400,000 PCs Infected With Fake "Antivirus 2009"

nandemoari writes "The second month of Microsoft's campaign against fake security software has resulted in the removal of the rogue "Antivirus 2009" application from almost 400,000 infected PCs. Microsoft claims that December's version of the Malicious Software Removal Tool (MSRT) — the free utility included in Windows Update every month — specifically targeted 'Antivirus 2009.' According to Microsoft, MSRT removed the rogue application from over 394,000 PCs in the first nine days after it was released on December 9."

Comments

Tomorrow's Headline

[meadowsoft]

"over 394,000 PCs report massive amounts of virus infections due to the accidental removal of Antivirus 2009"

Re:Tomorrow's Headline

[Anonymous Coward]

barack obama will make you touch his junk liberally.

Re:Tomorrow's Headline

[Anonymous Coward]

It's over NINE THOUSAND!!!

When will the Malcious software removal tool...

[Anonymous Coward]

Remove my win32 directory?

Re:When will the Malcious software removal tool...

[Anonymous Coward]

Run a search, I'd bet it already did.

Re:When will the Malcious software removal tool...

[rrohbeck]

... and load a Ubuntu installer?

Re:When will the Malcious software removal tool...

[Anonymous Coward]

hahahahahahaha

oh dear me how original and hilarious.

joke is so old now.

Re:When will the Malcious software removal tool...

[madhurms]

Boot into dos and try "rmdir /windows" :)

Re:When will the Malcious software removal tool...

[therufus]

Sad thing is that the majority of Windows users would not know what 'DOS' actually is. A very high percentage of people who use Windows lack the fundamental understanding of not only where the operating system came from (it's roots if you like) but also what alternatives are out there.

I've known people who, when told about linux, think it's all command line based because it's used for servers. To tell these people that there is a command line in Windows (in M.E., XP and on this actually rides ON TOP of the OS, not the other way around like 3.1, 95 and 98) shocks them.

Re:When will the Malcious software removal tool...

[Anonymous Coward]

That won't work because the directory isn't empty. Instead use:
deltree /y \windows

Re:When will the Malcious software removal tool...

[Anonymous Coward]

"Remove my win32 directory?"

When 64bit migration is complete, and 32bit (WOW64) is retired.

Re:When will the Malcious software removal tool...

[contrapunctus]

I agree with you a 100%.
But I would guess most people don't know how an appliance (kitchen for argument's sake) works, and they don't care. It cleans dishes, who cares how it works.
I think computers aren't "computers" (like in the 90s maybe) anymore, it's an appliance that checks email and plays solitaire.
I'd even venture and say that's why one pays (MS or Apple); it's so that one doesn't need to care how it works.

maybe

Re:When will the Malcious software removal tool...

[Anonymous Coward]

That won't work because the directory isn't empty. Instead use: deltree /y \windows

DELTREE doesn't exist in any OS based on Windows NT (i.e. NT, 2000, XP, Server 2003, Vista, Server 2008).

Try "rd c:\windows /s /q".

It won't remove files that are in use (or the dictories within which they reside, naturally), but, with the proper rights, will do quite a number on your Windows directory structure.

HTH. HAND.

Re:When will the Malcious software removal tool...

[Smauler]

That will not work. You want "rmdir \windows /S /Q", but I'm not too sure what it does with read only and/or system files.

Re:When will the Malcious software removal tool...

[Anonymous Coward]

I get your point, but I made a resolution yesterday that I would be more pedantic this year. So, to start off this year with a bang, here is my list of valid points (for varying definitions of valid):

- nobody really has a DOS disk left to boot from
- if they have, less and less PCs have a floppy disk drive left to boot from
- after booting into DOS, you would be on the boot disk drive, which probably does not have a windows directory
- the malicious software removal tool only runs on XP and above. It is safe to assume then, that the Windows directory is on an NTFS-formatted partition. These are not accessible from any version of DOS.
- if you do happen to find a Windows system running on FAT32, there is only one version of DOS that can read those: MS-DOS 6.22, only available with Win98 (maybe FreeDOS can as well, I wouldn't know)
- a forward slash indicates a command line option, not a directory specification
- rmdir only works on empty directories. You want deltree.
- deltree \windows, even if succesful, does not remove a win32 directory, unless is happens to be residing in \windows, which is not the case for any incarnation of windows I know.

There. I have done my good deed for this year already!

Re:When will the Malcious software removal tool...

[flappinbooger]

Computers have been like toasters since 2003.

You go to a store, put it in the cart, go get some eggs, cheese, chips and milk, and check out. You go home and plug it in and make interwebs (if it's a computer) or toasts (if it's a toaster).

The only time it gets interesting is if you're REALLY INTO TOAST, then the above scenario isn't for you.

Malwarebytes

[oahazmatt]

At my job, we've used Malwarebytes to fix about 200 PCs with this so far. It's a good alternative.

Re:Malwarebytes

[The Phantom Buffalo]

Or you could just delete the file and 2 reg entries.

Re:Malwarebytes

[Nimey]

We use Super Antispyware and Spybot Search & Destroy ourselves, running from the Ultimate Boot CD for Windows: http://www.ubcd4win.com/

Re:Malwarebytes

[Finallyjoined!!!]

Yup, I've removed it from 14 Windows PC's belonging to neighbours & friends. Malwarebytes was a handy tool.

The annoying thing though, most of them installed it themselves, deliberately, thinking they were doing "good".

Bah. Hang the authors of "Antivirus 2009" up by their nadgers.

Re:Malwarebytes

[Anonymous Coward]

You seem to have encountered a very mild version. There are many variants in the wild, some under different names. Mom got hit with one that put at least 20 files on the machine, tampered with system files and system reg entries and managed to get protection from the system file protection mechanisms in WinXP.
Malware Bytes tool fixed it right up.

Re:Malwarebytes

[peragrin]

the wooshing noise you heard was the sound of thousands of linux boot disks flying over your head.

Re:Malwarebytes

[Rahga]

That advice works wonders when the file won't delete while it's in use and the registy entries rewrite themselves after you delete them.

Re:Malwarebytes

[maz2331]

I've used Malwarebytes to fix this nasty little bugger too, several times. It seems to work pretty well.

I've had times where it's been necessary to rename the mbam-setup.exe to something like mbs.exe, and the main .exe to a different name, too. Some of these malwares do block access to known removal tools.

Re:Malwarebytes

[lejflo]

For the general malware infection, finding out what reg entries and what files to delete require:

1. Doing a Google search for symptoms
2. Reading through a LOT of forums/pages to figure out what you have.
3. Manually scouring your filesystem and registry for the culprits/doing many other steps that you found from the aforementioned search.
4. Crossing your fingers and hoping that you followed the appropriate instructions.

Contrast to Malwarebytes:

1. Start up the program.
2. Run the update (as needed).
3. Start the scan.
4. Go do something more fun (like, e.g., posting on /.).

I LOVE Malwarebytes. It saves me so much time, and it has, on occasion, found stuff I had no idea was even on my computer.

Re:Malwarebytes

[Justin Hopewell]

I'm not sure I have the exact malware described in the summary, but I think it is. Its been on there for about 2 months. Malwarebytes manages to find usually around 20-40 things on my computer; I'm assuming they're all part of this program. Anyway, it removes them, then when I run another scan I see that whatever was deleted was just replaced by more malware. I can't get rid of this thing! Should I try running Malwarebytes in Safe Mode? I'm worried if this virus is phoning home.

Re:Malwarebytes

[Endo13]

We use it at my job too (phone support) and most of the time it gets rid of it. Occasionally though, even that can't get rid of it. Even when it does seem to clean it, sometimes it misses a few files. My personal method is to first check the malware hiding places manually and eradicate anything I find, and then let Malwarebytes scan to see if I missed anything.

But yes, I can attest to the widespread plague of Antivirus 2009 and its associates.

Re:Malwarebytes

[Anonymous Coward]

We use combofix for anti virus 2009, but we have been using malware bytes for the new kid in town and called antivirus 360. It's relatively the same thing as av2009, bit av360 also has a script or something preventing certain .exe files from running like combofix and sdfix and malwarebytes. i usually just rename the exe and it works fine, but yea Ive probably removed this crap off of a few hundred machines myself and never thought of using msrt.

Re:Malwarebytes

[Emb3rz]

Then don't delete them. Change their permissions to disinclude system/whatever account and allow -only- whichever account you're running as. Then change the value of the reg key (assume it's pointing to a file to start up?) and reboot. When you've rebooted, they haven't. Feel free to delete the file/registry entries now. ;)

Re:Malwarebytes

[Anonymous Coward]

Some of the trickier ones will include themselves as part of winlogon, and winlogon is stupid enough to blow up if a dll listed in the registry to load fails. Becomes a tricky game of using sysinternals utils to nuke the right files and reg keys on boot before winlogon runs.

Re:Malwarebytes

[Endo13]

Oh yes, and one thing I forgot to mention that I found particularly interesting is how they manage to get so many people infected. They do it via google-bombing. I had been puzzling over how even careful users were getting infected, until I saw it happen on my own laptop: I was running a search on a black friday laptop model for more info, and the first search result on google gave me a panic popup (which I axed from task manager) and sent me to an Antivirus 2009 page. Naturally, knowing how to avoid their tactics I didn't get infected, but most people would not be so informed.

Re:Malwarebytes

[Endo13]

That's what Unlocker is for. http://ccollomb.free.fr/unlocker/

Re:Malwarebytes

[Vu1turEMaN]

Then use something like Unlocker to delete them, and then kill the registry keys after a reboot.

Thats how I fixed it.

Re:Malwarebytes

[gmagill]

A friend also had a particularly stubborn version. I replaced her AVG antivirus with Avast, ran a scan & it fixed it.

Re:Malwarebytes

[Endo13]

Try this instead.

1. Run Hijackthis and look for any suspicious startup entries. Even the average computer user will be able to rule out most entries as things they recognize, meaning you won't have to google more than a handful, which will probably take 5-10 minutes at the most.
2. Install Unlocker. http://ccollomb.free.fr/unlocker/
2. Browse to locations of files linked to by suspicious startup entries. Check date created.
3. Go to Windows directory, sort files by date, google suspicious files found since above date. Remove files confirmed to be malware or files for which you cannot find any information. (If you can't find any info on them, they're either randomly generated malware names, or malware too new to show up yet in a search.)
4. Do the same in Windows\System32.
5. Run a system cleanup to delete all Temp files and Temporary Internet Files.
6. Now delete the original malware folder.
7. Delete the startup entries with Hijackthis.
8. Restart computer. Should be clean.

The best part is, this will work with virtually *any* malware infection, and will generally catch things that even Malwarebytes misses.

Re:Malwarebytes

[cbiltcliffe]

This doesn't work with some variants I've seen. The malware is running as the system, but there are also components that are running as the current user.

Set the permissions to deny SYSTEM access to that key, and the user components change the permissions back before you can delete the key. Killing the user components is useless, as the system components restart them. Killing the system components blue screens the machine, as some are linked into winlogon, and you can't kill that.

Denying your own user write access to the startup keys to get around all this is, obviously, useless.

Offline scan/deletion is the only way to go with this crap.

Re:Malwarebytes

[Kleen13]

And I'll bet you were doing this far in advance of the Dec. 9 MSRT release....

Re:Malwarebytes

[cbiltcliffe]

Certainly, try Safe Mode.
You might actually have to configure the drive as a slave in another machine to get rid of it, using an offline scan. It's definitely the easiest way to eliminate stuff like this.

I've also seen AV2009 install a rootkit, which can't even be detected by most tools, let alone removed.

You can go to the link in my sig if you can't get it removed. I get rid of this crap for a living, and I'm working on a project currently that will allow me to do offline scans remotely. Cool stuff.

Re:Malwarebytes

[Nimey]

You don't get good malware-removal tools running on Linux, tard. ClamAV doesn't count, because it's not very good about detection.

You get good malware-removal tools on Windows because you get almost all of your malware on said OS, and because that OS is very popular hence has many developers.

Re:Malwarebytes

[Anonymous Coward]

It sounds to me like you've got something else going on in the background. MalwareBytes is great, but you need some other packages to complement it.

A few of the ones we use at work are AdAware2008, MalwareBytes of course, SuperAntiSpyWare, Spybot Search and Destroy, and an old pirated version of Pest Patrol. (My boss is less than ethical at the best of times.)

If you install those and then run them in Safe Mode, starting with AdAware, you should be fine. After you've cleaned the system out, or if you've got something stopping them from running properly, run DeepMonitor to find any hidden processes running.

If you can't update them, go to another PC and download/update the manual update files. (I've never had any luck manually updating AdAware, but that's no reason to not try.) If you can't even get the update files, you may have something that's changed your DNS server. AdAware can often find those without even being updated first, but if that fails somewhere out there is a script to reset your network registry entries (I've completely forgotten its name).

Good luck.

Re:Malwarebytes

[blincoln]

One of the potential dangers I've read about with this type of malware is that the google-bombed links don't just display popups - they also include things like hidden embedded PDF files that exploit vulnerabilities in older versions of Adobe [Acrobat] Reader to install the rest of the malware components. So even if you don't do anything wrong - even if you're running Firefox instead of IE, as long as you have an old version of Reader installed you're vulnerable.
I suspect this can be mitigated by turning off the "display in browser" option for PDF files, but I don't know for sure.

Re:Malwarebytes

[X0563511]

I did this crap with Blaster back when that was new. I've since reinstalled to greener pastures (leave it at that).

What I did was use a fancy tool to shred the module's drive space allocated to the file. Note that I did NOT use the filesystem API for anything but to find which clusters to hose. Hex editors are fun.

After this was done, a hard reset ensured the process died without having time to do anything useful.

Re:Malwarebytes

[fuzzyfuzzyfungus]

Obviously not much use for home users and very small outfits; but it is situations like that where imaging tools are far more useful.

Well, let's see: I could spend who knows how long poking at this, in the hope that I might end up with a clean system(as opposed to a more subtly infected one), or I could just send down an image, and have the system running like new in 20 minutes, 18 of them unattended. Not a hard choice.

Take off and nuke the site from orbit, it's the only way to be sure.

Re:Malwarebytes

[Psychotria]

home users and very small outfits; but it is situations like that where imaging tools are far more useful.

Especially if the home user is cute and wearing the small outfit. The imaging devices (camera etc) are very useful.

Re:Malwarebytes

[Anonymous Coward]

"You think"

I hope your friend doesn't do anything with finances on her machine.

Re:Malwarebytes

[wap911]

You got #2 right on.
The first thing I do is as when it got sick, then look for anything in that time frame.
Usually not long before that may be dates from Windows update.
Just cleaned one with many INI files.
They were binary not text.
Put a _ in front of the name to flag them.

But if you got one in WinLogOn...may well be hosed.
That is the most difficult to get out.

Re:Malwarebytes

[akboss]

The problem you are going to have is this is a root kit and sorry folks 99.9% of the scanners out there will not remove the root.
It is a manual job.
When this first came out as the WinAntivirus it was also rooted and after 10 reboots it would then reinfect the computer.
Nice for a tech but crappy for the EU.

Re:Malwarebytes

[pdawson]

Process Explorer is your answer to this, from Sysinternals. Suspend, not kill ass the problem processes, then go into properties for winlogon, explorer, etc and the problem dlls will have their own threads inside the process. Suspend the individual threads, then go back and kill everything you suspended. Memory is now clean, go kill the problem files off disk and out of startup entries, then reboot.

Re:Malwarebytes

[Bert64]

Which is entirely going about it the wrong way...
You don't want to try and eliminate malware while running a system that may be susceptible to it... You want to boot something else that won't be affected by the malware.
There are plenty of cases where something could get executed from a mounted drive, even if you boot from readonly media... It will still sit resident in memory and could hide itself.

Re:Malwarebytes

[Bert64]

The websites which distribute antivirus 2009 are irritating too...
If you visit them from a mac or linux box, they do the same fake scan in javascript followed by "your infected by all this malware"... The javascript makes a mess of safari by half covering the tab bar somehow, requiring you to close the window.

Re:Malwarebytes

[Bert64]

I've seen that site a fair few times too...
Tho it's obviously harmless to mac users, their site actually breaks safari by somehow obscuring the tab bar.

Re:Malwarebytes

[MacColossus]

Instead of unlocker I have just booted to an Ubuntu Desktop CD and removed the files that wouldn't go bye-bye. In the instances of Antivirus 2009 I have seen registry editing is locked. I used Registry Permission Tool to unlock the registry so I could delete the entries. It's freeware found here halfway down the page. http://www.xeromag.com/fvshare.html I have also used Winternals and Malwarebytes before. Generally using the company purchased Sophos and an Ubuntu CD to delete stubborn files works pretty will for 90% of the virii I have come across. If you want to make sure a Mac/Linux user/admin abhors Windows have them do virus removal in a higher ed environment for students and fac/staff. I realize most of us don't need to go through this hell to feel this way. I'm just lucky like that. "The Macs and Linux machines seem to be running well. We are going to have you do student network support since the Windows admin is swamped."

Re:Malwarebytes

[lgw]

None of which works against a root kit, of course. It's almost trivial for malware to keep the size and create/modified dates of any file replaced. Fortuntely most malware authors don't really know how to code, they just cobble together some payload and some half-assed delivery scheme (which is, after all, good enough most of the time). Serious malware (typical payload to add a machine to a botnet) replaces the kernel, cannot be detected by anything but its symptoms (it will even lie to debuggers about the contents of memory), and can only be cleaned manually by offline replacement.

MSRT is useful because Microsoft occasionally has better NT kernel hackers than the botnet guys. Sometimes the AV vendors can manage to remove a rootkit, but that's usually an arms race and the AV guys seldom have access to the NT kernel source code so they're at a significant disadvantage.

The only way to genuinely secure a running system (any OS) against a clever attacker is with a combination of virtualization and "trusted" computing hardware. Unfortunately, everyone seems to have decided that the TPM hardware is tainted, when it's just a powerful tool for good *or* evil. Of course, even with hardware assistance, most motherboards these days will allow a clever virus writer to flash the BIOS with a malware payload, so you're still screwed.

Re:Malwarebytes

[ScottDavidson15]

Agreed. Malwarebytes fixed it on several PCs I have worked on, including my parents.

Re:Malwarebytes

[Nimey]

Oh, for fuck's sake. Ultimate Boot CD for Windows. It's, get this, a boot CD, as in a LiveCD. Doesn't execute anything on the hard drive.

Re:Malwarebytes

[BrokenHalo]

"You think" I hope your friend doesn't do anything with finances on her machine.

