Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
Capnbigboobies
Dec 2, 2004

OneEightHundred posted:

From the source:
MALICIOUS LINK CLICK AT OWN RISK >>> o

Kaspersky apparently started detecting it 10 days ago. NOD32 doesn't.

The free version of AntiVir caught it almost instantly. Once you disable the stupid popup antivir is a great antivirus.

Adbot
ADBOT LOVES YOU

Capnbigboobies
Dec 2, 2004
What makes this newest generation of virues/malware is that you can never be 100% sure its gone unless you just reformat the whole system. On badly infected machines it seems that even after a antivirus scan, malwarebytes/superantispyware/adaware/spybot and combofix the machine still can still be hosed.

Windows XP's level of security in the hands of an average retard computer user is almost zero, even with the best antivirus. I find its often far faster to just backup and nuke the OS. Often a reinstall of windows is far faster than running several scans on a slow computer.

Capnbigboobies
Dec 2, 2004
I think the computer I am working on today is the worst machine I have ever found. So far antivir has found, I poo poo you not, over 4000 viruses.

EDIT: Just for fun

Capnbigboobies fucked around with this message at 04:30 on Dec 20, 2008

Capnbigboobies
Dec 2, 2004
If it was my machine I would nuke the install and reformat. Since it's not my computer I am not going to do that and then reinstall all the bullshit they want, they are not paying me enough for it. Its a dell, but has the recovery partition deleted.

I imagine they had some "computer smart" friend check it out a while ago and deleted the backup to have more hard drive space. Yeah buddy real loving smart since they only have a few crappy pictures on the computer and now there is zero way to restore the computer.

gently caress it they are not paying me enough for me to bother tracking down my XP home disk to rebuild it.

This machine went from so bad you could not do anything, even open my computer or IE to being reasonably snappy. I tried the GMER and it did find a hidden process and I was able to kill and delete it. GMER is pretty cool!

It took combofix, malwarebytes, superantispyware, GMER, and antivir to clean it up. Anything else I should throw at it? Ha!

Capnbigboobies
Dec 2, 2004

highme posted:

After reading this thread I downloaded Malwarebytes, Superantispyware, Combofix & Avira. I haven't yet installed Combofix, but Avira keeps popping up an alert saying that my copy of Combofix.exe is a Trojan. I believe I dl'd it from bleepingcomputer.com. Is this a known issue or did I trust the wrong google result?

I just scanned a copy of combofix from bleepingcomputer with antivir and it says its virus free.

Capnbigboobies
Dec 2, 2004

darkforce898 posted:

I still vote for TeaTimer from Spybot... works marvelously.

The problem with Teatimer is that if we install it on all the computers we are constantly fixing, the users would just mash accept or even worse delete a benign process/program/registry key.

Capnbigboobies
Dec 2, 2004

Jonny 290 posted:

TeaTimer and other "bong! security alert" programs - GREAT if you can understand what it's asking, terrible if you don't. TT should never be installed for end users IMO, they either blindly click accept or block on every popup.

I agree 100%, I always uncheck teatimer and the other thing SpyBot uses when I install it on a computer I am fixing. For us awesome computer guys we can use teatimer, but we never really run into spyware that often anyways.

Capnbigboobies
Dec 2, 2004
Anybody notice that after cleaning an hosed up xp machine msconfig is gone? Do some of these viruses/malware delete msconfig?

Capnbigboobies
Dec 2, 2004

darkforce898 posted:

True. In an environment where no one knows what they are doing I would just use DeepFreeze with their desktop linked to network drive being the thaw space.

After fixing a few computers over and over for the same poo poo I have considered installing DeepFreeze or MS SteadyState.

Capnbigboobies
Dec 2, 2004

ymgve posted:

Oh god. Reading this thread is making me seriously consider throwing Opera inside VirtualBox and use that for browsing.

If you are ultra paranoid you can do this pretty easy. Just grab virtual box and a xubuntu image from here http://en.wordpress.com/tag/virtualbox-images/

It would be great if somebody sold a commercial product that would run firefox or opera in a virtual machine that would be transparent to the end user. Would be great for office and public settings.

I just tried it and xubuntu with firefox open with digg.com takes up about 256mb of ram. Not too shabby. It took like maybe 10 min not including download time to set it all up.

EDIT: Oh crap virtual box has a seamless mode that works wonderful!

Capnbigboobies fucked around with this message at 03:19 on Mar 1, 2009

Capnbigboobies
Dec 2, 2004

Lediur posted:

I made a VM using VMware with the intent of testing suspicious applications. It is installed with a completely clean version of Win XP SP3. I have snapshotted this for quick and easy flattens.

Is there any risk of a virus jumping into the host? I don't want my computer getting compromised (even if I do use a combination of Avira and SuperAntiSpyware)

I guess there is a small chance if you have windows shares between the guest and host OS with some viruses if you are not up to date on patches.

Capnbigboobies
Dec 2, 2004

fishmech posted:

But then if that VM gets infected, all of your stuff is still screwed up.

Yeah that's why I would make the guest OS linux instead of xp. Sure linux is not invincible but its far better than xp while being lighter on system resources than vista. For running firefox linux would work fine.

Capnbigboobies
Dec 2, 2004
Has anybody upgraded to Antivir 9? I am wondering if you can still disable the "buy me" popup.

