Say Anything Blog

Last week I read this on Jerry Pournelle’s computer user blog.  (In the letters section.)

    XP Antivirus 2008/2009, the nastiest piece of spyware I’ve seen in a long time. I’m starting to get several infections of it a week at work—and these include computers with up-to-date antivirus where people don’t have admin rights.

  If you hit an infected web page, it will warn you of having thousands of viruses and insist you download the software to scan for it. The software “scans” and tells you that you need to buy their cleaner. They then have your credit card number and you still have the virus. The New York Times estimated that they make about $5 million a year through these tactics.

  I’ve seen these warnings on thin clients (which are so locked down no virus could be on them), and they wouldn’t go away until you restarted. I’ve seen it turn off automatic updates and hide from antivirus software. I’ve seen it put icons on your desktop even if you don’t actually download the software (click on them and you will). It puts rootkits on your computer.

  Nasty stuff. The best cleaner is Malwarebytes from http://malwarebytes.org.  So far, that’s always cleaned it up.

The obvious advice: If you hit a web site that warns you that you have viruses, don’t download anything from there. Get out of there and scan your system with something you have reason to trust. I don’t know anything about Malwarebytes.org

I would have to say that this was certainly timely because today I had an experience just like this.  I started by noticing the warning that my Windows firewall was turned off.  I turned it back on.  Next the Windows automatic updates were off.  Then the crap hit the fan and I had multiple Firefox and Internet Explorer windows opening up on my.  Firefox blocked at least one site from opening as it was a known “attack site.”  I have no idea how I got this as I use that computer for working at home and blogging.  I haven’t been on any gaming sites nor looking at things I shouldn’t be looking at.

I never did click the install button on any of these pop up windows. 

Jeez, what to do now.  The first thing I did was turn off the radio on the computer. 

My anti virus scanner was crashing the system.  I could run Spybot, but I couldn’t update it.  It would find and fix some scary viruses but they would come right back.  It wouldn’t let me go to the AVG anti-virus site. 

So I went back and looked up this recommended anti malware software that was recommended to Jerry.  I saw that it was available as a free download from Download.com and I know that’s a reputable site so I downloaded it.  It seems to have cleared it up. 

Right now I’m running every bit of anti virus scanner I can on all of the computers I have at home.  One thing I noticed on the infected computer was that Spybot found that the Windows Security Center was disabled.  That process is still going so I hope that turns it back on.  (I was able to update Spybot by the way.)

Anyway this has been an interesting afternoon and evening.  I hope this information helps you if you run into the same problem.  I’d recommend you share this information with everyone you can so that they are at least aware of the problem before it happens to them.