This is what always bothers me about Windows and the various anti-virus offerings. The operating system, with that arcane registry, always leaves me with an impression of being deliberately made to be overly complex, and you never can be sure of having removed a virus.

Re:Malwarebytes

[Anonymous Coward]

I have no need to remove this crap offline. All I end up doing is installing a program called Unlocker and use Autoruns to home in on these files. If it is hooked into winlogin, the machine will bluescreen but the threat will be removed before it does. As for Antivirus 2009, god only knows how many times I have seen it and how many times I will see it in the future.

Re:Malwarebytes

[Smauler]

Yup, I've got a couple of random pdf download requests recently from slightly suspect websites. I have set it up so that it does not display in browser, so I can just click cancel on the request.

Re:Malwarebytes

[jamesh]

never can be sure of having removed a virus.

It always gets me how the virus writers don't go that little bit further. It would be dead easy to install 2 rootkits instead of one. The first one is obvious, and deleting it is convoluted but straightforward, while the second one is deeply integrated and very difficult to remove. So you get an infection, follow the steps to remove it, but aren't aware of the second one.

Or maybe they are doing this already and we haven't noticed...

Re:Malwarebytes

[Bert64]

Can you guarantee that nothing in the filesystem driver code will cause malware to be executed?
How about the preview function of explorer which has been exploited to execute code in the past...
And then AV scanners have also had exploitable vulnerabilities...

Be careful and minimize the risks...
Of course the best option is always a clean format and reinstall.

Re:Malwarebytes

[itsthebin]

I use UBCD4win on a USB stick as most comps will boot from USB - a CD only for ones that don't

with it on the USB you just run the updaters in the plugins of the tools you use and not worry about burning a new CD every time

Re:Malwarebytes

[Antique Geekmeister]

Amen! I've spent quite a bit of time in group environments trying to convince managers and developers that they _must not_ rely on heavily personalized local systems, because the time spent cleaning up the mess and trying to 'save' their working environment when they have a major hardware or software problem is hideously expensive to both them and the IT group.

I support them by helping them have good software management and configuration tools to be able to re-establish the necessary parts of a custom environment from the standard image. It's incredibly helpful to build environments and testing efforts as well, because you know what tweaks were done to allow the software to build and to perform well or to avoid failing in the development environment, because those tweaks must be replicated to operate in the testing environment rather than simply imaging nsome developer's mess of a build environment.

Gentoo seems to be fabulous at this, and its software build components are often a good model of how to do this. The RedHat style 'mock' utility is also a good teaching tool for this approach. Lessons learned there are very useful in even Windows environments.

Re:Malwarebytes

[Anonymous Coward]

A few months ago, I encoutered (within a week) the same rootkit on three different PCs in my care. It was the now infamous TDSS rootkit. There were no automated fixes by that time, don't know if there are now.

You don't get good malware-removal tools running on Linux

I got the best malware-removal tools from the Ubuntu 8.10 install disc: ntfsclone, ntfsmount, find and rm.

From what I can find on the MBAM forums, it still cannot reliably cure Windows from a TDSS infection. I do not know about UBCD, but I certainly hope that all features concerning auto-preview and/or thumbnailing are disabled in Explorer, or I still would not trust it.

Re:Malwarebytes

[peragrin]

And once again the joke is on you twice over.

1) the virus's in question don't really exist So no matter what you use you can remove them.

2) Your running windows. The only OS that encourages virus writers by never fixing the underlying OS defects. Just adding a bit spackle to make it look good, and prevent that one virus from doing bad things. As genuine MSFT certified apps also require that function.

Re:Malwarebytes

[Anonymous Coward]

Unfortunately, everyone seems to have decided that the TPM hardware is tainted

It's not the hardware that is tainted, but the implementation; I would not allow a closed-source application to decide what I should and should not be doing on my PC. And even disregarding that "trust" issue, you would need a massive web of trust chains to verify all applications because Windows applications are decentralized, and relying on the user to manually add signatures will simply boil down to another UAC failure.

For most Linux implementations, it would be quite trivial to add executable validation into the master repos, at least for everything running as root. The Linux kernel could easily disallow access to certain libs and modules that do not have a known signature (selinux), and those signatures could be stored securelly with cryptography. Then only accept updates to those signatures via signed repositories, and you're set.

But once you have a secure system with repository validation and IDS, you will realize that adding the TPM to this system will not add to the security of the system. The added value of the TPM is based around the assumption that you cannot rely on the user to never install malware, and that malware can still be added to a system without intervention of the user. Both assumptions are only (mostly) valid on the current Windows platform. It's a paper model at best, when looked at from a user-centric perspective.

The other implications (privacy and corporate control) are of course relevant to other systems as well. But why would you accept those drawbacks when there already are viable alternatives to the problems mentioned above and do not have those drawbacks?

The TPM can still have valid uses, if only to accelerate cryptographic operations or to provide reliable identifications for workstations in a corporate network. But for the consumer, it has no added value.

Re:Malwarebytes

[miknix]

Try this instead.

1. Install GNU/Linux.

The best part is, this will work with virtually *any* malware infection, and will generally catch things that even Malwarebytes misses.

Fixed that for you.

Re:Malwarebytes

[Nimey]

It doesn't even use Explorer; it's got a different shell.

But by all means, keep trying to convince me when you don't know what you're talking about.

Re:Malwarebytes

[Nimey]

Nice thought, but it wouldn't work for us. We use student workers for some things, and some of the students are careless enough about leaving discs where they shouldn't be, or they get stolen, or something, and this happens from time to time with the USB sticks too. Basically CDs are much cheaper to replace, and I normally make new ones every few months with new releases (or when the definitions are getting old enough that updates are annoyingly long).

Re:Malwarebytes

[cbiltcliffe]

And when they're not listed as threads, inside something like winlogon, you're screwed. A loaded DLL does not necessarily make its own thread.

For a lot of things, I do exactly what you suggest. But when something digs deep into the system, and hooks into things like winlogon, lsass, or other system processes, it's easier and faster to do an offline scan, rather than screwing around suspending a dozen or more processes, hoping you got them all, then finding out you didn't, because there's a hidden rootkit that Process Explorer doesn't show.

Re:Malwarebytes

[cbiltcliffe]

Unlocker's a great program, I admit.

But use it to remove the rootkit files of the AV09 version that installs it. I dare you.

Re:Malwarebytes

[b1ffster]

If Malwarebytes doesn't work I'd be surprised. I sent CA/eTrust viruses and never even got a response! What I do is install ZtreeWin, log every file in every directory on hard drives, filter exe, dll, ocx, and sys files, tag all, search for 'UPX0' and decide if it should be there or not :P But then again, I'm a cwazy ninja muppet!

Re:Malwarebytes

[Endo13]

I can tell you for a fact that Malwarebytes doesn't work 100%. I've gone through and done a manual check immediately after having Malwarebytes delete everything it found, and still found more files it missed.

It's a good program, but it's not perfect.

Re:Malwarebytes

[Endo13]

Yes, boot disks are nice, but Unlocker fits on any USB flash drive and is trivially easy to find and download any time you have an internet connection, even on dialup. And it works. The other thing I really like about Unlocker is it can sometimes give you information you can't get any other way. And that is, when you try to delete a file that's in use, if it can find a handle on the file to unlock it, you can see exactly what program is using the file. Granted, that's usually not *needed* to remove the threats, but it's interesting nonetheless.

Re:Malwarebytes

[miknix]

You don't get good malware-removal tools running on Linux because it doesn't need them. ClamAV is mostly used on Linux gateways to scan incoming traffic for Windows virus.

You get good malware-removal tools on Windows because you get almost all of your malware on said OS because that OS is very popular and crappy hence has many masochist developers who likes to spend their time cleaning up mess on the said operating system.

There, fixed it for you.

Re:Malwarebytes

[b1ffster]

Endo, you and me are Cwazy Ninja Muppets. Let's start a Ninja Turkle effort!, cos the corporations who do Anti-virus aren't listening! DAMN THEM!!!!

Re:Malwarebytes

[lgw]

The closed nature of the TPM standard is just mind-bogglingly stupid. I used to work on a standards committe that interfaced with the TPM committee, and the NDAs and lack of public review were, simply put, crap.

However, I disagree that there's any need for a web of trust: you're trying to sovle the wrong problem. The point (here) of the TPM is to create a hypervisor that is hardware write protected (even its memory) from the client OSs. The hypervisor doesn't do a anything besides virus scanning (and being a hypervisor).

Rootkits on the client OS can't hide from the host OS, but today they can infect the host from the client (though that's largely theoretical today, it's definitely possible). TPM gives you complete protection of the host OS, without the limits of booting from a CD or other physically write-protected media.

Re:Malwarebytes

[mcohrs]

In googling Unlocker, I see a number of posts suggesting that it installs a trojan which is presented as eBayShortcuts.exe, but which may well take you to an adware download site. Seems to be reported mostly by folks using 1.8.7 and 1.8.6. Buyer beware

Wait a pain...

[Chabo]

I was tasked with getting this thing off my mom's laptop. That was tougher than any other piece of malware I've ever dealt with.

I also had to convince my dad that there was no easy way to sue the "manufacturer" of this program.

Re:Wait a pain...

[plover]

I hope one of those fakers takes Microsoft to court over this and publicly identifies themselves. There are many pissed-off users that would be happy to take a baseball bat to them. One of them would likely be on the jury.

Re:Wait a pain...

[bigngamer92]

I also had personal experience with this specific malware. It was on a computer I had even put Avast! on and when I went to troubleshoot it lo and behold avast was gone. However the stupid thing seemed to come of easily as I just killed the process (which was "restarting" the comp for having a unlicensed version every couple minutes) and then deleted the auto start entry. After that it was just a matter of deleting as many files as possible and running a ccleaner scan.

Of course it doesn't matter since I suspect the user of taking avast! off the computer and they wouldn't understand safe computing practices.

Re:Wait a pain...

[Anonymous Coward]

I also had to remove this from about 4 laptops and 2 PC's. Stupid family... " But its the new version" yes its the new version of the same MALWARE i removed from your PC last year. "Antivirus 2008" now shut up and stop downloading this stuff with out consulting me!..

Re:Wait a pain...

[Anonymous Coward]

Virtumondo is more of a pain in the ass.

Re:Wait a pain...

[TheBeowulf]

I had to talk a cousin of mine through the removal over the phone. I couldn't remote control his PC because the ISP was baller blocking.

I didn't need to use any fancy progams to get it to quit running, but I did use Spybot and AVG to remove it after it stopped running at startup.

Steps:
1) Killed all suspicious processes using Processor Explorer/Task Manager. Researched ones I wasn't sure of.
2) Disabled System Restore. (Critical)
3) Removed all traces and suspicious programs from the "run" sections in the Registry. (Do a search for "run" using only 'keys' and 'match whole string' checked.)
4) Searched the drive for the executable files found in the registry and renamed them to something rude.
5) Pulled the plug from the machine. Upon restart, it wasn't running and AVG was able to move it to it's vault. Spybot took care of the rest.

Wildly annoying one.

[fuzzyfuzzyfungus]

In having to do support for assorted windows users, I've seen assorted popup/redirect stuff pushing that particular fine piece of software a lot. Most disconcertingly, it even happens to users visiting what one would think of as reputable sites, on machines with fully updated AV that reports no issues.

I really don't have the time or interest to figure out if the AV is just sucking, and not reporting infections that actually do exist, or if whoever is pushing the software has compromised a bunch of ad providers; but it seems to be a big issue in windows land(poor bastards).

Re:Wildly annoying one.

[cbhacking]

It's probably the ad providers, but the really disturbing thing is it may be legit. Well-known (I can't quite call something like doubleclick "reputable" but you get the idea) advertising companies have pushed ads for malware sites before. In fact, they've even pushed ads that actually contain malware (Flash-based exploits, mostly - it's a sad day when AdBlock actually improves security as well).

For that matter, while Google doesn't generally do the pop-up-flashing-in-your-face ads, I've seen many examples of scam anti-malware software pushed through AdWords/AdSense. According to a study that I think was on Slashdot some time back, Live actually does a better job of filtering out the really slimy advertisers. Many ad providers do little to no verification at all, though; they'll take anybody's money.

Re:Wildly annoying one.

[Bert64]

I uploaded a few parts of this malware to virustotal.com a few weeks ago, it was picked up by 11% of the av engines tested, ie a very small percentage...
I got it from a machine that had mcafee installed, it didn't detect anything...

They seem to update this malware regularly to avoid detection, and there are typically several versions circulating at any one time. This particular machine had several versions installed which all pointed back to the same bunch of sites...

Agree!

[MxTxL]

Malwarebytes is awesome! The AV2009 malware is a tough one to remove, but Malwarebytes takes is right off.

Re:Agree!

[enharmonix]

Malwarebytes is awesome! The AV2009 malware is a tough one to remove, but Malwarebytes takes is right off.

I swear by them. In fact, I removed Symantec AV from my computer (since it only protects against exploits nobody uses anymore and slows your PC down more than any virus). I use Windows Defender to monitor system changes and do periodic sweeps w/ Malwarebytes. System is much faster now and still clean.

Re:Agree!

[v1]

soooo glad I don't have to spend that much time just to keep my system running. why do you put up with it?

Re:Agree!

[enharmonix]

Two big reasons: My wife doesn't like Ubuntu, and Finale is Windows only. (Of course, I am probably going to set her up on my old Mac soon, and if I can get Rosegarden working in kUbuntu, then I don't need Finale.)

Re:Agree!

[X0563511]

1. Can't help you there!

2. ubuntu-studio *

* (or, look for the ubuntu-studio audio metapackage. make sure you get linux-rt and the associated kernel headers etc as well)

Re:Agree!

[cjb658]

Yup, and AV 2009 is about the worst spyware there is. It installs a God damn driver just so that DNS queries to antivirus sites don't resolve, even though your hosts files stay clean.

Re:Agree!

[PenisLands]

You may also want to try running Finale in wine. Wine is improving a lot these days.

Re:Agree!

[adisakp]

I removed Symantec AV from my computer (since it only protects against exploits nobody uses anymore and slows your PC down more than any virus)

I don't personally use Symantec anything but the word is for the 2009 version, they completely rewrote everything from scratch with an emphasis on speed that seems to have worked according to PCmag.

Re:Agree!

[Creepy]

That depends on the source, because I'm pretty sure the f**kers that write Antivirus 2009 and similar programs were selling it to spammers and virus writers and they redistribute it. Their previous installers were often distributed with Russian viruses and the company that writes this crapware is in Florida.

Re:Agree!

[Raenex]

So your suggestion is to run unpopular operating systems? Neither Apple nor Linux prevent you from installing something like "Antivirus 2009".

Re:Agree!

[HolyCrapSCOsux]

Have a look at PlanetCCRMA
I have been using their repos for years for all my audio needs: Rosegarden, Ardour, Hydrogen, etc.
It's Fedora/Redhat based, but worth the switch.

Re:Agree!

[Toad-san]

Agreed. Malwarebytes is the only one _I_ could find that would remove that damned AV2009 (and all its clones). Pitiful really, how the otherwise somewhat effective AV and antispyware utilities (Trend, AVG, Avast, Panda) were totally useless for this hugely prevalent infection. Goes without saying, of course, that McAfee and Symantec were useless as well.

We made a lot of money cleaning systems of AV2009 (mostly via wipe and reinstall before Malwarebytes came out); but I don't like making money that way.

That was a prime candidate for the Feds to do something constructive (since there was a very obvious and clear money trail from this Blackmailware), but noooooo ...

Good job Microsoft!

[Chryana]

Now let's hope Symantec is not going to sue them... :)

how many users will complain about removal?

[hguorbray]

I wonder how many of the clueless will complain to microsoft that the removal tool removed software THEY HAD PAID FOR

iirc some of the malware and adware 'vendors' had eulas that forbade users to remove their programs

It'll never happen, but I'd like to see one of those guys try to sue microsoft for violating their EULA -would microsoft try to claim that the EULA was invalid?....

One can always dream.

-I'm just sayin'

Re:how many users will complain about removal?

[halln]

Technically, the user didn't remove it. Microsoft did. I'm sure MS didn't agree to their EULA.

Re:how many users will complain about removal?

[cbhacking]

An amusing notion, but it'll never happen for two reasons:
1) EULAs may or may not be enforceable in their usual sense, but a requirement that you can't remove the software doesn't even make sense. The concept of a EULA is that you must agree to the terms in order to use the software. If you're not using the software (i.e. you remove it) you're not bound by the terms anymore.
2) Since this is intentionally malicious software and almost certainly constitutes at least one form of fraud, the owner publicly identifying themselves would be a bad plan. Not only are they unlikely to win a legal battle with MS in civil court (the fraud might even make the EULA automatically invalid or some such), but they might well end up facing criminal charges as well.

IANAL, and one can always hope the malware authors get stupid, but this doesn't seem a likely scenario.

Re:how many users will complain about removal?

[Amazing Quantum Man]

iirc some of the malware and adware 'vendors' had eulas that forbade users to remove their programs

But if you remove it, you're in violation of the EULA, and therefore are not allowed to use the program, so you must remove it!

Absolutely no problem there.

Re:how many users will complain about removal?

[Amazing Quantum Man]

On second thought.... WARNING -- Infinite Recursion Detected!!!

Re:how many users will complain about removal?

[Naturalis Philosopho]

Technically the owner of the computer is responsible for all operations on and communication to/from their computer. IANAL, but wouldn't that (in this highly theoretical scenario) make Microsoft guilty of fraud for acting as the computer user and forcing the user to violate the TOS? ;)

Re:how many users will complain about removal?

[halln]

I would have to disagree. IANAL either, but from what I gathered a person is not supposed to be responsible for all operations on and communication to/from their computer unless there is proof that they were the ones who did it. Just because somebody was looking at porn on my computer at work using my name doesn't mean I did it. I could potentially be held responsible for it if there is a policy that states that I am not to allow anybody else to use my credentials, but if there is sufficient evidence to show that it might not have been me then it would be fairly hard to found guilty in a wrongful termination lawsuit.

In this situation I wouldn't really know which way to take it, but I would say that there is enough against the makers to invalidate the EULA. I would say the AV 2009 authors would be more likely to face fraud charges than Microsoft would for removing it.

Re:how many users will complain about removal?

[Actually, I do RTFA]

I wonder how many of the clueless will complain to microsoft that the removal tool removed software THEY HAD PAID FOR

Well, it's malware, not scareware. That is, it only acts scary to get it downloaded/installed, not to get money. Otherwise, they would have tracked down the payments by now. And if they had paid for it, the customers probably used a credit card. So a large number of them could get it refunded because of the fraud involved.