Capnbigboobies
Dec 2, 2004

mischief posted:

Aaaaand pretty sure my gaming box has it now as well. That's where I dumped the pictures from the first computer infected. I was really, really cautious about what I transferred and thought it was all pretty sanitized. I first noticed the system clock resetting to 2003 and got worried, and then the random connections to .pl sites started and Ad Muncher failed the CRC check. Please note that this was with NOD32 "set to 11" so to speak, and it still hasn't actually alarmed for having the virus... It's kind of frustrating when the user can detect the virus before the anti-virus. :sweatdrop:

It's powered down in the corner waiting for the Knoppix treatment. Good times!

drat shame for Time Warner here in Greensboro, though, that'll be about 24 gigs of Steam games downloaded tomorrow putting that computer back together. Thank goodness they fixed that pricing idea. :haw:

Yeah it seems Nod32 is really slipping these days. It seems a lot of machines with Nod32 are getting infected. I wonder how Avast!, Antivir and Kaspersky hold up.

Capnbigboobies
Dec 2, 2004
I downloaded some tool to prep a sega cd iso for a psp emulator and Antivir a day later said it had virut. I don't remember running it and after removing the file Antivir scans clean. I ran norton's virut scanner and some other one and they were clean too. I should be safe right? After following this thread so long I am scared of virut.

EDIT: Why is there no patch from MS to prevent an infection from virut? Is running an antivirus enough?

Capnbigboobies
Dec 2, 2004

Midelne posted:

If you ran a file that was infected with Virut, you're probably boned, but who knows.

You could have the world's most perfect operating system and if you ran a file infected with Virut, the world's most perfect operating system would obediently infect itself with Virut. Coupled with the fact that you can't patch a user who thinks running a downloaded tool intended for use in a legal grey area without virus-scanning first is a good idea, it seems safe to say that viruses will be around for a long time.

edit: Another possibility is that you already had Virut and the tool was infected when you ran it, but that should've showed up prior.

I like how you had to throw in the subtle insult about patching users, but whatever. I just wanted to compress a sega cd disk I have, not zero day filez.

I have been sort of short on sleep due to finals, but I realized it detected vundo not virut. I got them mixed up.
The first time I downloaded the file it was scanned by my antivirus (antivir) and it came up with nothing. The next day antivir popped up with a message that it found TR/Vundo.Gen. I just re-downloaded the file and ran it through virus total and here is the results.
http://www.virustotal.com/analisis/354f0981c740f15f7bb61b8e14a8d924

It looks like it was a false positive anyways.

Capnbigboobies
Dec 2, 2004

Luigi Thirty posted:

What would I do without you ComboFix :allears:

Yeah Combofix in safe mode is now pretty much the first thing I run on a infected machine. If it does not clear it out so I can run a antivirus scan I just format because in the end its faster.

Capnbigboobies
Dec 2, 2004
MSE is a pretty nice AV and I think is a nice replacement for Avast, AVG and Antivir. I feel that Antivir offers the best protection, but when there is a version update, the way to disable avnotify.exe often stops working on xp home machines. So the computers I installed it on for friends will have that drat pop-up come back up!

Screw it, I just put MSE on those machines. I like how its nice and quiet, it never bugs the user unless something is wrong. Some people have bitched about how one of the processes can use 50mb of ram, but jesus christ spend 15 bucks and get 512+ more ram then! Is anybody else tired of people bitching about modern apps that use more than 8mb of ram?

Capnbigboobies
Dec 2, 2004
Combofix is such an amazing tool. I really don't know where i would be without it. I am almost at the point now if combofix and a virus scan wont 100% fix it ill just flatten and reinstall the machine. It's faster that way anyhow.

Also why are people still using Avast! (?) Isn't MSE overall a much better antivirus?

Is it because people still roll their eyes when they think 'Microsoft' and 'security?' MSE scores very well on those AV comparative websites and seems to perform pretty much just as well as any of the paid AV applications.

MSE is great, it's like the best product ever for non-computer savvy people. It just chills in the tray and wont bug the user unless something is wrong. And unlike other free AV programs it wont have popup banners or crappy interfaces to confuse a novice user. I say the only thing to knock it on is that it uses up a lot of ram. I think around 50 MB. Oh well ram is a cheap as dirt these days and even a new middle of the line HP comes with 6gb of ram.

Capnbigboobies
Dec 2, 2004

ymgve posted:

MSE is apparently not available outside the US.

Using a UK proxy the download link comes up just fine. Also its pretty trivial to just download it off softpedia.

Capnbigboobies
Dec 2, 2004
So the other day MSE popped up with a warning that one of my buddies on aim (which one I do not know) had some sort of exploited .jpeg.

I imagine this was a false positive. I wanted to run it through virus total, but I was too lazy and just let MSE delete it.

Capnbigboobies
Dec 2, 2004

Epikhigh posted:

Well...got XP Antivirus 2010 from thepiratebay :/

You should run firefox or chrome with a adblock filter/plugin. I find this dramatically cuts down on XP Antivirus infections. A friend of mine kept infecting his machine with that crap from some bullshit "scene release" website. I installed Adblock plus and that stopped. (I hope)


Also of course a AV should be run.

Adbot
ADBOT LOVES YOU

Capnbigboobies
Dec 2, 2004

Space Gopher posted:

If you're using anything but Microsoft Security Essentials, you're doing free antivirus wrong.

I agree, but I am annoyed to see machines I put it on still get massively infected. Its just too drat easy in xp to kill AV processes. It really is a joke.

  • Locked thread