Virus Alert

I had done a Google search on this one before- this site, http://www.techimo.com/forum/t175852.html had the best information. I cut and pasted one of the fix responses below.

"Download SmitFraudFix, extract it, then restart your computer in safe mode. Run SmitFraudFix and it should get rid of it. I used this recently to get rid of the stupid Virus Burster thing on one of our computers."

Thank you for posting such an informative note. I always knew I stayed away from MySpace for a reason! Be aware though, this is the first time i have heard this tracked back to a profile so something may be changing. I have heard of people being infected in a number of ways.

Glad to know that you were able to rid yourself of the beastie!

First, I have to say that I am sorry you got a virus; however, you fell for one of the oldest tricks in the book. You don't open attachments or click links from people you don't know, especially links to install software.

With that said, thanks to being willing to post this info despite the fact that we would all know what you were trying to view :)

Words like...

"The only way I was able to Clean the Virus was to Delete the Partition, Format my Hard Drive and Completely re-install everything."

is the reason why we backup. Hopefully its not a virus that manages to create its own little partition and continiously restore itself.

First and foremost: use caution when connecting to an unknown site.
If in doubt, don't connect, but if you are curious (and aren't we all) use CallingID. It is a freeware download you can use to identify what site you're connecting to. It si available for IE and FireFox. A new and very useful development is CallingID LinkSAdvisor, which in essence tells you the risk of clicking on the link in an email. If you hover your mouse over the link, the software will verify the site, and advise you of the risk. I'm not in any way connected to CallingID, just a very satisfied user of the software.

.

I have had numerous encounters with similar or even possibly the same sort of infections.

It is caused by a virus/add-ware hybrid.

The hybrid is actually so advanced that you can remove it from one profile and it can still be active in another.

The best course of action is usually prevention. Get Microsoft?s windows defender and an antivirus and keep windows, the antivirus and windows defender up to date.

For those who have been unfortunate enough to get infected, firstly physically disconnect from the internet, get windows defender installed and get the updated definitions for you antivirus and defender also get hold of a little program called HijackThis.

Restart the machine in safe mode and let window defender do a full scan, the newer antivirus will pick up some of the instances of the malicious software while the scan is being processed, once the scan has bee processed, defender will list all instances that it recognises and show you a yellow or red shield, the reds will be automatically selected for removal, just remember if you are running any remote control software to leave that one as ignore and remove the rest.

Do a full scan using your antivirus, make sure that all explorer windows are closed and launch hijackthis, the program will scan the registry for possible hijack software entries, the program will list a number of legitimate programs as well. The legitimate entries will be for programs you have installed on the machine. It will also show you entries if the home page and proxy settings are different to windows default and you can chose to "Fix" them if they are different than the settings that you use.

This process needs to be repeated in safe mode for all profiles on the machine.

This is a long method but it dose save having to reload the entire machine.

It sounds like what you may want to try is a VMware appliance. What that is an OS (likely linux) that contains a web browser. (Nautilus, Firefox, or Opera) that can be used for checking out suspect or known hazardous sites. Since your browsing from a virtual computer your real system should go untouched. VMware Player is free from vmware.com and from there you can search for the web appliance of your choice.

I would love to know if some one has tried this or similar in a work environment.

Though for me part of safe computing is to not use IE (including IE7) for routine browsing. Don't run programs from internet without first scanning for malware. If something needs an "adult viewer" then don't look. And I would agree with the sentiment "Don't accept candy from strangers."

P.S. Also many newer malware are coming with root kits. With a root kit the only way I know of getting rid of them is to reinstall.

P.P.S This is where disaster recovery planning is needed because it's not just about hardware failure but about anything that makes the system unusable. If you had an image of that system then it could be back in operation in a matter of minutes rather then the time to repatition, format, and reinstall.

McAffee should have given you the name of the virus. Supplying the name would help us find fixes, and let us know what to look for on our machines.

...disconnect from the network!

I also recieved a friends request and went to the persons page to see if I Knew them.
The pop up said to click to install adult veiwer. When trying to install Symantec would not let it load. I dont seem to have any other problems. Maybe that is why I never liked Mcafee as protection. Symantecs Internet security does a much better job and does not seem to use as much resourses.

Anyone with even an iota of knowledge (or common sense) about MySpace, knows that you will never, and I mean NEVER have to download anything for MySpace. Not to mention MySpace prohibits nudity...