It'll never happen, but I'd like to see one of those guys try to sue microsoft for violating their EULA -would microsoft try to claim that the EULA was invalid?....

Well, Microsoft would point out that the EULA is a contract* between the end-user and the other company, and Microsoft wasn't a signatory.

*Regardless of whether you believe this to be true, I have no doubt that this is what they would claim.

Re:how many users will complain about removal?

[Naturalis Philosopho]

Yup. I'm just being argumentative to point out how screwed up our legal system is... You can bet the "manufacturers" of AV 2009 would use some equally screwed up argument if they were every brought to the bar. I would love to see the makers of AV 2009 in court though. For anything.

Re:how many users will complain about removal?

[Dan541]

Such EULAS are invalid, you can't stop people from removing or modifying software which they own. Re-distribution maybe but not removal.

Re:how many users will complain about removal?

[Anonymous Coward]

I think Microsofts EULA would trump it since their EULA says they own and control the OS. They could also claim that the software violated their restrictions on changing of OS files. And they can supposably change their EULA at any time so they could retroactivly put in a clause saying that AV2009 is illegal to run on any WindowsOS

Is this troublesome to anyone else?

[baomike]

The idea of MSFT deleting a program (albeit a piece of malware) from my machine bothers me.
When will their idea of malware differ from mine?
Will they always do it correctly (no collateral damage)?

Re:Is this troublesome to anyone else?

[Volante3192]

Well, the reason you install these programs like Defender is so it deletes the malware for you.

Replace Microsoft with Kaspersky, AVG or one of those other "reputable" AV vendors and ask the same question. They have just as much ability to delete a program.

Re:Is this troublesome to anyone else?

[Achromatic1978]

Well, then, I guess you better not install MSRT then, right? For it is not installed unless you explicitly ask for it, and it IS fairly clear that it is a "SOFTWARE REMOVAL TOOL", and that it will "remove software or files that Microsoft has determined to be malicious", and that you agree to that.

Do you worry about Symantec AV removing malware from your machine too, in case their definition differs?

Re:Is this troublesome to anyone else?

[cbhacking]

First, you don't have to run the MSRT I suspect you can even blacklist it, but leave Windows Update running normally and automatically otherwise. I don't recommend doing so, but it's your system.

Second, if it did damage your system, you could probably make a civil case about it. This makes it somewhat unlikely MS is ever going to risk actively causing a problem for any significant number of users. I suppose an accident could happen - after all, real antivirus programs have been known to have false positives from time to time, with occasionally catastrophic results - but the MSRT is targeted at specific software rather than being a broad defense, and it is tested widely before each release.

Re:Is this troublesome to anyone else?

[bill_mcgonigle]

When will their idea of malware differ from mine?

Sometime, perhaps.

Will they always do it correctly (no collateral damage)?

Probably not always.

The question is what alternative do you have? If you know enough to turn this off and install a 3rd-party solution you're probably fine. If you're in the lower 99.8% of Windows users, Microsoft knows way more about what it's doing with Windows than you do.

So, the question isn't whether Microsoft will be perfect but whether you're, on average, better with this than without it. The answer would seem to be a loud 'Yes'. There are more secure OS choices if that's an uncomfortable answer.

Re:Is this troublesome to anyone else?

[Lumpy]

Just wait, soon the following will be on their malware list.

anydvd
dvd decryptor
dvd shrink
ISObuster

Those programs have no legitimate purpose and only C R I M I N A L S would have them. you'll be lucky that they only delete it and all *.mp3 and *.mkv files it finds.

Re:Is this troublesome to anyone else?

[enharmonix]

The idea of MSFT deleting a program (albeit a piece of malware) from my machine bothers me.
When will their idea of malware differ from mine?

I had to use Real VNC at my last job and Windows Live OneCare (or whatever it's called) detected and removed it. I would think MRT would ignore questionable software, but for apps/services targeting Joe Sixpack, don't be surprised to see some things like VNC or IRC software flagged as malware.

Re:Is this troublesome to anyone else?

[gad_zuki!]

Dont run it then. Uncheck it from automatic updates. No one is putting a gun to your head.

Re:Is this troublesome to anyone else?

[gad_zuki!]

Take off your tin foil hat, man. Put down the gun. Seriously.

MS has been using MSRT for years and no one has targeted your little cd apps.

If youre this paranoid, then dont run it. Uncheck it from automatic updates.

Re:Is this troublesome to anyone else?

[baomike]

>
It is. That's why I use linux.

Re:Is this troublesome to anyone else?

[Anonymous Coward]

Yes, I finally had to turn off my AVG resident shield the other day because it thinks programs and utilities I use on a regular basis are malicious.

Re:Is this troublesome to anyone else?

[3vi1]

Microsoft Forefront does this with VNC too. Drives me nuts.

Re:Is this troublesome to anyone else?

[cbhacking]

Dunno about ForeFront, but there's a whitelist for OneCare. Given hat ForeFront is a business app, I'd expect it to have some centrally configurable whitelist.

Re:Is this troublesome to anyone else?

[madhurms]

I think they quarantine it (by default) instead of completely deleting it. Unless they have changed this recently.

Re:Is this troublesome to anyone else?

[wap911]

The last machine I clean needed 49 updates do to the malware shutting it down.

At no point did I get "Would you like to install MS Reoval Tool [Y/N]?"

All that was there was "Installing KBxxxxxxx".
Like that really helps
Stupid Microsoft.!>!>!

Re:Is this troublesome to anyone else?

[Crasoum]

So put them in the exemptions list....

Re:Is this troublesome to anyone else?

[Anonymous Coward]

I'm not the GP AC but,
There are some programs that AVG will ignore the exemptions listing... and I actually had the paid version!

Re:Is this troublesome to anyone else?

[Anonymous Coward]

But from their viewpoint it makes sense, an application that opens up ports, hooks into the mouse, keyboard, video and filesystem. If you saw something that did that you would flag it to.

I believe you can add the software as an exception to the rules and honestly do you want a security package that wouldn't err on the side of caution? Anything that might open up some part of the computer SHOULD be flagged unless specifically authorized.

Re:Is this troublesome to anyone else?

[petermgreen]

Afaict you can't easilly blacklist things like WGA notifications and MSRT, you can blacklist the current version but as soon as there is a new version they will be back.

Re:Is this troublesome to anyone else?

[IHateEverybody]

AFAIK, MSRT always asks you if you want to install it and even throws up a EULA, so it's pretty easy to avoid installing it if that is your wish.

Combofix was the only thing that worked for me

[transporter_ii]

Particularly bad virus. It blocked all antivirus web sites and even blocked programs on the computer. I could put Spybot Search and Destroy on the computer, but it wouldn't even start. What I finally had to do was rename combofix.exe to something else like fix.exe, and then it ran and removed MS Antivirus 2009. I did try to Malwarebytes but it wouldn't even install, even if I renamed it.

Re:Combofix was the only thing that worked for me

[Lumpy]

rename the spybot exe name. you can do the same with hijack this.

That way you can eradicate the registry entries, then DO NOT REBOOT but yank the power cord.

Most ickies will rewrite their registry entries when they see a shutdown started.

Avast! free home edition has protected against that nasty ever cince they updated the name from 2008 to 2009.

Re:Combofix was the only thing that worked for me

[Anonymous Coward]

I have an internship at a computer repair shop (my first job) and we got a computer with this on it a while back. The only other case that was worse was the one where I had to get an ME machine up and running. It is that bad.

Re:Combofix was the only thing that worked for me

[DigiShaman]

I'm not sure all registry modifications get committed to disk instantly. You might want to wait a few minutes before killing the power.

Anyways, I've ran into most versions "XP Antivirus 200x" (including its anti-spyware cousin) at least a dozen times now. Without going through an entire litany of what work was performed to remove it, I can safely say it's a (very good) professionally produced piece of fuck-ware!!

Don't waste your time with cleanup. Just back up the data, wipe the drive, and reload the OS and applications. Trust me, the aggravation of fighting this thing isn't worth it.

Re:Combofix was the only thing that worked for me

[Blakey Rat]

I wrote a blog entry to illustrate a method of getting rid of files like this in a slightly more "safe" manner, using NTFS permissions:

http://blakeyrat.com/2008/10/02/how-to-really-get-rid-of-the-vundo-aka-virtumonde-virtumondo-ms-juan/

The short version, set "Deny" permissions on the files you want to remove, when you reboot the NTFS permissions will prevent anything from opening up/running the files, and you can then remove the Deny permissions and delete them.

Re:Combofix was the only thing that worked for me

[jamesh]

Provided you run a version of the removal tool that was produced after the version of XP Antivirus, it gets rid of it just fine.

Trying to do it by hand is really really hard though. Just when you think you have deleted it, it comes from nowhere and installs itself all over again. If you can't get the removal tool then I agree that reinstalling is the best way forward.

Re:Combofix was the only thing that worked for me

[Anonymous Coward]

It blocked all antivirus web sites and even blocked programs on the computer. I could put Spybot Search and Destroy on the computer, but it wouldn't even start.

Ooh! Ooh! I know this one *frantically waves hand*. You know why you can't start several programs? This is hilarious, but true: Some malware modifies the "malicious software database" that is used by the microsoft tool for removing malicious software (try by booting into safe mode: you'll get a message from the MSRT that malware has been found).

Like another poster said, renaming the executable will still allow you to execute the app. Gives you a lot of faith in Microsoft's MSRT, doesn't it?

Re:Combofix was the only thing that worked for me

[garwain]

I've had about 30 machines pass through my shop with AV009... AVG did an excellent job at clearing it out on every machine (well, after ripping out the HDD, and attaching it to my test station, and running AVG on the CLEAN machine...). I love USB HDD enclosures.

Understating the menace.

[Rahga]

This family of infectors is probably, by far, the worst spyware/hijacking peice of junk I've ever seen. I can't help but feel that 400,000 isn't nearly the number that has actually been infected, simply because nobody I know actually uses MSRT, and I seriously doubt that any machine that gets infected with it could actually get back into the condition where it can download and/or install MSRT, or virtually any other software. It's just that bad.

Re:Understating the menace.

[PCM2]

nobody I know actually uses MSRT

You might be surprised. The version of MSRT that comes from Windows Update runs in the background once a month and only alerts you when it notices a problem. I've never knowingly run it, but sure enough, if I check my Windows Update history I've installed the December edition.

On a side note, maybe this explains the persistent disk thrashing episodes I still get with Vista, maybe once a month or so...

Re:Understating the menace.

[Anonymous Coward]

A combination of mbam and sas gets rid of it, so long as you rename the installers and actual program executables. I never even though to try MSRT.

Re:Understating the menace.

[enjo13]

Literally every single Windows user I know has been infected with this. I removed it several times over the holidays. My wife (and many of her coworkers) where infected...

I know it's not necessarily a representative sample, but I'd be shocked if it was only 400k machines in total.

Re:Understating the menace.

[cbhacking]

Actually, probably most people you know run the MSRT without even noticing. It's a default part of Windows Update and has been for years. Unless you specifically de-select it every month (or blacklist it) it will run automatically.

400,000 is probably the number of computers that got infected but were still sufficiently operable to run Windows Update on automatic, with perhaps a handful of people who manually ran it off a flash drive or similar (it doesn't need to be installed, and it might be possible to rename the executable or something like that even if AV2k9 tries to block the MSRT binary. I imagine a large number of machines were totally compromised before they could run Windows Update, and another large number had it turned off. Still, 400k is a lot of computers to be fixed by one tool.

Re:Understating the menace.

[cbhacking]

Out of curiosity, when do you have Windows Update scheduled (controllable from the Change Settings dialog on the side of the Windows Update window in Vista)? It only takes a few minutes to run the MSRT most of the time, and a couple minutes of disc thrashing at 5AM isn't likely to be a problem.

Re:Understating the menace.

[gad_zuki!]

>simply because nobody I know actually uses MSRT

MSRT is packaged with windows update. If they have automatic updates set as theyre supposed to then they run it every month. Its just not obvious to the end user. MS uses MSRT for a lot of things. Last time they took down one of the bigger botnets.

Ive seen PCs with "Antivirus 2009" and its precessors still able to use automatic updates. Im sure malware writers will now just disable the service. I believe some versions of Antivirus 2009 did shut down the service.

That said, the real problem here is why legitimate sites are service up the pop-under ads for antivirus 2009. Ad networks need to start vetting their clients. People should just start blocking all ads as a security threat.

Re:Understating the menace.

[Anonymous Coward]

Heh... Spyware Guard 2009 was the variant that I had to remove. It used rootkit like techniques to hook into system processes. Had to individually kill threads. It also blocked access to Windows Update and just about any other security program vendor's websites as well as online websites that help you remove it. It redirected a TON of wildcard DNS names to localhost. Even putting static entries in the host files to the correct IP addresses didn't work. I was VERY impressed by how advanced this software was. HUGE pain in the ass. I'd like to buy who ever wrote that a beer. Then put them in the guillotine.

Re:Understating the menace.

[mrphoton]

what repository did you install this cool new tool from?

Re:Understating the menace.

[PCM2]

Ah! So are you saying that the MSRT runs the scan during the Windows Update process? Because my assumption was that the Update would just install the tool, but that it would run at some later, undetermined time. If it did run during the Update, then it probably happened while I was asleep.

Re:Understating the menace.

[Anonymous Coward]

Guillotine? I'd help delivering a nice death by a thousand cuts.

Re:Understating the menace.

[Dan541]

You have to account for all the people who don't keep windows updated. So add at least another million and we are probably getting close.

Re:Understating the menace.

[WuphonsReach]

That said, the real problem here is why legitimate sites are service up the pop-under ads for antivirus 2009. Ad networks need to start vetting their clients. People should just start blocking all ads as a security threat.

A lot of these injections start as some sort of code-injection on legitimate sites. The criminals either do SQL injection attacks or break in via poor FTP username/passwords. They then append a bit of javascript to the pages that does the dirty deed. Or other attack vectors (Flash exploits, PDF exploits). So it's not always an infected ad (although those do exist and are becoming more frequent).

And if the Windows user is running as admin, the game is essentially over at that point and they've been infected.

Firefox combined with NoScript and FlashBlock cures a lot of these ills, but requires the end-user to maintain a whitelist of trusted sites. And to be sensible and cautious about adding sites to that whitelist. So if one of the sites on your whitelist is infected, you're still screwed.

Fortunately, it's moderately easy nowadays to run XP in limited-user mode. The vast majority of programs work just fine once you get them installed. Most viruses that do manage to infect the user can't do permanent infections, unless they use a local exploit to do privilege escalation. So a reboot kills off the running processes, and the malware becomes trivial to remove.

family tech support

[EpsCylonB]

Yep, got called round to my brothers house to fix his computer cos it had this stuff on it.

I don't know exactly what it was supposed to be doing, the computer would boot up into winxp and then just freeze. Safe mode worked but safe mode with networking did not, so I guess it was calling home somewhere (thinking about it now I should have just unplugged the network cable to see if that stopped the computer freezing).

Anyways I didn't have any stuff with me and without net access I decided the path of least resistance was to reinstall windows (my brother did not have anything he wanted to keep).

I should have brought round a ubuntu live cd with me.

Re:family tech support

[gd2shoe]

Possible, but more likely it had infected the networking stack somewhere. (I haven't dealt with a bad one yet, so I don't have any way to know.)

Re:family tech support

[Anonymous Coward]

UBCD4WIN and GMER are your friends.

Re:family tech support

[Anonymous Coward]

I should have brought round a ubuntu live cd with me.

Another linux freek shoving OO-BOON-2 down somebody's throat. If your brother wanted OO-BOON-2, he would have asked for it. Instead, all he asked is that you fix it, and it seems all you want to do is wreck it even more.

Word of advice: somebody once offered to install OO-BOON-2 on my computer, it wrecked my harddrive a week later. And it set the fire alarm off. Fuck your linuts and keep your mitts off your brother's half-way functioning computer and ask him to get someone competent. He can call Geeksquad, they'll at least won't infect him with malware and take away his windows and half his apps over your crappy ideology!

Re:family tech support

[Anonymous Coward]

Obviously you cannot read your pathetic stupid fucking dickhead.

He stated that Windows would freeze and he had no network access. If he had an Ubuntu Live CD he would have been able to boot into it and get access to both the internet and the Windows installation on the hard drive. From there he would have been able to fix it. He made no mention of installing Ubuntu but since you are a pathetic low life Windows fanboy who clearly cannot comprehend English then you wouldn't understand that. Clearly the original poster knows more about computers than you do. There is more to the computer than Windows and the on/off switch you know.

I meet and deal with tosspots like you all the time. They are clearly lusers who think Microsoft are the only way. The clearly refuse to even contemplate that there could be alternatives. Microsoft through and through, only! They are stupid enough to keep going the Microsoft way even though they have to go through this crap every so often.

You on the other hand need to take your head out of Bill Gates arse and your little cock out of Steve Ballmers sweaty mouth. Go out and get a fucking life you moron!

Re:family tech support

[EpsCylonB]

I know this is a joke but I will bite anyway.

I wished I had brought a ubuntu cd with me so that I could have used the live cd to get net access and figure out how to fix the windows install.

Your turn.

Re:family tech support

[Anonymous Coward]

Oh, that's how it always starts with you OO-BOON-2 freaks.

OO-BOON-2 Freak/ YOU: "Oh, it's a live CD, it won't touch your harddrive."

Victim: "Okay, I trust you. Please get it working again. I think I'm owed that since you stole my zune the last time you were here, even though I paid you $20 for 15 minutes work."

OO-BOON-2 Freak/ YOU: "Nah, I just accidently pick it up instead of my iPod/some_lamer_linuts_device. Bring it back next time, promise. O, this installation is burned. I'm not competent at fixing windows. Let's do a format and install. Where are your Windows CDs"

Victim: "Um, discs? I don't know. Haven't seen those since you were here last" *Wonders if you hadn't stolen them last time for the valuable CD keys to pirate. OTOH, no one steals Linuts CD keys or even CDs strewn about in streets like worthless AOL coasters*

OO-BOON-2 Freak/ YOU: "That's okay. See that 'install' icon?' Let's click that!"

Victim sits down at his computer later that week. "What, why is OO-BOON-2 isn't seeing my music CD I want to rip?" Looks up on google, with Firefux browser that crashes every few minutes due to memory errors. "Wait, I have type 'mount -t iso9660 -r /dev/cdrom /mnt/cdrom' just for a cd? This is bullshit! I'm calling Geeksquad 2night. They know how to treat me right and not steal my stuff!"

