Virus question for tech challenged

11/17/2008 | self

[libbylu]

I was googling alaska illegal aliens. I clicked on a site and my computer system page came up, saying I head three trojan viruses, and something called iabestscan came up, asking if I wanted to remove. I did, then it came up with a "buy page". That's when I noticed it was not my avast. Trying to get out of it, didn't want me to cancel out, Avast found a trojan and removed it. When finally out I closed out firefox and ran a scan, Avast found one more trojan.

Is this really wierd? Should I be doing something else? I did go to Xoftspy and ran a scan, had high risk stuff in cookies, and in registry.

Thanks.

[Terpfen]

Your problem is that you confused a pop-up advertisement with a warning message generated by your computer.

You fell for a trick, and the trick installed viruses on your computer. Prior to your clicking on the ad, you were clean.

[6SJ7]

That "buy page" you mention sounds like a common trick on some nefarious web pages to try and trick you into purchasing virus protection software. There likely is no virus protection software, the site just wants to charge your credit card. These sites will give some erroneous warnings about virus being detected to try and scare you into purchasing the software.

If the company actually does send you software, it is likely spyware and not an actual virus protection package.

[libbylu]

Thanks, it was tricky how it did it. Was it related to where I was searching? That was a really nasty thing to do.

[mmichaels1970]

I agree with Terpfen. As soon as you clicked “remove”, you got hosed. I’d recommend you try to do a system restore (in XP-Start/Programs/Accessories/System Tools/System Restore) to restore you system to a previous date/time before the problem happened.

Then you might want to go to a site like www.trendmicro.com and run their housecall online virus scan. It’ll take a while to scan, but it should help you determine if the system restore cleared the malware.

Sometimes, malware will remove all of your system restore information. In that case, you won’t be able to select a previous date/time from your System Restore tool. Go right to an online antivirus scanner if that occurs.

[mmichaels1970]

Do the system restore only if you suspect you were infected. If you start noticing many more pop-ups now since you went to that site, you’ll need to restore.

[Loud Mime]

bump

[avacado]

"I was googling alaska illegal aliens..."

I couldn't get past that part!

[milwguy]

http://www.malwarebytes.org/mbam.php

Free and works well. My wife made same mistake as you and was a real pain for about two weeks. I installed their program and ran it and it removed everything that my avast would see but not be able to fix. Also, the automatic updates from microsoft was disabled by the Trojan Munod (sp) that my wife got on the computer. Once I ran Avast, then Ad aware anti spam, and Malwarebytes, all the issues diappeared and microsoft autom updates was able to bwe turned on again. Good luck!

[hunter112]

They’re called “frostbacks”.

[avacado]

LOL!!!

[Uri’el-2012]

Is this really wierd? Should I be doing something else?

Get root !

[weegee]

Several things about that tactic. It is illegal on several counts. It is false advertising to pretend to be your own computer security and not what it clearly is. It is also blackmail to bill someone to “remove” what you just installed.

I’ve gotten some nasty adware infections before (been a long time) installed under no such deceit (I wasn’t even asked) and would get a periodic popup that would tell me that for $29.95 (or whatever) it could remove the infection from my computer. There would even be a popup now and then that said “still here”.

And no, I did not pay them and would not recommend doing so (there can be no trust of anyone behaving in such a criminal behavior). Good luck on cleaning your system.

[domeika]

One way to be absolutely sure nothing is installed on your system is to create another user account on your machine that does not have admin priveleges, i.e. cannot install anything. You can then either log on to that account and then surf, or right click on the Internet Explorer or Firefox icon and select "Run As", and then be prompted for which account to run under.
As to the problem you had, yes, it's a common trick to have the user inadvertantly install the illness that they are selling the cure for.
In regards to antivirus, I use Windows One Care, which stops all malware, spyware and virii (so far anyway). I've used avast, mcaffee, bitdefender, and a few others, but microsoft seems the best, and it's dead simple.

[weegee]

Some virus infections (and let's be honest, that is what these are) are now targeting certain page content.

There was an article that was following trends (whatever the hot new Google search is that week, there are a number of pages designed to get a hit just to infect).

Cybercriminals syndicating Google Trends keywords to serve malware (ZDNet October 2nd, 2008 Dancho Danchev)

Probably more of the chill wind blowing from the Left.

But also know that you can become infected and then SEE the infection once you have travelled to another page.

[Blood of Tyrants]

My daughter LOVES Libby Lu.

Anyway, I did a google search for something and clicked on a link and got the same type of crap. This one was persistent and would not allow me to click out of it. I simply closed the browser and did not go back to the site.

[JoJo Gunn]

You fell for something akin to this animated image which I found somwhere a while back:

 

Over the last few years the scumbags have taken legit fears of spyware to a whole 'nother depth. 

 

[domeika]

Somtimes a javascript message box will appear that prompts to install something, or maybe asks some seemingly innocous question. NEVER click ok, or even cancel. Click the X in the corner to turn it off, and if it appears again immediately (also a widely used tactic), you will not be able to shut the browser down. If that happens, click Ctl + Alt +Del, then from the list of applications running, shut it down there.

[Bloody Sam Roberts]

"Nasty little spywareses and viruses...always trying to get to The Precious. Smeagol hates them."

[Conservativegreatgrandma]

Carville!!!