I delete everything from persons unknown. I never, ever look at the message, and (gasp) open any attachments or click on links. That's the surest way I know to get a virus/worm/rootkit infection. The more enticing a message is, the more you'll want to look see, but you must resist this. I've cleaned literally thousands of machines that had all manner of infections. Backups are your best protection if you just gotta see where those links take you. Some of the latest and greatest are not on anyones list yet so most virus busters won't provide any help. Even MacAfee runs a couple days behind in the updates for new infections. The hackers rely on the users who can't resist a good line and know you'll just have to look. Once in your machine, the best way to clean it is a deletion of the partition and reinstall the OS. You should have your OS on a seperate partition from the valuable data and programs you run. Rootkits are especially nasty if not detected in a timely manner and some of the newest worms can even take your machine to a web site that will flash the BIOS and install their bug in the BIOS. The only way to clear that out is to remove the CMOS battery and allow the hardware to revert back to the default BIOS. Again I hope you have a copy of the BIOS that is available so you can get the machine back to the state it was in before the infection. Most users are so oblivious to these facts and that's why I get to charge you $100. an hour to fix these things. It would be a simple matter if all machines were alike and there was one simple and easy coverall backup to load. But, no two machines are alike, and unless you build them all yourself with identical hardware and software, that's not going to happen. I have seen some new bugs that will make it appear that the hardware has failed, but not one yet has really done any physical damage. That would be counter productive, the hacker wants to control your machine, not destroy it, it's no good to them that way. They need your machine to continue to build their email spam empire and bot armies to sent out more infecting emails. The biggest crime I see is that the ISPs continue to let it happen.. Tey could stop this in a second with the right approach, but they don't and won't when others are paying to get into their systems as legitimate users. By the time they find out what's happening, it's too late and the hackers have already moved on and found others to provide access.

Searching for porn, nudity or even just bikinis on the Web is always inherently risky; it's used as bait in just these kinds of traps. MySpace in particular strikes me as a tarpit of danger from about fourteen different angles. Just looking at a lot of those "webpages" makes my skin crawl. If there's anything out on that wastepile that is worth looking at, it'll be the first time. MySpace doesn't seem to police things like virus infected sites very well, if at all, much less any other illegal or immoral activities among the kiddies they're trolling for.

Having a bartPE disk would probably have helped. Google this and build one for yourself ASAP, and learn how to use it. You boot from it and do your searches for infected files from there; since you don't boot from your infected HD, the virii can't get their defenses up.

AVAST antivirus is free and does a much better job, IMHO, than either Symantec or McAfee. I've seen AVAST scoop stuff up that both the commercial products ignored. It also screams like a banshee if infected files even try to install themselves on your machine.

Most of all, be careful! It might even be worth having a separate PC for surfing, one with minimal data on it that can be reimaged quickly - use GHOST to get and keep an image of your system while you know it's still clean. DON'T keep confidential info on it. Make sure ALL your systems are armored heavily, OS and security paatches are always up to date, firewalls up, and so on.

For quite a while I've been using the free version of a program called WinPatrol. It just sits in your icon area and monitors your startup programs, and if something changes in any of a number of places it asks if you want to allow it or not. It can also be used to blunt the claws of some viruses / spyware once they're in, by disabling or removing some of their startup entries.

You can get it from www.winpatrol.com.

I am not at all affiliated with WinPatrol or the author - I've just found it to be very helpful!

Now I understood that you already have formatted the disk, therefore the data is already lost and you are not interested in saving it, anymore. But there are a few options people like you can use to avoid formatting the disk.

1. Other good approach to solve a virus issue is to log into the station using other admin account, which was not previously used, therefore the Internet temporarily files are clean. Try to use that account to clean the system. It worked for me.

2. Other idea is to have a separate OS installed on the same system (preferably on different partition, different disk is even better). Use that installation as a spare one to clean the infected installation. You?ll have full access to all the files on the infected partition, therefore you can clean/delete any file (could be even system files). Do not worry too much if a system file is going to be deleted from the infected installation because when Windows starts, it will recreate those files. If it doesn?t boot, you still have an option to repair that installation using the CD. After you boot from the CD, do NOT use the first repair option you see (RC, or RR), go further and then use the repairing for the installation detected on the disk by Setup program.

3. The other option is physically removing the disk from that machine and plug it into another machine with adequate antivirus software and then try the same things as above.