OO-BOON-2 and your loose morales lost you another friend, LOOZER!

Re:family tech support

[EpsCylonB]

Bravo

Of course in this case my brother did have the windows install cd, so the easiest thing was just to do a clean install.

I don't enjoy being tech support, whether its for complete strangers or friend and fmaily, I wouldn't install ubuntu for my brother because I know that I am the one he would call when he can't do something.

Apart from the above your completely spot on though.

MS patting themselves on the back

[Etrias]

*golf clap*

Anyone besides me concerned though that this piece of shit malware was eliminated on that many PCs? Doesn't that just scream that there is something fundamentally wrong with the browser and/or the OS?

Re:MS patting themselves on the back

[Colonel Korn]

People actually pay to install it and then manually do so. There's not a lot the OS can do when the user is specifically enthusiastic about installing the malware. That is, there's not a lot the OS can do until the malware is specifically identified for removal.

Re:MS patting themselves on the back

[cbhacking]

Nope. Try a little research, please. This program spreads through two methods, Trojans and scareware (tricking the user into thinking that his computer is infected, so he buys and installs AV2k9 as a "fix"). Such software can do anything the user can (which, provided you run the program with root/Administrator credentials - like you would if installing something - is anything at all).

In either case, it's a simple matter of Problem Exists Between Keyboard And Chair. The prevalence of malware for Windows does make scareware more likely to work, but in the end it's still a matter of the user telling the OS to do something stupid (run a malicious program) and the OS obeying just like it's supposed to.

Re:MS patting themselves on the back

[cdrguru]

If software can be installed, then your average user is going to do something bad.

Best answer is a web appliance that does email and web browsing and NOTHING ELSE and CANNOT have anything installed on it, no matter how attractive is sounds.

This is all 99% of the "home computer using population" needs. The other 1% can have computers they can screw up to their hearts content. The problem is today this move would put all of the PC manufacturers out of business. It would also put anyone who gets paid for cleaning up screwed up computers out of business. Geek Squad, anyone?

Re:MS patting themselves on the back

[compro01]

At least some variants of it use some privilege escalation exploit, as running as a limited user does nothing to stop it.

Re:MS patting themselves on the back

[Bert64]

Yes...
What's wrong with having a mail/browser that you can run on a games console, and which boots from readonly media and doesn't store any executable code on writable media...

Someone should make a simplified linux livecd distro that's trivially bootable on a PS3 and can be used for basic browsing and email (mount the hd under /home with the noexec option)...

Re:MS patting themselves on the back

[Anonymous Coward]

Trojans and scareware (tricking the user into thinking that his computer is infected, so he buys and installs AV2k9 as a "fix").

If windows were secure, trojans wouldn't be able to do as much damage as they do now (I don't want to say "no damage", but at least it would be much more limited, and removing them would be much easier).

Also, if windows were secure, people wouldn't fall for scareware. In fact, the VERY EXISTENCE of scareware shows that there is something fundamentally wrong with windows - people are so conditioned to expect that they're infected with all kinds of shite that they will believe any ad banner that claims they are.

If windows were secure, this kind of scam wouldn't even exist.

Re:MS patting themselves on the back

[Etrias]

Oh please. You are talking about the scam, I'm talking about how the malware ends up on the system in the first place. How does it get there before they get suckered in and buy it, hmmm? Sure, it's all bait to get someone to pony up money for the supposed "fix", but before that, it shows up as a bunch of pop-ups and home page redirects letting you know that you have malware. PLUS, some variants prevent you from getting to web pages which would help you remove it.

Here's my point that you so carefully missed. MS said that it cleaned 400,000 PCs of Antivirus 2009. Digging a little further into the article you find they claim that they cleaned about one million PCs from other malware software in the last quarter. Lets assumed that even with those big numbers, they missed some (even though an honest assessment would be that they haven't even scratched the surface). The problem is that we have a browser (IE) which still is infuriatingly easy to load with malware/spyware. Coupled with an OS which either in the case of XP, offers no protection from installing items in the background or Vista, which the UAC frustrates the user in such a way that they feel better when it is off.

Believe me, I've had to deal with this crap malware before and have it ruin many a day for me as I have to be the one to clean it off of people's computers when they get it. Incidently, you're little jab of "try a little research" is way off the mark. You never address how it ends up with the initial malware in the first place...which is through browsing and landing on unsafe sites. I am the first to recognize a PEBKAC when I see one, but this particular malware is nasty.

Re:MS patting themselves on the back

[Anonymous Coward]

Seen this one do a drive by browser install exploiting IE security holes. Definitely doesn't take a user screw up to get AV2k9

Re:MS patting themselves on the back

[recoiledsnake]

The problem exists because, if a user can install FireFox(or any other software) off the internet, they can install malware disguised as a useful program too. Windows, or any other OS or browser, cannot determine whether a said program is harmful(except Antivirus s/w like Defender). IE now gives multiple warnings and stops driveby downloads by default(pops up a bar on top) and allows downloads onyl if you click on a direct link etc. If OS X/Linux was popular and a legitimate looking site offered NiceGame.deb or NiceGame.dmg, won't many users(naive ones) download and install them beyond any warnings etc.? Either you make stuff absurdly hard to install(hence making FireFox hard to install), or use a whitelist like iPhone App Store(which stops all other sites from distributing s/w), ideas which won't be popular at all.

Re:MS patting themselves on the back

[LackThereof]

IE does NOT completely stop driveby downloads yet. Holes that allow them are being patched regularly, but they are by no means dead. Most of the zero-day exploits found in the wild these days are driveby type holes - all a user has to do is browse a legitimate website with a sketchy ad network, or better yet, a legitimate website that's been compromised to include a hidden iframe. Something is installed silently, typically avoiding UAC through a privilege escalation exploit. Not that anyone has UAC turned on, anyway. And most home machines are so sloppily patched that exploits from 2 months ago will still work. Assuming the autoupdater isn't still stuck prompting the user for SP1, in which case... they're already hosed.

Re:MS patting themselves on the back

[Anonymous Coward]

Yeah, because linux is immune to social engineering.

Here's a little hint for the fanboys: When you can get the root user to run your program, you can do whatever the hell you want. Linux won't save you.

(And don't cry about running as a limited user - this is something that claims to be an antivirus program, something that the sort of user who installs fake antivirus programs would happily grant admin access to).

Everyone seems to want linux on the desktop, but no one wants to accept that fact that once that happens you have the same stupid users that get viruses on windows admining linux systems.

Re:MS patting themselves on the back

[Kojiro Ganryu Sasaki]

Linux is more resistant to driveby installs, though.

Re:MS patting themselves on the back

[Wildclaw]

The problem isn't installation itself. The problem is with the idicoy that surround the current way of thinking that computer security has, starting with the whole centering on user access. Programs aren't data files and simply shouldn't be governed under the same rules as data files. Instead programs need their own restrictions that are handled independent to which user who runs the program.

An ordinary user should have the right to install any program, but the rights of the programs the user installs should be limited to access to the application's own directories as well as access to files via a secure file dialog.

The whole idea that I have to install as an administrator is what caused this whole mess, because that just causes every user to become an administrator every time he wants to install a new program. The solution isn't to make it more difficult to install things. Instead you want to make it easier to install things, but ensure that things that get installed can't do any harm.

Re:MS patting themselves on the back

[cbhacking]

Oh, please.
sudo rm -rf /
plus entering a password (equivalent to a UAC prompt, or if you run as Administrator then you're logging in as root and can discard the sudo) is less damaging how? Linux actually makes far less effort to prevent the user from doing something truly stupid than Windows does.

Of course, we were talking about Trojans and malware, rather than just wanton destruction. How about a rootkit that quietly patches your kernel so that any socket you open to port 80 (or 25, 465, or take-your-pick) causes a notification of such to be sent to some malicious address? Hell, that would be an easy piece of really nasty spyware, compared to doing it on Windows (having kernel sources helps, of course). Anything running with root permissions could easily make the modification, even preserving the metadata well enough that you'd probably never notice unless you routinely run hash checks on your kernel. Sure, it wouldn't take effect until you rebooted, but even Linux needs to reboot every now and again. Hell, it might even be possible to do that sort of thing as a loadable kernel module, and then you're hosed unless you happen to notice a funny entry in lsmod.

Re:MS patting themselves on the back

[cbhacking]

Um, no. Again, do your research. The scam *is* how the malware ends up on the system. Somebody is browsing the web on a completely clean system, and a pop-up (from a otherwise legit ad vender that took these peoples' money) jumps up and screams at them that their system is infected. It tells them that their only hope of salvation lies in downloading Microsoft Antivirus 2009, with a handy link. Being the kind of person who doesn't really understand how computers work, they have no exceptional reason to be suspicious, follow the link, hand over some dough, and willfully install the malware.

THAT is when the locally-originating pop-ups, home page redirects, and blocking of search results starts. Up until then, the duped user had simply been interacting with remote servers on a completely clean computer.

I've managed to avoid dealing with this specific malware, but I've cleaned plenty of others. Over the least few years, nearly all of them were due to Trojans that ignorant users intentionally ran and gave whatever permissions they needed. I think you're a little too ready to assume an actual security flaw where none exists - IE, especially IE6, certainly still has vulnerabilities, but they are not the main avenue by which malware lands on the average user's computer these days. Scareware through legit ad vendors is quite common as well, even to the point that I've seen some very authentic-looking warnings with perfect imitations of the default XP window chrome... while browsing the web using Konqueror on Linux with a theme that looks nothing like that of Windows.

Re:MS patting themselves on the back

[Spatial]

There's something fundamentally wrong alright, and it's simply that people are completely thick. It's a trojan.

Re:MS patting themselves on the back

[krinklyfig]

I deal with cleanups every day. I understand that in many cases it's the user who allowed the malware in, but any conclusion which points at the user as a resolution to the problem is missing the point. It's been over 16 years since the Endless September, and we're in no better shape trying to educate people. Any security solution which requires the user to become educated is doomed. The problem may be the user in the strictest sense, but the solution has to be taken out of their hands to work in a widespread fashion. Prevention and eradication has to include the concept that most users will never become educated enough to prevent these issues.

Re:MS patting themselves on the back

[Anonymous Coward]

Not quite right on the methods there buddy. Depends how it's bundled. I have removed this "family" of crap from at least four dozen computers in the last few months. I knew that some of the clients in question would gladly click on a window that told them "U R infectz0red! Click HERE!". PEBKAC happens.

I also removed it for some people who are generally skeptical, who don't usually call me with malware problems; I thought "well, the social engineering is just that effective".

Then *I* got the fucking thing. Previous infections? None. XP x64 fully updated? Check. Updated, active anti-virus? Check. Running Firefox 3.05 at the time of infection? Check. System scanned clean with malwarebytes 2 days prior? Check.

And next thing I know I'm closing a license agreement (lol) for "Virus Remover 2008". Silently installed, apparently from a site I browsed to via reddit, that looked like it might have been a hack job on a blog (the blog itself didn't seem suspect). Malwarebytes rips a few dlls out of system32, some startup entries, about two dozen items total, and it's gone (reinstall coming soon).

The fact of the matter is I've never seen two identical "bundles" of these apps. Some are cake to remove, others are buried in layers of defensive crap that blocks MB, A/V, etc etc. I've removed the ones I've seen, one way or the other. Doesn't work on Vista? Wrong, seen it, 2-3 times. The scareware is the symptom, the question is what methods of installation/defense it's bundled with.

Yes, we can all sit around and chuckle about my client who has managed to catch these things three times now, who I guarantee will happily click on anything that promises to fix his imaginary infection. What we cannot do is dismiss this stuff as purely the result of PEBKAC when MS can remove 400k infections just on the machines that are updated (through the infection, which isn't guaranteed).

And just in case you're patting yourself on the back for running linux/mac, consider this scenario:

Anyone recall a flash "bug" a couple months ago that spammed the clipboard from within ads on major sites? I was chatting with a friend in IRC. Had about 5 tabs open in Firefox. Tab 5 is lol. Ctrl-C//Ctrl-V/Enter. Friend says wtf?

Tab 2 was MSNBC, running an ad with the flash clipboard attack. The recipient stopped at the sight of the URL. The pasted address was the "main" antivirus 2009 site. The recipient was on Vista, but I pasted it from Firefox into XChat on Ubuntu. Tell me, how long do you have to read your chat client between your left hand hitting ctrl-v and your right hand hitting enter?

Heh, what an excellent thought..

[Finallyjoined!!!]

It'll never happen, but I'd like to see one of those guys try to sue microsoft for violating their EULA -would microsoft try to claim that the EULA was invalid?....

To take into 2009 :-)

When will people learn

[TheGeniusIsOut]

I do not have anti-virus/spyware/malware software installed, the only firewall I have is in my router, my computer is on and connected nearly 24/7, and I have not gotten any viruses/malware/spyware in at least 3 years. Windows XP fully updated, careful browsing/downloading habits, and liberal use of free online scanners for suspicious software before execution has served me well. The problem is too many people are click happy and ignore common sense, basic safe computing habits, and in general are looking for a quick fix they don't have to think about. This leads to people falling prey to the pop-up ads claiming their computer is infected so they can download the latest botnet zombification software. Up until a year ago, I was having to clean my sister's PC on a weekly to monthly basis due to all the crap she downloaded off the internet. After convincing her to try the safe habits I practice for a month, in which time her computer worked perfectly, she realized she was the source of her computer problems and corrected her attitude towards computer security, with no problems to this day.

Re:When will people learn

[Aetuneo]

(l)Users don't want to have to think about what they're doing, they just want to be able to do it. Sad but true.

Re:When will people learn

[Lumpy]

Because a computer is too complex for these people. Cripes they have to put a warning label on a curling iron to NOT stick it into any bodily orifices.

if our consumers are stupid enogh to stick a hot curling iron in their ass, ear,mouth, nose ,etcc... then they certianly are not smart enough to be near a computer.

People expect computers to be toasters. They are not, they are highly complex devices.

It does not stop me from collecting all the malware infected dells that are 1yr to 6 months old. I sell them a new dell for $299.00 less than the cost of my cleaning the pc. and I get thier old infected pc for free. every 2 of them get combined to make 1 good one and then after an ubuntu install they get donated to a local school. I lock the boot sector and bios so the part time handy with computers guy at the school can not install winders on them. almost every 6 months I donate 40 hours of time to these schools and reinstall ubuntu on many machines as the moron physed teacher keeps installing his pirate copy of XP that comes with 3 trojans in it. Opening up the school to a huge liability. They wont buy a site license.. not in the budget.

Dumb people infect pc, they call me after calling geek squad and being quoted $300+ to fix it I take their pc, give them a NEW ONE and a school get's free goodies and I get a giant tax deduction.

All around win.

Re:When will people learn

[cbhacking]

Substitute Vista for XP and add the Windows Firewall (which is much better on Vista than XP) since I'm on a laptop that's not always behind a router, and this is true for me as well. There's always the risk of a 0-day exploit, but those are less and less common and there are mitigations for them (like NoScript or other forms of Flash blocking, plus don't run everything as Administrator). Unfortunately, as the software security gets better, it seems the user security gets worse.

It really is a problem of education. The OS tries to warn you, but it can't determine sketchy download from legit ones so the same warning always appears and people click right past it. People don't even recognize these things, or else they think that having Norton installed makes them immune. Most computer users treat it simply as a tool, and never think in terms of its security.

Re:When will people learn

[Kojiro Ganryu Sasaki]

That's not sad. That's practical. If i have a hammer, i want to use the hammer to hit nails with it. I don't want to begin every nail hammering session by inspecting it to see if someone has smeared super glue on the handle.

Re:When will people learn

[Anonymous Coward]

Yeah, let's all pretend that zero day doesn't exist. There are no worms, only trojans. If you don't click "I agree" nothing bad can happen to you... Great New Year buddy! Hope you like your life in that cave. Just keep sending those emails... /cluestick

What an ass.

Re:When will people learn

[Chordonblue]

This.

Re:When will people learn

[JumpDrive]

You're a perfect botnet host. My hats off to you.

Re:When will people learn

[Anonymous Coward]

I think you may be trolling but I'll bite anyway... An online scanner will not detect anything once a rootkit has gotten its hooks into your kernel. Check out UBCD4WIN or GMER if you're going to live dangerously.

Re:When will people learn

[nine-times]

That's great. Consider yourself smart and/or lucky. To be honest, I run AV software on all my Windows machines, and I don't think I've ever had it find a virus while I was using it. On the other hand, I have users, friends, and family member who seem to encounter viruses on a regular basis.

I don't know what they're doing, what sites they're visiting, or what behavior is leading them to find these viruses. At this point, I generally don't care, because I haven't had any luck getting them to stop whatever it is they're doing. The answer is that they have to run their computer as a non-administrator, and they need to run an Antivirus package.

Re:When will people learn

[therufus]

You have to understand these things can come through other avenues, not just ignorant browsing habits. We've had customer's who have sworn that they haven't used their browser for weeks, only checked emails. Now I know people lie, but it is plausible and I'll tell you why.

Some of the first variants of Vundo virus (pretty much all of these WinAntivirus/MS Antivirus 08/09/etc) was fed to the OS through an exploit in older versions of Java. JAVA! You'd not normally think that injecting code through an old version of Java would be the way these things get infected unless you're in the business. Your average Joe these days would question 'updating your java' when they don't even know what java is.

So it's not always just people clicking on a banner that is telling them they're infected, or they're the 1,000,000th visitor that get infected with this scum.

Re:When will people learn

[Bert64]

Infecting users through third party plugins (java, acrobat etc) is actually a fairly effective technique...
windows update only updates its core system files, it doesn't update third party apps at all, not sure if it even updates non default microsoft apps either.

Re:When will people learn

[Nethead]

Good operation there Lumpy! Now, when people ask me to fix their Windows box I just set their old drive to slave and pop in a 160GB drive with Ubuntu. (I have a nice stack of 160s from an old job.) If they ask about the difference I just tell them it the latest upgrade :)
If they try to run smiles.exe or whatever they got online and it doesn't work I tell them the virus detection is working. They can always get their old data off the windows mount and as long as they can surf, d/l music/vids and burn them, they have all they really want. Most like the upgrade to just one chat program (pigeon) and none have ever complained about Open Office.

Granted, none of these people are gamers. But (caution: car analogy) I figure that if they want to run a hot rod they better know how to get under the hood.

