jul 20, 2006 7:01 pm
Location: Wichita, Kansas

Post by joedw00 »

etc92guy wrote:
Here's my recommendation. It isn't the only way to disinfect yourself, but it has worked for me:
  1. Download and install Malwarebytes. ( Do this from http://download.cnet.com/Malwarebytes-A ... ?tag=mncol, a safe site )
  2. Run MalwareBytes FULL SCAN. The quick scan won't cut it. Quarantine/delete the infections.
  3. Download and install Advance System Care ( Do this from http://download.cnet.com/Advanced-Syste ... ?tag=mncol )
  4. Run it, update the definition files, and let it scan for Spyware and quarantine/delete the infections.
  5. Download Microsoft Security Essentials and install it. (http://www.microsoft.com/security_essentials)
  6. Update the Definition file, if necessary
  7. Run the Full Scan.
Dusty
At least you can get on the internet, one of my computers will not let me open anything. I get this security warning that that file is infected. I tried to put the three on a zip drive and install them on it, but it will not let me do that. I guess I will have to restore it all the way back to day one. I tried to restore it to a recent point, but no go. I am also getting Pron pop ups:eek:
I will try to put it in safe mode when I get home, and see if I can do anything there.
Joe

520, Bandsaw, Beltsander, Delta Drill Press, Delta Lathe, Craftsman Planner/Jointer, Delta Planner, Mini "Greenie" Shorty 500

Being a VETERAN is an honor
Being a GRANDPA is priceless
User avatar
heathicus
Platinum Member
Posts: 2648
Joined: Wed Oct 22, 2008 1:02 am
Location: WhoDat Nation

Post by heathicus »

I hope this eases your mind about the Shopsmith site, Dusty:

http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http://shopsmith.net/forums

The warning is part of the fake "anti-spyware" program you're infected with. It has spoofed the real warning that is a Firefox feature. The following link is for a Mozilla test page that should generate a real warning. Compare and contrast the two closely including the icon and the exact wording including the labels on the buttons, etc.

http://www.mozilla.com/firefox/its-an-attack.html
Heath
Central Louisiana
-10ER - SN 13927, Born 1949, Acquired October 2008, Restored November, 2008
-10ER - SN 35630, Born 1950, Acquired April 2009, Restored May 2009, A34 Jigsaw
-Mark V - SN 212052, Born 1986, Acquired Sept 2009, Restored March 2010, Bandsaw
-10ER - SN 39722, Born 1950, Acquired March 2011, awaiting restoration
User avatar
cv3
Gold Member
Posts: 403
Joined: Mon Dec 28, 2009 4:18 pm
Location: Mobile Al

Post by cv3 »

Dusty
I just had a similar virus a few weeks ago. I am not a computer person so I took it to a friend who is. And he fixed it with the Malwarebytes program and installed that program in my computer. It was a free install. I am trying to catch-up with my grandson’s knowledge of computer.
Make today a day that lets you smile!
CV
Mobile Al.
MARK V 520 - Band saw and Jointer. DeWalt scroll saw.
------------------------
Gold Member
Posts: 397
Joined: Fri Jan 01, 2010 2:10 am

Post by ------------------------ »

cv3 wrote:Dusty
I am trying to catch-up with my grandson’s knowledge of computer.
If it wasn't for my kids, I would still be sending smoke signals:)
Post Reply