Good luck,
George

the internet is a great tool, but it is fast becoming a waste dump for scams, thieves, etc...

access is going to be controlled before you can do away with the garbage that is polluting it...

which i use to be totally against, but i am nearing the point where i am willing to give up some of my freedom to control these bastards and put them where they belong - wired to some chair that provides a lot of voltage when the right key is pressed...:)

well msn messenger is prone to virus too...there are times where people automatically send you/people on their msn list a message saying "please download this picture" and comes with a file.

there are times when the virus will automatically send a zip/rar file saying with a name (i cant remember the name of the file) asking you to download the file.remember dont download and dont even execute the file..

if you are not sure whats with the file or why suddenly your friend send you the file,ask him/her....

many times i got the message but i did ask my friend why they send me their picture and they told me they didnt...

i think there is a fix to that by editing the registry,but i am not sure where..maybe someone can point it out to us

NOT

in windows/system32 finf
rrtcany.dll (sometimes its sacskza.dll)

rename it (name and extension! I changed mine to a jpg file).
restart
delete the renamed file

no need for a reboot

Unfortunately, I found out recently that a friend of mine had encountered this virus. He is not all that computer saavy and so he actually went through with buying the software that was proposed to him. He was smart enough to cancel his credit card right a way, but financial damage has still been done. Has anyone else purchased the software? If so, have you attempted to get your money refunded? If not, it seems like it is time to start making reports to the credit buereau.

Goback 4 will restore PC to before you downloaded it thus getting rid of it without to much hassle, {This leads me to believe that the people at Virus Burster CREATED the Virus} after reading this post the scum bags email should be bombarded so to crash there server SOB. ANYONE KNOW THE EMAIL ADDRESS?

Spy Sweeper

Spy Sweeper

Without such, you're leaving yourself wide open. AV products are, for the most part, reactive tools, not proactive ones.

If nothing else, at least install a free version, such a Zone Alarm. Though I am less than please with their suite, their basic firewall is well worth the price, and then some.

Also, you need to protect the Registry Hive from unwanted changes. You would do well to try Spybot Search & Destroy for this task; it will notify you of any attempt to change the Registry, so that you make the decision whether to allow this instance, allow always, deny this instance, or deny always.

Okay, I get Viruses every now and then, the list of viruses is endless. However, it is very easy to get rid of viruses provided that you have updated Anti-virus Software and Spyware that you run regularly depending on your internet activity: Downloads/ Unsafe web browsing habits.

1) The first step if you suspect a Virus is to update your Anti-virus if possible.
2) Go to: Start\Control Panel\Folder Options and click the View tab.
3) Since viruses are hidden you want to select options that will un-hide the hidden folders to show any viruses before you run your updated Anti-virus.
4) In the View tab, click on "Show hidden files and folders."
5) Next in the same View tab, click on "Apply" and then click on "Okay."
6) Reboot your computer and press F8, to get into Safe Mode.
7) Run the Anti-virus in Safe Mode.
8) And when your Anti-virus picks up the virus make a note of the viruses location.
9) Go to the virus location detected by the Anti-virus and delete the folders containing the virus assuming it is not a crucial system file/files need to boot the O.S.
10) After deleting the virus to the Recycle bin, all you have to do it empty the Recycle bin and your virus is gone.
11) Run the Anti-virus one more time in Safe mode just to make sure that it is gone.
12) If the virus is still there, repeat the above steps or if you have multiple viruses.
Excellent free Antivirus Software includes: AVG, AVAST, etc. And Nortons and Bitdefender provide free online Anti-virus scan.

I would highly suggest ghosting your system for just such an event. OR......STAY OFF THE PORN SITES!!!!
Just an idea....

Kevin

Any security application can only deal with those threats that it is able to identify. A threat which dissembles, so that it takes on an appearance that cannot be identified as being that of a threat, will therefore escape detection.

In order to insure detection of such at boot time would require that the boot be effected on a [i]virtual[/i] machine, observe the behavior of [i]all[/i] processes initiated at boot, and determine if any of said processes, either individually or in concert with others, [i]created[/i] a process that could identified as a threat.

And, this approach would work [b]only if[/b] the threats functioned in an [b]identical manner[/b] on [b]both a real and virtual machine.[/b] In fact, there are now extant malevolent processes which are capable of determining whether or not they are being executed on a real machine or a virtual one, and modifying their behavior accordingly!

There is [b]no simple and easy cure[/b] that will work in all instances.

to the pirated OS or running without service packs. :0

Then to admit that you on top of that weren't running ANY AV software running? On a Windows Box? That is just nuts. infection the first time you browse the web!

so basicly you were looking a porn and messed up
lmao
loser