I just got to the point that I don't do Windows. http://nethead.org/dilbert-unix.png

Re:When will people learn

[Shados]

Yeah, Windows Update keeps stuff like Office or SQL Server up to date. Even some third party stuff, like nvidia drivers (always late though). But not everything, unfortunately.

Re:When will people learn

[Smauler]

People expect computers to be toasters. They are not

Ha! That's what you think! The line is blurring....

Re:When will people learn

[Anonymous Coward]

Congratulations!

Re:When will people learn

[garwain]

Isn't that kind of like not using a condom because all the women you sleep with are professionals, so they must be clean, so you must be safe?

Re:When will people learn

[Anonymous Coward]

Significantly you didn't mention any anally retentive habit of installing updates for Flash, Adobe Reader, JRE, etc the minute they become available. You said nothing about browsing with JavaScript, plug-ins, I-frames or other inline content disabled. You didn't mention running with reduced privileges (you're not running as admin are you?). Fact is, you can be very careful these days, do almost everything right, and still get rooted by some nasty .swf or .pdf pulled in through a trusted website's infected CDN. Nothing visible, no click required. My guess is you're not as untouchable as you think.

Re:When will people learn

[Anonymous Coward]

Who clicks pop-ups? Idiots.

I've never known anyone who actually responds to ads/spam/pop-ups, but apparently more than 400,000 people are dumb enough to do so.

Re:When will people learn

[smash]

You're one of the people who will still get hit by stuff like code-red or other 0-day browser exploits that infect your favorite website.

Yes, your habits will reduce your exposure, but they aren't fail-safe.

At least Zunes are safe

[MrNonchalant]

Thanks Microsoft for thoughtfully protecting all the Zunes from this outbreak.

Just the beginning

[matthewncohen]

I have uninstalled this parasitic piece of crap from the same guy's laptop no less than four times over a period of months, even doing my best to educate him about the situation. The Malware Removal Tool is not going to make any difference if the user is intent on reinstalling it as soon possible.

An actually responsible thing to do might be for Microsoft to run a friendly educational campaign about malware and viruses... a lovely dream.

Re:Just the beginning

[Chordonblue]

My continuing policy for repeat infected users is to install Ubuntu or Mandriva. Granted, I'm not sure if you're talking about a corporate user here or not, but all my friends and relatives are getting Linux now.

I'm tired of seeing the disappointment and terror of people who get this shitware on their computers. I'm tired of spending hours trying to fight the damn things, reinstall Windows, update Windows, reinstall apps, wash, rinse, repeat.

So I'm done - either Linux, I tell them, or buy a Mac. Those who have gone the Linux route have not looked back. I put on Wine for those few apps people need, and all is good.

Re:Just the beginning

[matthewncohen]

This guy is a small business owner who could probably switch to linux but like so many he pretty much runs his life through Outlook. The migration process, not to mention the lack of an integrated email/calendar app for linux that I know of, might be too hard on the old guy.

Re:Just the beginning

[Bert64]

Doesn't evolution do that? Zimbra desktop is meant to be good too, tho i think it requires the server to go with it.
I never saw why email and calendar had to be integrated into one app, they are separate functions, and there are already standard ways to connect the two.

Re:Just the beginning

[Smauler]

I just read this a minute ago. Sounds like this could be your problem, unless you've gone out of your way to remove rootkits too.

removed my antivirus!

[gchesney0001]

Now OpenOffice doesn't work either!

Very few PCs run Windows?

[flyingfsck]

If only 400,000 machines were infected, then it would seem that Apple And Linux have taken over the desktop.

Re:Very few PCs run Windows?

[cbhacking]

The malware may try and stop Windows Update from running (many of them do). For that matter, the kind of people likely to install something like this (it spreads either through Trojans or as scareware, not through system exploits) are probably statistically more likely to have Windows Update turned off entirely. For that matter, this isn't a worm that spreads automatically - it takes substantial user error to get infected in the first place.

All this means that the only infections the MSRT can get to were either not fully compromised (yet) or the user did something tricky (like downloading the MSRT to another computer, renaming the executable, and running it from a flash drive). Considering that, 400,000 is actually a lot for a well-known and reactive (not proactive) tool like the MSRT.

Re:Very few PCs run Windows?

[garwain]

or they are only counting the ones that MS has received reports about... I have cleaned about 30 machines of this evilness in the last few weeks.

Re:Very few PCs run Windows?

[Spatial]

For that matter, the kind of people likely to install something like this (it spreads either through Trojans or as scareware, not through system exploits) are probably statistically more likely to have Windows Update turned off entirely.

Out of curiousity, why do you think that? If there was a correlation I'd expect the opposite, because in my experience the kind of people who fall for this stuff aren't the ones who tinker with default OS settings. They just don't know any better.

Re:Very few PCs run Windows?

[TheQuantumShift]

The rest are on corporate networks that block windows update (but still allow popups proclaiming "Ur 'puter i$ uNproteccteded!!!!1! Clic hear n0W!") or are still on dialup where running windows update, even on a fresh sp3 install is a royal time consuming, prone to failure pain.

The best antivirus solution

[Anonymous Coward]

www.ubuntu.com
www.opensuse.org
www.fedoraproject.org
www.freebsd.com
www.opensolaris.com

Re:The best antivirus solution

[TailGunner]

Using an insecure OS that nobody cares about is NOT security. dumbass.

Re:The best antivirus solution

[Kojiro Ganryu Sasaki]

It's security by obscurity!

Re:The best antivirus solution

[Anonymous Coward]

Using an insecure OS that nobody cares about is NOT security. dumbass.

There ought to be a moderation type made specifically for this kind of a post.

Re:The best antivirus solution

[Anonymous Coward]

Using an insecure OS that nobody cares about is NOT security. dumbass.

There ought to be a moderation type made specifically for this kind of a post.

Are you looking for +1 cluebat?

There is no +1 ironic for meta-moderation, but you gotta love /. for this: the GP that you quoted is currently modded insightful. And certainly, his comment is insightful, when considered by itself. But in context, you might assume that the GP was actually referring to Ubuntu instead of Windows XP, which would make it obvious flamebait.

Ah, the joys of moderation divination:
The GGP is off-topic. Might even be considered a troll, for posting such an obvious solution in a Windows-centric thread.
The GP's intentions are harder to discern. Such an obvious flamebait as the GP can't be taken seriously, therefore we must assume that the GP is being sarcastic. And his sarcasm is so subtle, that you can only detect it through much deliberation. It should be modded funny with a karma-bonus. And insightful is the new funny, isn't it?
You, dear parent, entice the reader to reflect on the current state of /. moderation without bias or stated agenda. You should be modded interesting.
And as for me, clearly I'm the easy moddee here. All moderators already know what I just wrote, so I must be redundant.

So, my €0.02 moderation guide:
GGP - offtopic
GP - insightful (and on-topic)
P - interesting
me - redundant

I'm tired of users like you

[Anonymous Coward]

I'm not saying this as flamebait but I'm really tired of users who consistently post in forum after forum that they don't run antivirus, firewall, or antimalware applications. Then, just like you, they claim they don't have any infections. How would you know even if you had an infection without running a scanner? Online scanners are great but they only cover files that you're going to run of your own volition. They do not cover infections that occur through holes in the browser and/or OS. This is where the fundamental problem lies in your strategy.

Case in point, lets say you browse to a website that uses a hole in your browser to get code onto your system that opens a port via UPNP in your router. Then through the open port your machine starts infecting/spamming others. How would your methods guard against that?

Safe computer habits are great when you can trust your Operating System and browser to be secure all while you're not logged in with an account with "Administrator" (root) level privileges. Too bad Windows can't be trusted to be secure and, therefore, necessitates the need for antivirus, antimalware, and firewall.

Re:I'm tired of users like you

[TheGeniusIsOut]

How would you know even if you had an infection without running a scanner? Online scanners are great but they only cover files that you're going to run of your own volition.

I run a full scan with Trend Micro's House Call every few months to see if I am infected, which does much more than simply scanning files I would execute of my own volition. We use McAfee at work, and House Call will detect and remove things McAfee ignores, which usually come my way via a co-worker's USB drive.

Case in point, lets say you browse to a website that uses a hole in your browser to get code onto your system that opens a port via UPNP in your router. Then through the open port your machine starts infecting/spamming others. How would your methods guard against that?

If I went to a site that found an exploitable hole in Opera, since I only use IE if I have to, and began running code on my machine, it could be detected by a quick look into Process Explorer and a check of my idle bandwidth usage. It may take a day or two to notice the performance degradation to check, but it would be found. As this has not happened yet, it does not seem to be a problem for me

Safe computer habits are great when you can trust your Operating System and browser to be secure all while you're not logged in with an account with "Administrator" (root) level privileges. Too bad Windows can't be trusted to be secure and, therefore, necessitates the need for antivirus, antimalware, and firewall.

I can trust my operating system, because I do not trust it completely. I know no system is perfect, and someone will always be looking for a way to subvert the latest security patches. Having protection is no substitute for vigilance, but sometimes vigilance in itself can be all the protection you need.

Re:I'm tired of users like you

[Anonymous Coward]

I run a full scan with Trend Micro's House Call every few months to see if I am infected, which does much more than simply scanning files I would execute of my own volition. We use McAfee at work, and House Call will detect and remove things McAfee ignores, which usually come my way via a co-worker's USB drive.

You're still trusting your security to a scan every few months. You're more likely to have a lower infection rate by running a good on-access virus scanner on your machine even if another scanner (such as Mcafee) ignores some files.

If I went to a site that found an exploitable hole in Opera, since I only use IE if I have to, and began running code on my machine, it could be detected by a quick look into Process Explorer and a check of my idle bandwidth usage. It may take a day or two to notice the performance degradation to check, but it would be found. As this has not happened yet, it does not seem to be a problem for me

First of all, how would you know a site found an exploitable hole? I'm pretty certain you're not monitoring every security mailing list on the internet. Even if you were would you run a full system scan every time a new exploit came out? It seems like a pretty big waste of resources. Secondly, we all use Process Explorer but do you leave it running all the time and monitor every process running on your machine in realtime? What about big all encompassing processes like svchost.exe that run multiple services? Do you monitor the load modules and stacks in realtime? Most times people fire up Process Explorer because something is pegging their CPU usage.

What happens when the next piece of malware comes out what runs at a low priority, can detect an idle network connection, and can hide itself as another legitmate process? Oh wait, they already exist. I somehow doubt you monitor all of this in realtime because if you were paying attention to everything then you'd have very little time to do "real work" on your computer. This is why these realtime scanning agents were created.

Having protection is no substitute for vigilance, but sometimes vigilance in itself can be all the protection you need.

Vigilance of every process in realtime on your machine is exactly what a virus scanner does. However, as a person who runs his computer 24/7 and always connected to the internet, how can you claim to be vigilant?

The worst part of overly self-confident posters like you is you try to train others in your system. For example you stated you taught your sister your system. Does she use process explorer too? Does she monitor her bandwidth usage as well? Therein lies my problem with your post. In this day-and-age running Windows without antivirus and antimalware scanners is all the rage amongst the "too cool for you" self-proclaimed computer geniuses littering the web's gamer forums. You wouldn't believe how many times I've been asked to fix someone's computer only to hear that they "read somewhere that virus scanners aren't needed." Therefore people like you are the problem just as much as those who don't manage their own computer's safety. All it takes is a couple thousand machines to bring down spam/infect tens of thousands of others.

Re:I'm tired of users like you

[Anonymous Coward]

I wish I had mod points for this comment. The arrogance of the previous poster irritates me.

Even if it is true that this 'Internet bad-ass' hasn't gotten any infections, how does this mitigate the damage the millions of users who do get infected suffer?

I guess they make the mistake of not having IT training, huh? Users should be better protected against malware, end of line. No amount of, 'Well, *I've* never been infected...' is helpful.

Re:I'm tired of users like you

[st0rmshad0w]

Yeah, good luck catching rootkits with an online scanner. If you can even get to one once the malware takes over your network stack.

And is that router of yours just a Linksys NAT router or a real UTP device?

Spend a few years fighting this stuff pretty much full time and you'll see how foolish your assumptions are about both the ability of this stuff to find a way into your system, and your ability to detect it and kill it once its there.

Re:I'm tired of users like you

[st0rmshad0w]

From the CBL a few months back:

News Alert - 2008/09/22 - A/V is not keeping up
It has become apparent that reliance on Anti-virus software for protection against spam bots is increasingly ineffective, and is reaching "disaster" status.

A large non-profit security organization has recently reported that only 23% of the 30,000 "unique" infections they see per day are detected by _any_ of 35 of the most popular A/V products, and percentage only reaches 50% after the infections have been in the wild for a month. And this includes well-known long standing botnets like Srizbi or Storm.

Many of our correspondants have told us that they've run a whole battery of A/V products on an infected machine that are provably infected with a known bot (by the email they emit), and not found anything.

Given the failure of A/V to help identify/eradicate infections, we can only continue to assert that the best way to prevent bot emission (and CBL detection) is to secure your networks so that ONLY mail servers can send email to the Internet.

Spam bots are out-pacing AV software by leaps and bounds.

Re:I'm tired of users like you

[shiftless]

Sorry, your post is flamebait. Like the grandparent I refuse to run that crap on any of my Windows PCs. It slows the computer down and it's simply not necessary if the user is somewhat clueful and takes appropriate precautions. I have never had a hole in my browser or OS exploited to install malware. The only time I got a piece of malware installed was when I was stupid and ran a suspicious EXE off a cracking site. (And yes, I have ran many EXEs off cracking sites without problems; I had a bad feeling about this one but stupidly ran it anyway.) I am not a new user; I have been using PCs since the MS-DOS 5.0 days and at no point in time have I EVER had to rely on antivirus/antimalware/etc software to keep my computer clean.

And yes, I *would* know if my PC became infected with spyware. I do pop up the task manager from time to time for various reasons and I know which exactly processes are normal and which don't belong. I don't run a bunch of bullshit programs in my system tray or background processes so I know right away when the system starts acting abnormal; I then immediately start looking for the cause. (Back in the DOS days you could just watch your hard disk activity LED for unusual activity.)

Re:I'm tired of users like you

[Stiletto]

Your post (and those like it) is FUD.

I'm another one of those apparently "arrogant" folks who practice safe browsing habits and somehow have never gotten an infection. Take basic precautions, run everything in a non-Administrative account, and you'll likely have no problems.

Some of you guys sound like those extreme alarmist sex-ed teachers: "EVERYONE'S AT RISK OF AN STD!!! Be afraid!! You think you're so smart because you use a CONDOM during sex??? How about oral? What about pubic lice? What about crabs? That toilet seat you sat on?? That person you shook hands with, did you wash afterward?? See! You're so arrogant to think you're safe! The only way to be truly safe is to WRAP YOURSELF IN PLASTIC WRAP EVERY DAY AND HAVE NO CONTACT WITH ANYONE, EVER!!!!!!"

Practice safe, common-sense browsing, run a scanner periodically (weekly should be enough), and don't run with administrative privileges, and your chances of a system-destroying virus infestation are incalculably small.

Re:I'm tired of users like you

[Anonymous Coward]

And I'm fairly sick of people that think that antivirus provides a universal solution to the end users being unable to take responsibility for their own actions.

I go to somewhat silly lengths to validate that my own systems are virus free - I run an incremental backup of all files (using a PXE booted OS once a month), then compare them for changes to any files I consider important, then verify they happened because of an expected update, are digitally signed by MS, something I installed or a document I created/edited.

I also don't get problems from my parents antivirus free computers or brothers antivirus free laptop because I told them to think and read messages before they click them, don't trust anything they see on screen and call me if they have any doubts or see a message at the same time as browsing that seems suspicious. Just defining that it IS possible for sites to pretend to be the system appears to have been adequate to prevent them from falling for these things (although I occasionally have to take a look at their screens it's maybe once a month at most).

On the other hand a whole bunch of people I know that do run antivirus packages up the wazoo and have firewalls and adware removal programs gallore on their systems also tend to have vast numbers of trojans, virus infestations and happily go an enter their credit card details when asked like good little sheep.

The vast majority of the population is totally stupid, no amount of "antivirus" will fix that, though a whitelist of programs will (incidentally I use digital signature based whitelists on servers just incase already as a precaution and software restriction policies is easy to implement).

Re:I'm tired of users like you

[Anonymous Coward]

You do know that one of the main features of a root kit is to keep the processes from showing on process listings such as task manager, and that they are generally successful at this, don't you? The better rootkits can detect when they are being run under a VM, and avoid running then to avoid detection.

I agree that safe practices are generally sufficient, but it's healthy to be skeptical.

Re:I'm tired of users like you

[Anonymous Coward]

And I suppose that you know if anything is installed through running Symantec/AVG/Whatever?

AV software has become pathetically ineffective and trusting it is foolish. I agree that it is useful on end-user systems in order to catch less effective malware. However, if you generally keep an eye on what processes and services are running, what runs on startup, what's hooked into explorer.exe and winlogon then AV software is only slightly more useful than a program that does nothing but eat 20-50% of your system's resources.

Re:I'm tired of users like you

[Anonymous Coward]

I'm not saying this as flamebait but I'm really tired of users who consistently post in forum after forum that they don't run antivirus, firewall, or antimalware applications. Then, just like you, they claim they don't have any infections. How would you know even if you had an infection without running a scanner?

I think these people mean they seldom run a scanner, but when they do they never find any problem. A sufficient paranoia factor between the ears and a good hardware firewall will guard against perhaps 99.999% of the Windoze malware. Like another poster here, I've been splashed with the AV2009 window a few times in the past from seemingly reputable pages, before it became infamous enough to garner much comment on the internet. It was blatant phonyware. Alt-F4 (I have Firefox set to clear everything possible whenever closed) and life went on. Oddly enough the worst time was not on Windows but Linux (Kubuntu Intrepid). The blastard thing managed to fill the screen with all the browser windows in an unminimizable way, even those invoked afterward. (I ended up nuking my personal mozilla directory to get past the problem.)

Re:I'm tired of users like you

[NuclearDog]

Sure, maybe I've got some sort of virus/trojan/spyware. It must be a particularly nasty one too, there's no noticeable spike in network traffic (so I must be spamming), nothing picked up by the IDS (from all those malicious port scanning and network attacks going on), no pop-ups (making them lots of money), nothing picked up by clamav on my fileserver (not infecting things allows it to spread more effectively) nor any changes in the md5 hashes of the vital system files and directory listings I monitor (allowing it to truly root my system).

Oh, and my router doesn't support uPnp.

