CurtPalme.com Home Theater Forum

**Curt Palme** · Posted: Wed Mar 17, 2010 11:46 pm Post subject: Virus attack!

FYI,. I got hit bad this morning on my main computer. It was running slow, so I rebooted, and got all sorts of 'YOU'RE INFECTED' messages on the screen, did I want to start my virus scanner? While I argued with the screen, saying my pap smears are all fine now, I knew I'd been hit. With what, I don't know, but after an hour of trying to get my virus scanner to start, it seems this virus more or less shuts down any program I try and open.

So eff it, off to the computer place I went, and dropped it off.

I'm trying on my laptop, but have no access to email, as once the email is downloaded to the computer, it's no longer on the Shaw server. That sucks!

So, email is down for a bit, until I get my computer back hopefully tomorrow. I can't even change my auto reply, as my ID was cookied on the old computer.

But, my phone still works if someonen wants to get a hold of me.

IN a week, I had my GPS swiped out of my car, my cell got stolen last night, I finally HAD to go to a phone with a QWERTY keypad, as basic phones are no longer available, and now the damn computer. THat's three. Stop now, OK?

At least I got a cantankerous 909 SMPS working today. That one was a TOUGH fix, but now I know....

Tom.W · Joined: 09 Mar 2006 Posts: 6635

Do you have your hard drive backed up on an external hard drive ?

Did you try a system restore to an earlier date ?

Shocked

**AnalogRocks** · Posted: Wed Mar 17, 2010 11:59 pm Post subject:

You thinking restore disk Tom?

Tom.W · Joined: 09 Mar 2006 Posts: 6635

With windows XP you can do a system restore to an earlier date to undo changes. Just click START then help and support and then undo recent changes to your computer with system restore. Choose the last system restore point if everything was working fine at that point in time.

Reminds me of this thread ..........

https://www.curtpalme.com/forum_archived/viewtopic.php@t=19632.html

But first read this ..

http://www.spyware-techie.com/malware-defense-removal-guide/

Rolling Eyes

**Curt Palme** · Posted: Thu Mar 18, 2010 12:20 am Post subject:

I was going to try that, but with a virus lurking, I figured I'd just take it into the shop.

Tom.W · Joined: 09 Mar 2006 Posts: 6635

It sounds like a false positive to me....

http://www.xp-vista.com/spyware-removal/remove-malware-defense

Rolling Eyes

Tom.W · Joined: 09 Mar 2006 Posts: 6635

My sister got this virus once a while back and this worked...

http://www.bleepingcomputer.com/virus-removal/remove-malware-defender-2009

http://www.pcindanger.com/malware-defense-removal.html

**Curt Palme** · Posted: Thu Mar 18, 2010 12:52 am Post subject:

I did get one virus scanner to work that I had on the computer, but 1/2 hour later, and it locked up and a porn window had opened. Started it again, and the next time it opened www.viagra.com. Smile

With my work PC, I don't have time to screw around. I'm better off working on CRTs, and letting the pros do the computer stuff. I will update the virus scanners once I get the unit back. Bitdefender was doing a good job, but I let the subscription expire before Christmas, and 'forgot' to renew it. I wasn't too worried, since I never download anything onto my main work computer, I have another one to surf and download, but I got screwed this morning...

Tom.W · Joined: 09 Mar 2006 Posts: 6635

I did get one virus scanner to work that I had on the computer, but 1/2 hour later, and it locked up and a porn window had opened. Started it again, and the next time it opened www.viagra.com. Smile

So does that mean it's back up and the meters running ? Wink

**Curt Palme** · Posted: Thu Mar 18, 2010 4:04 am Post subject:

No, I'm on my laptop. Computer place says they will probably need to reload Windows after saving all my files. Piss me off!

zaphod · Joined: 16 Jun 2006 Posts: 2002 Location: Cloverdale

curt - you gotta get the virus s/w that comes with your shaw account. i can help if you want it installed. it's cleaned my PC at least once and blocked a few bad things too.

ecrabb · Posted: Thu Mar 18, 2010 6:44 am Post subject: Re: Virus attack!