Of course, you could play the card that it's possible it has so effectively rooted my system that the on-system checks (md5 hashes/listings) are compromised, and it doesn't perform any activities that would allow the other machine to pick it up.

But I'm not playing possibilities here, I'm playing probabilities. I find the chance that I've been infected by a piece of malware that would slip under my radar sufficiently low as to be acceptable. Consdering the one or two infections I have let slip by (by running executables I really shouldn't have) have been picked up almost instantly.

Especially considering how ridiculously ineffective most modern AV programs are and how much they negatively effect system performance. Merely monitoring the hash of vital system files and keeping an eye on changes in the list of files in Windows\System32 will probably be more effective.

But hey, what do I know.

How to fix this on Grandma's PC

[mrtexe]

mrt.exe

To run the MSRT program you need to run mrt.exe. from the "run" dialog box or a command prompt in Windows.

You can directly download the latest mrt.exe

Why do they know this?

[pembo13]

Why do does the malaware removal tool report back about what it finds? Do all such tools do that?

Re:Why do they know this?

[cbhacking]

Presumably it's just to collect metrics on how widespread the malware is. It might also be used for vaguely PR-like purposes (such as TFA). It does not (apparently) identify the computer that got infected, merely indicates that such an infection was found.

Warning: Known sockpuppet/troll

[Anonymous Coward]

User maintains more than a dozen sockpuppet accounts on Slashdot.

Re:Warning: Known sockpuppet/troll

[Anonymous Coward]

Warning: The user Anonymous Coward is a known troll/sockpuppet.

Long live Twitter!

it got me

[systematical]

I consider myself a pretty knowledgeable computer user as I've been in IT for 6 years now working in technical support, network administration, and development. Spybot and AVG would not even run and I couldn't reinstall them. Trend Micro's online scanner would stop working half way through. I installed adaware and that removed some of the junk. Then I installed Avast and that removed a bit more. At this point I was able to run SpyBot and that removed a bit more. Finally after running malware bytes or whatever its called + spybot + adaware + avast + malware bytes again for good measure my XP system is "clean." Though who really knows? My system is speedy again, as well as my internet, but I have the sneaking suspicion my pc is working the grave yard shift for a botnet....

Re:it got me

[Anonymous Coward]

Then reformat. Jeez.

Re:it got me

[wap911]

Mepis will cure that www.mepis.org

Open My Computer
Click the Show Folders icon on the tool bar
Navigate to the Windows [or WinNT] folder.
there is a little icon on the right of the tool bar that will select "Show Details"
Click on the "Date" column name until the top is the newest files.

Look for strange named DLL/EXE/INI.
if they are after you noticed the pc got sick.
Right Click the file and choose rename the put a _ at the start [if the machine works fine there easy to find and delete after a reboot]

But the real answer is Mepis.

Re:it got me

[Anonymous Coward]

You've been doing IT technical support for 6 years and you can't determine whether or not your computer is still infected? This reveals a fundamental lack of knowledge. You're taking a shotgun approach to the problem and hoping it will get fixed.

>Though who really knows?
>My system is speedy again, as well as my internet, but I have the sneaking suspicion my pc is working the grave yard shift for a botnet....

Baby Jesus weeps.

One rogue program removed per month?

[rrohbeck]

So how long will it take to clean up the entire population of Windows PCs?
This kind of propaganda is counterproductive. First of all, this is a negligible effect, secondly it pretends that MS takes care of Windows users, and thirdly it doesn't emphasize that safe computing is far more important than all security software in the world.

Re:One rogue program removed per month?

[philspear]

While I would in no way consider myself a computer expert of any sort, I do think I'm more informed than a good number of PC users, yet I managed to get infected. I was running antivirus and a firewall, run adaware and spybot regularly, run opera with popups blocked instead of internet explorer, never download anything from e-mail, and thought I was being careful about what I downloaded. Yet I got infected with an annoying one. Still not sure how that happened. Not looking for advice here, so I'm not going to get into specific holes in my defense.

My point is that if you have to be more careful than I am when it comes to computing, this is always going to be a problem, since I don't see my parents or most people I know bothering to be better informed about security. Someone doing it for the masses, targeting the worst offenders first seems like the only realistic way.

Re:One rogue program removed per month?

[therufus]

There was a java exploit that snuck this bastard in. Remember to update your Java/Flash/etc...

Re:One rogue program removed per month?

[Anonymous Coward]

4 Machines at my office got infected.

All were fully up to date, NOD32 running and updated, behind an Untangle UTM.

Now my users have local admin rights because some of the LOB applications dont work unless they have admin.

I had to slave the drives to another machine and scan and fix. What a pain in the ass.

As for "safe computing" internet access is heavily locked down... only "safe computing" is allowed. Explain that one?

Re:One rogue program removed per month?

[Blakey Rat]

Java is full of security holes. I got the Vundo/Virtumonde virus from a Java exploit. I've vowed never to put Java on another machine, any software that wants to use it can just go to hell as far as I'm concerned.

Re:One rogue program removed per month?

[MemoryDragon]

Depends on the java, most java viruses i have seen have targetted the microsoft platform. I have yet to see a direct Sun VM exploit. It is not that easy to sneak a program in, all java applets are sandboxed and need additional user permission to access limited system resources (like being able to store files)
also there is no direct way to achieve buffer overflows, since you cannot do them on language level due to bounds checking!
All you can do is to trigger one on C level which is hard to reach since 99% of the VM is written in java itself.
But that does not say it is fully secure, there are security flaws fixed from time to time, but it is definitely not as insecure as you mention it. On the other hand if you meant javascript instead or the Microsoft VM then this is a different ballpark!

I used to think this way too

[PIPBoy3000]

I recently felt that same way, that it was mostly due to people downloading weird stuff. Then I browsed a cached version of a Google page, which launched some JavaScript and completely destroyed my install of Windows Server 2003 (it wouldn't boot up at all). Afterwards I switched my home browsing to Firefox with NoScript and AdBlock Plus.

Fast forward to work a couple weeks ago, running IE7, Norton Anti-Virus, and the typical corporate firewalls. All I did was have a pop-up ad from a boring site and my computer was infected through the IE 7 vulnerability.

I think what has to happen is that browsers have to be locked down and sandboxed to the point where external sources have no access to the inner workings of a machine. Otherwise there's simply too much risk with ordinary browsing.

Re:I used to think this way too

[Bert64]

Indeed, the browser should be totally sandboxed...

But then look at some of the "ssl vpn" products currently being sold, which try to install a kernel level driver via the web browser... The mere idea is insane.

what this really says..

[purpleraison]

This is more a comment about people not wanting to pay significant sums of money on an annual basis to the antivirus companies.

Quite honestly, I never had a concern about this until I had to install AV software on 7 computers.

It's bad enough they nail you for $30 to $90 for software, but then next year they want you to fork it over again.

We would all be better served if free antivirus software became the mainstream, and costly software for corporate use. Sure, AVG is alright, but with Windows being so crappy, why isn't serious antivirus/anti-trojan software distributed with it instead of trial-ware Symantec?

Re:what this really says..

[Chabo]

Most people DO run AV software, and every machine I fixed that was infected with this malware had AV software installed and updated.

Re:what this really says..

[wap911]

Not sure if you are young or just need to get of SD and pay attention.

The USoA was over taken years ago.
Welcome to the United Corporations and Churches of America.
Where the *real product* is the Stock and
the *true customer* is the Stock Holder.

Corporations have a legal obligation to increase share holder value.

If you want of the money-go-round then have a look at lists.thedatalist.com, everything is "what is says it is". If it says installing Google ToolBar that is fine - sneaking it is not.
Some is free, some is share, some is pay.
It up to you.

Re:what this really says..

[Anonymous Coward]

Norton products don't count as AV software.

Speaking as someone whose removed this junk from two computers with Norton's overpriced bloatware installed

Re:what this really says..

[Barny]

Have not seen an AV yet that stops this, their attack vector is browser and java 0day exploits usually, and they almost never fail to re-infect within a month unless you grab the user firefox and no-script and educate them in their use :)

Re:what this really says..

[earlymon]

Here's your solution to the $ drain for AV: http://www.avast.com/eng/avast_4_home.html

An earlier poster already mentioned that Avast! did very well with the problem at hand.

Haha

[Anonymous Coward]

I find it incredibly funny that the same people offering this rouge application are now offering a remover, which has even more malware and crap in it.

Had to rename the install file of malewarebytes

[billius]

I had to remove this off of my uncle's computer over Thanksgiving. I thought I had succeeded but then I heard Howie Mandel's disembodied voice shilling for buy.com, a clear signal that some more work needed to be done. It's a tenacious little sucker; I ended up downloading Malwarebytes and having to rename the install file. I guess it recognized it and was blocking it.

A lack of software freedom should trouble everyone

[jbn-o]

There's no way to know unless you're running free software (software you're free to inspect, share, run, and modify) to do that job.

By the same token, any proprietary software (regardless of its purported task) should be troublesome. Technically there's nothing that prevents a proprietary statistical analysis program from doing things you wouldn't want done without your full consent such as removing programs, altering files, opening a remote access point for someone, or sending information about your computer somewhere.

The faithful are numerous and clear: Apparently setting up a slick-looking website which claims that a program is trustworthy is enough to convince many people that that program won't do something bad. Even amongst what passes for technical conversation on sites like /. the religion goes unquestioned; this view prevails despite that nobody really knows what AVG, Norton, McAfee, and so many other anti-malware programs do. You'd think that at least for security software (such as what's being discussed in this thread) you'd see numerous challenges any proprietary anti-malware software (even though logically and ethically there's no reason to limit software freedom to just security tasks).

I guess it will take some more time and more hard knocks to make people understand that price and freedom aren't the same thing and that freedom encompasses (and is a lot more valuable than) price since, with freedom, all can share as they wish commercially or not. I certainly don't have the time or skill to inspect every program I use, and I certainly don't trust proprietors to tell me the real story on what their programs do. So I'm not going to choose to cut myself off from other people inspecting what they can, improving and sharing along the way.

I'm not sure how they install this

[gparent]

I mean, 2009 isn't even there yet and people think this program can exist? Pfft. I bet 80% of the infectees are car manufacturers!

Re:Malwarebytes rocks!

[Facegarden]

My girlfriend's laptop got infected before i knew this was a common virus (i just found that out) so i was searching all over. Most virus scanners and malware programs missed it (trendmicro online scanner, norton online scanner, Ad-Aware) but MalwareBytes found it all and killed it! I was so happy when it worked!
-Taylor

Our website got hit by a AV2k9 redirect issue

[pjp6259]

I'm not sure how this happened. Our personal little website (prestopnik.com), got hit by these guys. The put some redirect rules into our .htaccess file, such that if you were visiting our site from one of about 6 different domains, it redirected you to their site. We didn't see it for a long time, because we usually just visit our site directly, but if you were coming from a link in yahoo mail, or found it via google or something you got redirected.

Our hosting tech support said one of our computers was infected, but from looking online, I didn't see signs of an infection on our side, but I'm still not 100% sure what happened, and if we are clean now. I think we run on our shared machine for hosting (linux though), maybe they got in like that?

Re:Our website got hit by a AV2k9 redirect issue

[Bert64]

They may have keylogged you, and got your password to the hosting machine...
Or they could have exploited vulnerable webapps on it...
Unusual for a linux hosted website to get hit by something like this, but not unheard of. You need to make sure the machine wasn't rooted tho, and reinstall if it was.

Re:Our website got hit by a AV2k9 redirect issue

[Nethead]

I must say that was a clever way for the botters to get a transfer vector. I would have hijacked it back and pointed it to your own ad-snarfing page and get the hits for yourself :)

Re:Our website got hit by a AV2k9 redirect issue

[LackThereof]

Typically this is done via a vulnerable webapp, rather than an exploit of the underlying webserver.

Old versions of various blogging programs are particularly vulnerable - old Greymatter and MovableType versions come to mind immediately. But I imagine there are many other, smaller, niche products that are just as vulnerable but don't get the same kind of attention, so exploits can fly under the radar.

Re:Our website got hit by a AV2k9 redirect issue

[Anonymous Coward]

Unusual? Hardly.

The number of easily compromised Linux servers out there is legion. All it takes is a user installing some cheesy CMS outside of package management and never updating it.

The more nefarious elements of the Intertubes are well aware of this.

Re:Our website got hit by a AV2k9 redirect issue

[Bert64]

Part of the problem here is shared hosting boxes... Thousands of sites on one box, all it takes is for one user to install a buggy app...
And then you have the same apache process serving all the sites, so even if you can't root the box, you can still mess with the other sites too.

But in terms of spreading this kind of malware, i have predominantly seen iis servers spreading it...

I got rid of it manually

[Howitzer86]

It can be very difficult to remove. I got it from visiting a website at work. It being my work computer, I simply couldn't just take out the hard drive and scan it from another computer - and the anti virus software couldn't do it either (Clamwin, Avast, and McAfee) - though McAfee did delete a few as there were installing.

In the end what worked was Hijackthis (to find out what files were starting up with Windows), Google search (to find out about the files listed) and Unlocker (to delete the running malware files). I did everything while keeping the work computer off the internet. For internet searches I used the laptop.

Google is useful for more than just searching for websites. Every known file can be discovered. What this virus did was create files with random names Google did not know about (such as "hgGxvwvT.dll"). So, I targeted them anyway since they were created the moment I was infected. In the end, the file I had to get rid of was a file I thought I needed - PSSDNSVC.exe - but this is something you have to specify to install, and since it was created the moment I got infected, I deleted it too.

Deleting a file in use can be an interesting thing. These files were being used by Winlogon, so when I hit it with Unlocker, the computer promptly crashed. The random dll files were actually decoys about 120k in size. So I don't think they serve much function other than to confuse you or perhaps do malicious things in spite of you. These were simply replaced when I deleted them. The real source of everything was PSSDNSVC.exe, deleting that got rid of the replicating dlls.

Re:Try this instead

[NeoManyon]

I do a similar thing but i start with knoppix and use that to access and clean windows folders, then boot windows and use hijack this to see what was referenced and make sure i've got it all.

As you say this approach seems to work with pretty much everything

Re:A lack of software freedom should trouble every

[Chabo]

I like open-source software as much as the next /. user, but there are some areas in which OSS has not caught up with the proprietary market. ClamAV is a good solution for Linux, and they have a windows port, but neither one has built-in real-time protection. You can implement it with a hack, but some people like their computer to be free of duct tape.

Time for Linux

[MrJimbo]

My wife's Windows XP laptop was infected with this virus. This was her last straw. She came to me and asked if there is anything that can be done. I told her she can reduce her exposure to these pieces of malware if we were to install Linux on her laptop. It's been 5 days since we installed Ubuntu 8.10, and while there are some slight differences, she is enjoying it. I had been running Ubuntu for some time now.

Re:Time for Linux

[TheNetAvenger]

Sorry about your wife's laptop, but this doesn't happen without the user specifically installing the software.

Even on Linux, she won't be any safer if she isn't instructed not to click on crap and install it.

You would be safer running Vista, as this malware (not virus) was not able to get installed on Vista even when users told it yes. If by chance it even did get installed on Vista, it would have had limited damage compared to XP; things like redirect the web sites, turn off anti-virus etc. (Vista users basically didn't have this problem)

So you convince her to move to Vista yet?

You could also set her up as a 'user' and not let her run crap in administrator mode, and if she needs something installed, have her do the run as and actually type in the password so she knows that she is modifying the computer. (Yes on XP)

On, Vista, have her run as User as well, the password prompt is just automatic and doesn't require her to do 'run as'...

---

I love the stories of 'the last straw' and how horrible Windows is, especially when it is something users have done to themselves. If Windows or MS is guilty of anything here, is that they made Windows too easy for users and hasn't educated people enough. (Like you should have done for your spouse.)

PS She should smack the crap out of you for not explaining what to click on and what not to click on to install, especially from the internet.

Re:Time for Linux

[Anonymous Coward]

Don't make the mistake of thinking you're immune just because you don't download/install programs. I got my first and only virus in 20 years after browsing encyclopedia dramatica (using firefox). It wasn't a trojan- I didn't install/download anything at all. My browser kept getting redirected to a fake anti-virus program webpage.

Re:Time for Linux

[MemoryDragon]

The difference is to install crap you need to chmod u+x the crap and then if you do not run as admin only your local account is affected. Since Linux has no file locking backup and shadowing of accounts is rather easy...
There is no double click and then hit the ok box crapware install on linux and that is exactly what makes it more idiot proof.

Re:Time for Linux

[Anonymous Coward]

(Vista users basically didn't have this problem)

Haha, now you're defending Vista because it's obscure and not a lot of virusses target it. Isn't it ironic coming from a Windows fanboy.

Also you prove your own ignorance,

On, Vista, have her run as User as well, the password prompt is just automatic and doesn't require her to do 'run as'...

Wrong, it is called sudo and only used from a command line. Any GUI administration application under Gnome and KDE will popup a password prompt just like in Mac. Only not every few seconds and it isn't using a version of SELinux on speed which Vista security is.

You also do not mention to run Vista you have to install a new CPU and extra RAM to support all the bloatware.

--the vista anti-troll ;-)

Re:Time for Linux

[MrJimbo]

Vista wasn't an option as I did not have a license. Given the reasons my wife uses a computer (browsing, email, and word processing), Ubuntu was a fit. It did not make sense to purchase Vista for those uses when Ubuntu met her needs. I'll leave the $100 that would have been spent for the Vista license in the bank. Also, going to Linux does not eliminate all threats. If you notice in my post, I stated that it reduces the exposure. My wife is what I consider a "typical" user. Typical users do not care if they are using Windows, OS X or Linux so long as it meets their needs. For most people, its browsing, email, and word processing. Do I think Linux is going to take over the desktop world? No. Did it take over the desktop in my house? Yes it did. While you may enjoy playing tech support at home, I prefer enjoying my time off. My "internal tech support calls" have gone way down since putting the wife on Linux. All your suggestions are useful, but mixing in hints of violence (wife should smack me) makes me think negatively of you. I am sure the users you support on your company's help desk agree. PS: I don't recall stating that Windows was horrible.

Re:Time for Linux

[miknix]

Even on Linux, she won't be any safer if she isn't instructed not to click on crap and install it.

Not true. She can click on whatever ads/spam she want. The majority of viruses out there are targeted to windows.
Linux boxes are NOT capable of executing windows binaries. If she clicks one, Linux will ask you "with which program do you want to open it with?"

Linux WILL be able to execute windows binaries if you install wine (some kind of win32 API wrapper).

Even if she clicks on a virus targeted to GNU/Linux systems, she would be safe since GNU/Linux is secure BY DEFAULT. The virus would only be able to install on her user account and would be easily removable.

Learn a little more about other operating systems before instructing users to move to crapy/joke operating systems.

Re:Time for Linux

[Anonymous Coward]

Like to be beaten by parents, huh?

Re:Time for Linux

[TheNetAvenger]

All your suggestions are useful, but mixing in hints of violence (wife should smack me) makes me think negatively of you.

Whoa, it is called 'humor' - 'satire' - emphasis...

I also work in the computing world 24/7, and if you had time to respond to an article on SlashDot, you had 5min to make sure your family was secure when it comes to social security exploits.

I have yet to have a close friend or family member get infected by anything, let alone something they had to purposely install themselves. If they get it, move on, if they don't help them lock the computer down.

And although you may not agree with my 'wording', the problems your spouse had was the result of you not taking time to either explain how to avoid malware or help her lock down her computer.

It is easy to blame MS and go, "wow, last straw, linux here I come" - but it would also be like leaving your car unlocked and having your ipod stolen and then sell the car and get a new brand cause the old car was way to easy to steal stuff out of - not good logic. Ok?

I do apologize if you took my satire serious and any physical harm came to you or your spouse because I wrote that.

Re:Time for Linux

[TheNetAvenger]

The majority of viruses out there are targeted to windows

This is where your logic fails.

Ya, sure you are 'less likely', but I could write some software tonight that targets Linux Distributions, and throw it out on sites and then we will see how soon it is before Linux zealots never go for the obscurity defense again.

Already, there is an uprising of newbie techie Linux community users that have bots on their systems and are contributing to more spam and other bot crap than they realize. It is time for the old timers to educate the new generation of *nix users and explain, they are not immune.

(Windows NT was considered virus and malware safe in the 90s too, because no one used it and the viruses targeted Win9X)

Re:Time for Linux

[miknix]

Ya, sure you are 'less likely', but I could write some software tonight that targets Linux Distributions, and throw it out on sites and then we will see how soon it is before Linux zealots never go for the obscurity defense again.

1) It is not that easy, GNU/Linux distros are sufficiently different from each other which makes cross-distro virus difficult to make.
2) Also, each distro provides a secure centralized software base, which makes difficult to target a particular application.
3) There is also the user factor. Each Linux setup tend to be very user specific.
4) GNU/Linux works in a regular update basis.

Finally, your malware site logic won't work as you desire because of 1) and 3). Exploiting vulnerabilities will, actually, only work on a minimal subset of all GNU/Linux boxes.
Due to 4), known vulnerabilities are either alreay fixed or will continue in the wild for a reduced time.

Already, there is an uprising of newbie techie Linux community users that have bots on their systems and are contributing to more spam and other bot crap than they realize. It is time for the old timers to educate the new generation of *nix users and explain, they are not immune.

O'Really? And did you know that's not because of GNU/Linux viruses?
These are just GNU/Linux computers who have been "hacked" and are being used as proxies or remote shells. Most people used to Windows that moved to Linux don't realize how critical is to have a secure root and user account password. Mind you that default windows installations don't enforce account passwords.
So, I would call it "bad education" provided by Windows experience instead.

Re:Time for Linux

[MrJimbo]

All your suggestions are useful, but mixing in hints of violence (wife should smack me) makes me think negatively of you.

Whoa, it is called 'humor' - 'satire' - emphasis...

...

I do apologize if you took my satire serious and any physical harm came to you or your spouse because I wrote that.

Apparently, you have trouble understanding 'humor' - 'satire' - emphasis... as well.
Perhaps if you didn't work in the computing environment 24/7, you would understand that people skills are necessary. Perhaps you should approach your boss and ask about a 40 hour work week instead. 24/7 is unnerving for anyone. No sleep makes Jack a very irritable boy.

Also, regarding taking "5 minutes," my wife is an adult, and I warned about "what can happen." Because she is an adult, I did not restrict her. It is the "you don't have to treat people like a child" dynamic and that they accept the consequences of their actions. She chose to install something malicious. She asked for help, I gave her the options, and yes, in this case Linux "came to the rescue."

I think it just pains you because someone was converted from a Microsoft OS.

It is possible that she can introduce all those bad pieces of malware on her Linux PC. In order for her to do so, it would be like Indiana Jones going after the Holy Grail. So it is possible, but it is not very likely.

Re:Time for Linux

[MrJimbo]

The majority of viruses out there are targeted to windows

This is where your logic fails.

Ya, sure you are 'less likely', but I could write some software tonight that targets Linux Distributions, and throw it out on sites and then we will see how soon it is before Linux zealots never go for the obscurity defense again.

Actually, it is indeed a fact that most viruses out there are targeted to Windows. If you do decide to write some software tonight that targets Linux distribtions, the statement that "most viruses out that are targeted to Windows" is still factual.

Get cracking at that Linux virus though. When you get it finished, you will find that you need to provide instructions for an end-user to install it. If you like, I will be happy to provide the testing systems before you deploy that vicious Linux virus.

Re:Time for Linux

[TheNetAvenger]

) It is not that easy, GNU/Linux distros are sufficiently different from each other which makes cross-distro virus difficult to make.

Really, you want to bet on this?

How many XWindow interfaces are there, and how many would I have to target to hit all the distrobutions? If I wrote one virus targeting KDE and GNOME how many distributions do you think I would get? 99%?

Viruses and Malware only have to target one API on a platform, NOT THE KERNEL. In fact 99.99999% of viruses/malware on Windows, target Win32 and never even attempt to touch the NT kernel.

Due to 4), known vulnerabilities are either alreay fixed or will continue in the wild for a reduced time.

BTW I have a bridge in Brooklyn I am selling, are you interested?

There are a lot of 'bots' running on Linux boxes around the world that got in via a remote root exploit or even a user clicking on crap or installing a tainted binary. But because the users are like you, they know it isn't them and can't possibly be happening on their boxes.

Here is just one area that made a little news in the past year... Go research college records being hacked/stolen off of UNIX servers.

Even Berkley was hacked a year ago exposing tons of student data, and the servers that were hacked via an 'unknown' exploit using a 'bot' were OpenBSD (Not OSX, Not FreeBSD, Not even Linux) - Yes they were OpenBSD.

It is the unknowns that get ya, and this is one area the trapping development tools MS is using is giving them an edge over human error in the OSS world that depends on peer review and the peers being smart enough to sense a hole in the code.

The OSS world should do a MS style 'reboot' and adopt some new standards for development tools that don't depend on peer review as much as they do now. It couldn't hurt.

Re:Time for Linux

[TheNetAvenger]

Apparently, you have trouble understanding 'humor' - 'satire' - emphasis... as well.

I can see you are still on this subject. It reminds me of statement I read recently:
"A consistent trait of sociopaths is their inability to get or understand satire."

At least I now know what type of person I am dealing with...
*Gulp*

I hope your wife loves her Linux laptop, you really did her a favor by getting rid of that evil Windows for her.

My best wishes go out to you!

Have a nice day...

Re:Time for Linux

[miknix]

How many XWindow interfaces are there, and how many would I have to target to hit all the distrobutions? If I wrote one virus targeting KDE and GNOME how many distributions do you think I would get? 99%?

FAIL
Vulnerabilities are found on IMPLEMENTATIONS not the API itself. Furthermore, there are zilions of different implementations for the same API of FOOBAR software in the opensource community. Even the API changes across software versions.
Each distro also provides different stabilized software versions with their own "hot" patches.

There are a lot of 'bots' running on Linux boxes around the world that got in via a remote root exploit or even a user clicking on crap or installing a tainted binary. But because the users are like you, they know it isn't them and can't possibly be happening on their boxes.

STOP!
Don't make wrong assumptions about me based on a couple of /. posts. You attitude is arrogant, so, I don't care and I won't reply any further.

Re:Time for Linux

[Anonymous Coward]

This virus/malware or something like it affected Vista as well; my fiancee's computer was crippled by it. The installation confirmation window for the malware masqueraded as an operating system warning (MS security center or whatever it's called) about a well known trojan/keylogger and instructed her to install an "antimalware" program with a name similar to Windows Defender.

The first thing that looked at all suspicious to her was when this new antimalware program said she had to register it in order to get the malware removal feature (to get rid of the alleged trojan). Luckily, she called me rather than entering her credit card number.

Re:Time for Linux

[MrJimbo]

And I, too, know what kind of person I am dealing with... all bark and no bite. I am awaiting patiently for that virus you are going to write that will cripple the Linux community.

I am reminded of a quote, too.

"I refuse to have a battle of wits with an unarmed man."

data collection

[Anonymous Coward]

The EULA for the software does ask if "you agree" during the install. This EULA includes a provision to collect and report statistical data. Microsoft's data is personally unidentifiable.

Google also does statistical analysis. As does Yahoo and most Internet companies.

I personally decline the malicious software install of the systems I maintain. I know the system is clean and infection is not probable.

I see this almost daily...

[r0bVious]

...at the Geek Squad. People honestly tell me "Hey, I got this sweet program and it says I have a million infections and all I have to do is send them like $40 to fix it. But I can't get spybot to run, tho." People + Computers = Catastrophe. "It's on the internet, so it must be legit."

This is useful for removing this and others.

[Anonymous Coward]

http://forums.majorgeeks.com/showthread.php?t=35407

Cheddarlump

[cheddarlump]

My laptop users at work got hit with this pretty hard, Symantec endpoint 12.5 didn't even wimper when they installed it. The users were particularly upset as they thought they were actually being responsible by making sure they had "all the security software updated." *slaps head* My desktop users were fine, as they don't have admin rights.. This is one huge PITA to remove, I gave up and just re-imaged for 'em.

Re:The relationship between Windows 95/98 and DOS

[adminstring]

Here's some fun trivia: Contrary to popular belief, Windows only rode on top of DOS through version 3.11. 95 and 98 only looked like they did, by optionally loading 16-bit legacy DOS drivers as part of the Windows startup process, and by providing both DOS VMs and an option to boot into DOS Mode (which actually was MS-DOS) for backwards compatibility with legacy DOS apps.

This page has a pretty good overview of Windows 95 architecture, with some diagrams that show the various OS components, none of which is a full copy of DOS that has a GUI riding on top of it as found in Windows 3.11 and earlier. Instead, there is a 32-bit kernel which uses 32-bit device drivers exclusively, unless the user installs a legacy DOS driver.

If any DOS apps are run within Windows 95, they run in their own DOS virtual machine, and if no DOS apps are running, no DOS VM is created. These VMs are similar to those in Windows NT; what is not similar to Windows NT is the ability to load DOS device drivers to support legacy hardware that had no 32-bit protected-mode driver.

Those DOS drivers almost always ran slower than 32-bit drivers and frequently caused problems, to the extent that one of the first steps in troubleshooting a Windows 95 system was to check the autoexec.bat and config.sys for unneeded DOS drivers, or simply renaming those files to get rid of the gunk.

If there really were a copy of DOS running underneath Windows 95, renaming autoexec.bat and config.sys would have removed all the device drivers, leaving you with no access to your CD-ROM drive due to a lack of MSCDEX.EXE, which is needed by all versions of DOS, including the "DOS Mode" of Windows 95.

Removing win antivirus 2009

[Pasda]

With regards to the people recommending malwarebites to remove win antivirus 2009 be warned that it does not remove the whole program. Often you are better off reinstalling.

Shouldn' this remove...?

[Anonymous Coward]

If the Malicious Software Removal Tool really worked, it would have to remove Windows from the computer!!!!!!!

Thank You

[ewhac]

I never thought I would say this without irony, but... Thank you, Microsoft.

We got this $(EXPLETIVE) $(EXPLETIVE) piece of $(EXPLETIVE) on the young one's PC, and it was an absolute bear to get rid of. I'm still not entirely sure we eradicated it. It's nice to see some bigger guns applied to the issue.

Schwab

They should...

[Tatarize]

I've encountered that crap. It's mean. It infects the security center and every time you manage to rip it apart and trash the files, security center brings it back to life and runs some more of the infected files to warn you that the software has now been disabled.

"Of course it was disabled, it's malware you ignorant piece of crap!" The problem was that Microsoft created a special place for the malware to infect so that it was way harder to dislodge than other malware. Usually hijackthis and a few scans is enough to fix anything. But, not that... nope.

I think it's one of those cases where Microsoft should pat itself on the back for fixing a tiny problem that they themselves caused. They deserve all the acclaim they get. Does anybody recall how fantastic Windows 2000 was? You'd switch from ME to 2000 and you'd be astounded! It's been up for three weeks straight without crashing!!!!

Bravo Microsoft.

Use Secunia's PSI

[rwwyatt]

It is simply the best solution I have seen on the market. I use a variety of solutions, and the best I have found so far is Spybot Search and Destroy along with PSI. I can even browse porn with Windows now... Imagine that..

Re:Use Secunia's PSI

[dataninja]

I use an Ubuntu box, see security pays now I can browse the internet for scientific material without any worries.

Depends

[Sycraft-fu]

Some do, some don't, some are configurable. A lot of companies want their tools to check in so that they can measure how widespread something is and react accordingly. For example NOD32 can be configured anywhere from submitting no information to submitting anonymous statistics as well as files it flags as potentially unsafe but can't identify. They want the information because it helps them better update their virus database and respond to new threats faster.

Also many corporate AV/AM products can do very full reporting back to the central server. They'll check in and say when they ran, what they found, where it was, etc.

Re:Depends

[Nethead]

Good reply to a oddly worded question. Had mods yesterday.. but so far, none yet today, so: Happy New Year!

In other news...

[Anonymous Coward]

Analysts predict that 400,000 PCs will be infected with Antivirus 2010.

Re:Damn!

[Nathrael]

Well, well...at least it's OVER NINE THOUSAND!!!1

Removal method

[Anonymous Coward]

Honestly, the best way is to use a boot CD with Bartpe on it and use a combination of removal tools and the Remote Registry Loader plugin to get rid of it. Then boot into safe mode and run programs like spybot to remove all of the less obvious registry entries this thing puts in. I've seen variants that leverage group policy to disable regedit, the control panel, command prompt and even the display settings window.

Yep...Ubuntu time.

[wasexton]

My daughter brought her laptop home for the holidays and was complaining that it has been very slow and unable to connect to the internet for the past few weeks. I booted and found this crap installed and tried for about 4 hours to remove this crap before discussing installing Ubuntu. I copied her documents off and installed Ubuntu and she has been happily working for the past week with no issues whatsoever. Not THE solution for everyone, but she mainly uses it for research and online social networking so there were no "linux killer" applications that I had to consider with her. The printer she has will work fine with Ubuntu. Total time to copy documents, install, and then configure the installation like she wanted was 2 hours.

how to save yourself.

[Anonymous Coward]

read NT Shell Scripting by O'really.

boot to a live dvd. (Bart's PE) and kill the bugger

after: check your head, build a good hosts file (or get MVPS) and quit clicking on the links that say free penis enlargement.

Re:The relationship between Windows 95/98 and DOS

[RyuuzakiTetsuya]

You don't *need* drivers for CDROM access in DOS. Drivers just provide an API where you can communicate with the hardware. However, if you're an application developer and you're cheeky and/or stupid, you could just code commands to the ATA device to communicate directly to the CDROM drive, which is exactly what Windows 95 does, it has it's own set of built in drivers. You can boot Win95 with out MSCDEX, or atleast, you could boot win98 with out MSCDEX.

Doesn't change the fact that the Kernel blew, or that it was complete garbage.

Re:The relationship between Windows 95/98 and DOS

[X3J11]

Try deleting the hidden system files (.SYS) in the root of your boot drive and see how far Windows 9x gets while booting.

The 9x Windows did ride on top of DOS, but replaced (and I'm using the word very loosely) DOS with its own kernel and drivers. DOS was still there, hiding in the background, but most everything was handled by the 32-bit protected mode code of 9x.

Also, there was no "virtual machine" for DOS in 9x. Windows took a snapshot of the DOS environment before it took over, and was able to present this environment to the user via V86 mode. This was, more or less, the same way Quarterdesk's DesqView software worked, except without the pretty graphics of the Windows GUI. A virtual machine implies much of the hardware is emulated, which it was not.

Renaming autoexec.bat and config.sys would have no bearing on the Windows environment because once Windows took over, it used its own .ini files and the registry to store and retrieve hardware and software configuration information.

Any drivers/TSRs run before Windows started would still be present after Windows loaded. In fact, one simple change to a single file cause Windows to not even load, booting instead to a plain old C:\ prompt. One could then later start Windows by executing WIN.COM.

Even Windows ME had DOS still hiding underneath it all. Windows versions based on the NT kernel are the only ones that did not rely on some version of MS-DOS to bootstrap Windows.

I really don't think you know what you are talking about.

Re:The relationship between Windows 95/98 and DOS

[X3J11]

Also, there was no "virtual machine" for DOS in 9x. Windows took a snapshot of the DOS environment before it took over, and was able to present this environment to the user via V86 mode. This was, more or less, the same way Quarterdesk's DesqView software worked, except without the pretty graphics of the Windows GUI. A virtual machine implies much of the hardware is emulated, which it was not.

... I knew I should have actually thought a bit harder before I posted. This is wrong, as Microsoft did refer to it as a virtual machine. I'm going to ahead and blame my bit of idiocy here on the wicked head cold I picked up a few days ago. Yeah, that's it.

All the remaining Vista installs were infected?

[Sfing_ter]

So wait, they are admitting that all the remaining Vista installs were infected by this malware?

Nice

[dataninja]

A month ago I had the pleasure of removing this piece of malware from a computer owned by "female" who actually tough it was the real thing. I have to say interface is better than some of the commercial ones out there.

more than 400000

[segagman]

what about the people like me who removed it before ms's update? Im your friendly neighborhood shade tree computer nerd who fixes puters for 12 packs and promotes linux!

just for a heads up.

[Deathlizard]

At first, we used to use Malwarebytes to clean this infection from our university laptop program, but after a while we just switched to "format and reinstall" when it came to Antivirus 2009.

Why you ask? Because in our dealings with the program, about 30-50% of the infections would also have the TDSS Rootkit embedded with the malicious package. It would hide everything from F-secure (not really surprised there), and although Malwarebytes had the best chance of getting the rootkit and the AV2009 application, it would occasionally be missed by MBAM as well.

We just felt that it was safer for the student as well as the network to start over, move their documents, and sleep well knowing that the rootkit is gone and not logging their credit card or other personal info.