akajester · Joined: 09 Jul 2008 Posts: 934 Location: Wisconsin

The majority (90%) of windows viruses and malware going around right now get in via flash and pdf exploits. With those two things being almost necessary to run these days, I've found only one way to protect yourself well. Use flash player as no substitute exists. Then use foxit pdf reader (free) instead of adobe acrobat. Get any decent antivirus, free is fine, AVG works great. DO NOT use Internet Exploder! Get Firefox and install the Adblock Plus and NoScript plugins. This will prevent all scripts and most ads from loading while browsing. This is how they slip your computer the mickey. For instance, my wife got infected checking yahoo mail! So, you set this combination up and for example you go to curtpalme.com and you'll notice things don't work right. Click on the NoScript icon (bottom right "S" icon in the browser window) and say "allow curtpalme.com". This will allow the main site but not any third party linked sites for instance outsourced ads. It's an extra step but it remembers your setting for that website so you set it once per website. The majority of the websites that infect you are not from the main site! Only a few websites require other sites to work. For instance Ebay and Amazon have separate sites to load images. I had to approve the main site and a secondary site usually named something having to do with "images". This has helped me avoid viruses and other nasties for quite some time now. That is, after I had to reformat and reinstall windows about 10 times in one week for myself and other clients. It's good money though! Smile

In a few cases I was able to clean with malwarebytes antimalware another free tool, but even that isn't perfect. No software is perfect. You could even get infected using noscript, but it puts another wall between yourself and the web, one that you can control.

http://adblockplus.org/en/

http://noscript.net/

Enjoy!

WTS · Joined: 08 Mar 2006 Posts: 1276 Location: Calgary

CUrt,

Yes for sure use Shaws F Secure for anti virus and also you can setup Outlook to keep a copy of all your emails on the shaw server, they will remain on the Shaw server until you delete them from your own computer. As for downloading F Secure just go to Shaw's website and download it. I beleive it will also delete any other forms of antivirus SW on your computer at the time of install, it's free do it. I've been using it for years and have never had a problem period no matter what I've download or whatever sites I've been to, shaw secure seems to catch them all.

WanMan · Joined: 19 Mar 2006 Posts: 10270

While I did get rid of some mirrored disks, I chose not to give up the mirror for my boot disks. I am wondering now if it might be wise to disconnect the second disk from that boot RAID and only reconnect it once per week or two to resync the information therein. This would have certainly reduced (minimized) the notion of a filesystem corruption across the RAIDed disks and provided a 1-2 week window of backing up in case something like this happened.

**Curt Palme** · Posted: Thu Mar 18, 2010 2:41 pm Post subject:

Thanks guys! I don't typically download anything onto my work computer. THe last thing I did was a service manual through a secure link from an eBay seller. Can't see the porn spam coming from there. Will do that Shaw thing as soon as I get it back. Still working on my laptop.

BTW, I am using Firefox..

akajester · Joined: 09 Jul 2008 Posts: 934 Location: Wisconsin

You might think it couldn't possibly come from Ebay, but it can came from the ads that third parties are loading on their site. Heck, would you ever think yahoo mail would infect someone? I don't believe anyone that says one product will protect you from everything. It's just not possible. If you already use Firefox that's great, add the noscript plug-in (at least) to prevent those ads from loading in your browser without your consent. The anti-virus/security software is one of the last methods of defense you have, next to a full restore from backups. I've worked on hundreds of computers that have all had different security software install and they're all 99% effective. You need to add a block to prevent these things from loading in your web browser period.

It's like saying the airbag in your car is enough to save you. If you don't drive safe to begin with you're still at risk.

Another thing I do is use acronis backup. hang a removable drive (usb/esata/etc) off your computer and tell acronis to do a full backup (or incremental) when the computer is idle. It can do a backup of a full drive in about 10 minutes. Amazing! Then when this happens again, just do a full restore from yesterday and you're set and saved a bunch of cash too. Curt, if you want a beta copy of acronis let me know and I'll send it your way. Acronis had it free for download a while back and it works great! No need to spend a bunch of money.

lexx21 · Joined: 10 Oct 2008 Posts: 119

It sounds like you had the "antivirus live" virus. I was hit with that from a webpage. It makes it look like you have tons of virus alerts coming up but won't allow your antivirus to run. You don't have to reinstall for that one, but wipe out some reg entries and use a removal tool. It's a pain in the ass once you get it though.

I agree with one poster here. If Shaw allows for IMAP email, then that is what you should use. The emails would stay on the mail server so you can access them from any pc.

km987654 · Posted: Thu Mar 18, 2010 8:38 pm Post subject:

**Curt Palme** · Posted: Thu Mar 18, 2010 9:11 pm Post subject:

Well, $100 later and I'm running again. The computer Dr. got rid of it through DOS. He said it was a strange one that he hadn't seen before. Still, I lost no data. He's got me set up on AVG, we'll see how that goes.

Everything so far is working, so I'm backing up EVERYTHING to DVD in case it crashes again.