Other interesting notes, most of the students had no idea how they got this. It was browser agnostic (Firefox and IE users would get it) and no specific place was ever found by us to infect a PC. I thought it was at first IM related, but some students had no IM installed. My guess it was either a Flash Ad infection or a Java Ad infection, but again I never found a source to test infection with. And people wonder why users use anti-banner systems like AdBlockplus and Spywareblaster.

Nastyware

[Anonymous Coward]

This particular piece of work goes out of its way to completely frak up a computer. Can't run antispyware on it because it finds it and disables it. It also fakes bluescreens that to the uninitiated look quite real.

I managed to get this gunk off your average family laptop by simply ctrl-alt-del and killing every process that wasn't a core windows process then zapping it properly with spybot. Even then it left a nice stain on the hard drive with a system-account only folder randomly named in system32.

Stuff like this should be prosecuted as any malicious virus writer would be. And with a definite money trail attached to this program, it shouldn't be too hard.

Increasingly accurately named series of MS apps

[alien-alien]

First there was DOS... Denial Of Service.
Then there was WinXP... "XP" is an emote-icon for dead with tongue hanging out.
Then WinCE... Read it and wince.

Now MSRT... a Malicious, Software Removal Tool (note the comma)

Re:A lack of software freedom should trouble every

[jbn-o]

The protection of your data comes from running more free software, not less. Also, I value the software for its freedom, not its features, so I'd rather work to make free software better instead of tossing aside my freedom for something else. In other words, I like powerful reliable programs too, but I'm not going to toss aside my software freedom to get it.

Sometimes protected by a rootkit

[Anonymous Coward]

I ran into two machines in the last few days with AV2009, but removing them was rather tricky because there was a rootkit present as well. Despite grabbing AVG, Spybot, Malwarebytes Antimalware, Ad-Aware, Superantispyware etc etc, half of them couldn't install/update/run. I would rename the install files, rename the .exe files, change the install path, it didn't matter. Even in safe mode the rootkit was intercepting and disabling the programs. Vicious little bugger.

Ultimately, I found the culprit to be a rootkit called TDSS. A little googling will give you all the details you need, but essentially going into Device Manager, from the menu selecting Show Hidden Devices, Non-Plug and Play Drivers, and disabling anything with TDSS in the title should solve your problem. Once it's disabled you can get your anti-spyware software to run properly.

I've been out of the tech support loop for a while, and this one made me a little nuts until I found it. Hope the clue helps somebody.

Re:Try this instead

[Barny]

I back the clients data up from a linux environment (usb stick 4tw) over the network to my file server, wipe their system, and reinstall with a slipstreamed disk that disables IE, loads firefox and no-script :P

Always works, always prevents re-infection.

Beyond Annoying

[Coopjust]

Back when it was Antivirus 2008 (and earlier) it was pretty easy to remove (relatively). Kill two processes at once via process explorer (so the tree dies and the other process doesn't revive the killed process), remove some registry and startup entries.

I just had to deal with a new version (friend's PC)- Spyware Guard 2008. What a pain in the ass. This version installed a rootkit, a device driver, locked the HOSTS file, added hidden registry entries, hidden services, parent and child services, downloading stubs to update it to stop detection...antiviruses stopped updating.

I was determined to kill it though. I got SuperAntiSpyware Free edition- free for personal use. Picked up all of the entries (rootkit, files, registry, etc.) and removed them after a reboot, no safe mode necessary. A standalone A/V scan (McAfee boot disc with latest definitions, and a rootkit scan from an OS outside of Windows) turned out clean, which impressed me.

I've also used Malwarebytes on a few PCs- very efficient and effective. I have to PayPal some money to these developers, as these two tools are great and allow even users who were decieved into running this crap to disinfect their own PCs. It also makes a techie's job much easier- a few minutes of running tools versus hours of trying to hack at the thing manually.

I hope whoever is contributing to this P.I.T.A. malware has karma bite them in the ass.

Re:Beyond Annoying

[MemoryDragon]

Actually I had to remove this crapware at a friends pc a while ago, it was nasty, booting into safe mode deleting several files deleting half a dozen registry entries scattered throughout the registry.
btw. speaking of this machine I stumbled upon another interesting piece of spyware, a meta spyware, the spyware scanner which i used (and did not want to pay for hence the manual removal) reported me a meta spyware program, a program which adds periodically other spyware onto the machine. Needless to say i had to remove about 10 trojans and this meta trojan before the machine was clean again!

Re:Beyond Annoying

[Anonymous Coward]

-1 astroturf?

Re:Beyond Annoying

[Coopjust]

Sorry, but I don't work for any security companies, nor do I know anybody that does. Just giving my opinion on two tools that save me an assload of time when I need to remove difficult malware.

Re:The relationship between Windows 95/98 and DOS

[adminstring]

The question of whether 9x "rides on top of" DOS is related to the two somewhat distinct issues of the use of DOS during the boot process, and support for DOS device drivers once Windows 95 has booted.

To me, the fact that the DOS 7 kernel IO.SYS is used to bootstrap Windows 95 does not indicate that 9x "rides on top of DOS" any more than the fact that LILO or GRUB might be used to bootstrap Linux means that Linux "rides on top of" LILO or GRUB.

The fact that legacy DOS device drivers can be loaded during the real-mode portion of the 9x boot process (but need not be kept around afterwards, and by default are not) only indicates that Windows has been designed to tolerate DOS device drivers in order to provide backwards compatibility.

This is a big difference between 9x and 3.x, which requires DOS drivers for sound and CDROM support. This is also the biggest difference between 9x and NT as regards DOS support - NT will not tolerate legacy DOS device drivers at all. This fact makes it perfectly clear that NT does not "ride on top of" DOS, while the fact that 9x is built to tolerate DOS drivers muddies the waters as to whether or not 9x "rides on top of" DOS. To me, the fact that these legacy drivers are not required indicates that 9x is an OS rather than a GUI, and that is the point I was getting at with the CD-ROM driver example.

Taking this reasoning a step farther, the fact that 32-bit hard disk drivers are available under Windows 3.1 leads some to consider 3.1 itself to be somewhat of an OS (or, along with DOS, one of the two components of an OS) rather than simply a GUI, because previous GUIs such as GEM for DOS had no device drivers of their own and relied entirely on DOS for driver support. There is some merit to this argument, and my take on the situation is that there isn't a clear line between GUI and OS where early versions of Windows are concerned, but rather a gradual shift from total reliance on and tolerance of DOS for bootstrapping and drivers in early versions of Windows (which were mere window managers like GEM) to a total lack of reliance on DOS code for these functions in later versions starting with NT 3.1, which first used NTLDR to begin the boot process. Windows 95's place on this spectrum is that it requires some DOS code to boot, but afterwards doesn't require any non-32-bit device drivers at all.

If, when we say that Windows 3.11 "rides on top of" DOS 6, we mean that Windows 3.11 is an application environment which takes advantage of the filesystem and driver support provided by DOS, I don't think that we can accurately say the same thing about Windows 95, which is an OS with a 32-bit kernel and some 16-bit components which uses DOS for bootstrapping but does not need any DOS filesystem or driver support once it's up and running. To me this doesn't equate to having DOS "hiding underneath" Windows 9x. It seems more accurate to me to say that Windows 9x has built-in support for DOS drivers and apps for backwards-compatibility reasons, and uses it during the boot process.

Instructed?

[Anonymous Coward]

You make it sound as if Linux is some horribly complicated OS that requires instruction. With Ubuntu, you click on Add/Remove..., install what you want and you're done.

It's only with Windows that the user is enslaved to third party repositories that may or may not be credible or authenticated. This is one of the huge selling points of Linux. I daresay no one using Linux does not know this.

Re:Instructed?

[TheNetAvenger]

You make it sound as if Linux is some horribly complicated OS that requires instruction

Nope, never hinted at it, or had it even cross my mind.

The fact that you somehow got that from my post is beyond Freudian...

skillful troll: iosys.com

[Anonymous Coward]

The io file just renamed the autoexec.bat and config.sys files, that's why you couldn't find them. A cursory examination with the Still River shell would have told you that.

This hasn't changed with XP and Vista, it's still MSDos commands that make them work. If you don't know Dos directory navigation, you're just a social worker monkey pushing buttons.

Re:The relationship between Windows 95/98 and DOS

[adminstring]

If you want the OS itself to be able to access the CDROM drive, and not just your one application, you *need* drivers for CDROM access in DOS. Hard-coding ATA CDROM support in a DOS app would have resulted in an app that didn't work with SCSI CDROM drives, and it would also be a serious case of reinventing the wheel. MSCDEX was already written, hardware manufacturers wrote device drivers to work with it, and it was the only serious choice for getting CDROM support in DOS.

Windows 95, like Windows 98, used modular, 32-bit drivers for CDROM access and generally did not require MSCDEX. If MSCDEX were present in the autoexec.bat and a matching device driver were present in the config.sys, it would be used instead of the 32-bit drivers, and this would generally degrade performance significantly as opposed to just using the proper 32-bit Windows driver. Windows 3.1, on the other hand, relied on DOS for its CDROM support, therefore it needed MSCDEX.

Re:The relationship between Windows 95/98 and DOS

[Anonymous Coward]

... but afterwards doesn't require any non-32-bit device drivers at all.

I think you've forgotten some sound card drivers... Win95 more-or-less forced the use of 16 bit sound card drivers.

OK, so ISA (the default for sound cards in '95) was a 16 bit bus, but Win95 definitely still needed 16 bit drivers. In fact, MS kinda forced the BIOS makers to break ISA PnP for sound cards, because they couldn't get the 32 bit drivers right.

The obligatory comment for the linux crowd:

[Anonymous Coward]

".... and over half of the 394,000 machines were running the linux operating system"....

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

MS AV

[Anonymous Coward]

Microsoft AV. So damn good, they had to give it for free.

Re:The relationship between Windows 95/98 and DOS

[adminstring]

Back in the day I installed plenty of ISA and PCI sound cards that didn't need 16-bit drivers under Windows 95. There were some older ISA cards that needed them, especially if they weren't popular enough to get a Microsoft-written driver, but in my experience (thousands of cases) that was the exception rather than the rule. Your mileage may have varied if you had a lot of funky old cards.

Re:A lack of software freedom should trouble every

[Raenex]

By the same token, any proprietary software (regardless of its purported task) should be troublesome. Technically there's nothing that prevents a proprietary statistical analysis program from doing things you wouldn't want done without your full consent such as removing programs, altering files, opening a remote access point for someone, or sending information about your computer somewhere.

This is what permissions are for. There's no reason some random piece of software should have full access to your sensitive files or the Internet. The answer isn't to condemn all proprietary software. The answer is to reduce the amount of software you have to trust, and to limit the damage when the trust is broken.

Quicker way:

[Anonymous Coward]

http://www.ubuntu.com/

Re:A lack of software freedom should trouble every

[jbn-o]

Without software freedom you have no idea how or if the permissions you attempt to set are being paid attention to in the way you'd want. Microsoft, for example, was known for having secret APIs to allow their apps to do things their competitors couldn't. There's no technical reason an OS proprietor's secret API couldn't grant them access to anything on the system regardless of your permissions. By contrast, implementing secret APIs in a free software OS isn't viable; any attempt runs the risk of being discovered, edited out, and competing derivatives distributed as an improvement which the community can switch to.

Re:A lack of software freedom should trouble every

[jbn-o]

As a brief addendum to my earlier comment, the most powerful reason to reject proprietary software isn't technical it's ethical; it's the most prominent dividing line between the philosophies of the free software and open source movements: how we treat one another matters. Social solidarity matters. Keeping users helpless to aid their fellows and themselves is unethical, and that's what proprietary software does because nobody but the proprietor can tell you how that proprietary program really works or grant you permission to change that program. The open source movement was defined to not raise any ethical challenge to business because that movement's proponents wish to speak to businesses, including those which make and distribute proprietary software. They want to end the conversation at software development methodology and convenience. So when faced with powerful reliable proprietary software, open source proponents will ultimately accept the software and lose their software freedom while a free software activist will reject the program and work toward making a free replacement for that program so nobody is tempted in the future: (from the aforelinked essay)

The main initial motivation for the term "open source software" is that the ethical ideas of "free software" make some people uneasy. That's true: talking about freedom, about ethical issues, about responsibilities as well as convenience, is asking people to think about things they might prefer to ignore, such as whether their conduct is ethical. This can trigger discomfort, and some people may simply close their minds to it. It does not follow that we ought to stop talking about these things.

However, that is what the leaders of "open source" decided to do. They figured that by keeping quiet about ethics and freedom, and talking only about the immediate practical benefits of certain free software, they might be able to "sell" the software more effectively to certain users, especially business.

This approach has proved effective, in its own terms. The rhetoric of open source has convinced many businesses and individuals to use, and even develop, free software, which has extended our community--but only at the superficial, practical level. The philosophy of open source, with its purely practical values, impedes understanding of the deeper ideas of free software; it brings many people into our community, but does not teach them to defend it. That is good, as far as it goes, but it is not enough to make freedom secure. Attracting users to free software takes them just part of the way to becoming defenders of their own freedom.

Sooner or later these users will be invited to switch back to proprietary software for some practical advantage. Countless companies seek to offer such temptation, some even offering copies gratis. Why would users decline? Only if they have learned to value the freedom free software gives them, to value freedom as such rather than the technical and practical convenience of specific free software. To spread this idea, we have to talk about freedom. A certain amount of the "keep quiet" approach to business can be useful for the community, but it is dangerous if it becomes so common that the love of freedom comes to seem like an eccentricity.

That dangerous situation is exactly what we have. Most people involved with free software say little about freedom--usually because they seek to be "more acceptable to business." Software distributors especially show this pattern. Nearly all GNU/Linux operating system distributions add proprietary packages to the basic free system, and they invite users to consider this an advantage, rather than a step backwards from freedom.

Proprietary add-on software and partially non-free GNU/Linux distributions find fertile ground because most of our community does not insist on freedom with its software. This is no coincidence. Most GNU/Linux users were introduced to the system by "

Re:A lack of software freedom should trouble every

[Raenex]

I'm all for open source operating systems, but even there you need a layered approach to security. With the current Linux kernel, there are millions of lines of source code that you have to trust. And that's just the kernel. There's way too much trust required in software, open source or not.

As for your addendum, I don't consider proprietary software unethical, per se. Keeping the source code secret is the most straightforward way for an author to protect his investment. Users can also enjoy the benefit of a free market. Yes, there are downsides, but I don't see proprietary software going away.

ClamAV

[Anonymous Coward]

If using Ubuntu live boot CD to get the malware off, you need Hardy or greater to write access NTFS partitions. The free ClamAV then does a great job of rooting out the malware, but boy is it slooooooooow. (It is equally slow under Windows itself.)

Re:The relationship between Windows 95/98 and DOS

[RyuuzakiTetsuya]

Just because it's a good idea doesn't make it a requirement.

Which seems to be a large majority of the philosphy behind DOS/Windows. Like proper user account security. Or a decent webbrowser. Good idea, but it's not a requirement.

I'll throw in my £0.02 worth

[FoamingToad]

Had a friend's machine in over the holidays. It would boot, get to Welcome screen, then after logging in machine would log straight back out. You weren't able to interact with the system at all.

Tried safe mode - same symptoms. Therefore I was of the opinion that it was a driver, winlogon-hooked DLL or a service that was tagged to run in safe mode.

The WinPE preinstallation environment allowed me to find/remove some of the offending parties, but still no dice. Snagged UBCD and pulled updates for all of the antivirus / antispyware tools.

Booting to UBCD got _some_ results... Spybot found a large number of nasties (including some identified as Antivirus 2009); A-Squared found some, as did AVG. Even after running all of them, the actual root cause persisted. Unfortunately, SysInternals autoruns wasn't much help, as it retrieves startup info from the currently running system, rather than of the inactive o/s (anyone know whether there's a tool that'll do this?)

Ultimately I waved the white flag and pulled out a repair install of Windows to bring the machine back up, at which point I found the culprit - a process called winlogon.exe in \windows rather than \windows\system32 and invoked via the winlogon registry keys. I kicked myself for not spotting this, but also note that none of the scanners in the UBCD (updated as of 28 Dec) were capable of identifying this as foul.

The offending file has been sent to various AV vendors in the hope that this one can be spotted in future.

Stupid User Tricks

[Anonymous Coward]

I have a coworker who has infected her computer on 4 different occasions with "Antivirus 2009" and it's variants, 2 of those occasions were on the same day.

Re:A lack of software freedom should trouble every

[jbn-o]

There is no free market with proprietary software because only the proprietor has the freedoms of free software for those programs. Only the proprietor can share copies, modify the software, or inspect what the program is doing. Nobody else is allowed to deal in Apple's MacOS X like Apple can, WordPerfect the way Corel can, or Microsoft Money the way Microsoft can. The proprietor exercises their power under copyright law to restrict you from doing these things. This has nothing to do with one's technical skill, I'm talking about legal permission and technical access to source code under a free software license. One could write alternatives (as some hackers are doing for Microsoft Windows with ReactOS) but the alternative isn't the same software even if it is 100% compatible. Free software, on the other hand, is a free market because everyone is allowed to deal in the software (even commercially) limited only by their abilities and desires. Proprietary software is what proprietors use to avoid a free market, not instantiate one. They don't want competition and they have many weapons in their arsenal to avoid competing on a neutral ground. Furthermore, "protect[ing] his investment" is nowhere near as important as society's need to organize and help one another. It's high time we stopped putting business interests ahead of our own interests as people and citizens. The most viable means to do this with computer software is to support software freedom for its own sake.

Re:A lack of software freedom should trouble every

[Raenex]

A free market must include the possibility that somebody is allowed to provide you software without source code. Society needs to function, but competition within society is part of that.

Common sense

[noppy]

uuvinehigtu.dll: status: clean

Re:The relationship between Windows 95/98 and DOS

[Anonymous Coward]

To me, the idea that Windows is riding on top of DOS is answered by one simple question.

Can you enter the DOS environment prior to loading the Windows GUI?

This was true with Windows 3.11, and was the default behavior. You typed "win" to load the win.com/win.exe which loaded the GUI.

The default behavior was changed with Windows 95, but with some configuration tweaks it could also start up to a command prompt by default, then the GUI could be entered via the long-standing method.

Also, if Windows riding on top of DOS is a function of whether it calls down to the 16-bit interface, Windows 3.11 included optional 32-bit disk access that bypassed DOS entirely. It was included due to the long delay releasing Windows 95, they basically retrofitted Win95's 32-bit disk access into Win 3.x, but it never really worked all that well.