Be Excellent To Each Other

This isn't affecting my computer, phew, but it is causing grief on a friend's laptop. She phoned me and blubbed some symptoms down the phone.

It says that 'realupgrade is infected' and that 'you're computer is an infected bubble' (sic). Done some google searching and sounds like some heavy shit going down, man. Anyone had experience with this? Anyway, I'm off over there now (be there in ten!) with a USB stick full of anti-virals and stuff. Hope I can eliminate this disease without, for example, destroying her laptop. I'll be operating from another friend's laptop there to keep track of any helpful advice you clever chaps and ladies might have.

She's cooking me dinner tonight while I try and fix it, so it's not all bad news.

Not this one specifically, but I got the System Tool 2011 virus yesterday* and bleepingcomputer.com recommended "Malware-byte's Anti Malware" and it sorted what Microsoft Security Essestials was unable to.


*yes, I was watching porn**
**off a site perkies once mentioned no less.

Regardless of how much you trust your browser folks, running it in Sandboxie is an excellent way to keep nasties from getting at your stuff.

So... what you're saying is "use Sandboxie to look at porn"?

Also, Pete, get ready to bed in for the night - there was a similar virus on my old man's computer a few years back (malware masquerading as AV software). Easily the most stubborn bit of a malicious software I've ever encountered. It did EVERYTHING it possibly could to prevent removal. A right bugger. Got it in the end, though. Good luck!

That, plus sites that are hosting malware without even knowing it, plus any torrents you download can sit in the sandbox so you can give them a nice scan before letting them onto your machine.

But mostly for porn, yes.

Cheers Crasty, I'll give it a whirl!

Does Sandboxie eliminate the benefits of the cache?

Nope. The exe creates the cache files as normal, it's just putting them in a virtual location within the sanbox instead of in the real cache.

I'm trying it out now. It reckons it can't virtualise the mail part of Opera, as the mailbox is too large (9mb), so we'll see what happens there.

As I've said before, I use virtual machines for most browsing purposes.

Ta mate. It did say 'System Tool' in a pop up box. It put up a new wallpaper as well full of 1's and 0's and wordage about how 'This virus will break your life' and stuff. I've asked her to bring the laptop down tomorrow evening and I'll do what I can. A question though:

In copying photos to CD and USB stick, can they carry the virus with them? Can they infect USB sticks? (Not porn photos, obv.) I'll also be copying anti-spyware stuff over to her computer using a stick of my own.

Photos, no (at least, I don't think any of the current crop out there make use of renderer vulnerabilities). There's a fair chance the virus will copy things like shortcuts, executables, and the like that are 'infected' onto any disk you insert though.

Cool, so as long as I make sure that no new files have appeared we should be okay. Phew.

Main thing to watch out for (if your own computer isn't sanitised against it) is some sort of autorun appearing on any writeable thing you insert. I have seen somethings which do a reasonable job of hiding said autorun.

Oh, then it's easy to fix. Also download rkill from bleepingcomputer which kills any system processes associated with System Tool.

Reboot in safe mode with networking. Run rkill. Run anti malware. Reboot. Fixed. Run sandboxie (hehe).

You'll know you've fixed it as on reboot the wallpaper is gone.

The only problem I had was getting the computer to restart in safe mode with networking as it wouldn't let me log off. In the end I held the power button in for a few seconds.

Also it seems the only purpose of it is to get you to pay for their fake antivirus program. It doesn't appear to spread that much.

Ta Mr Russell, have downloaded your recommended programs, will try now. Infuriatingly difficult to impress on friend how completely fucking important virus protection, for example, is. Which is weird, because in every other respect she's smarter and more sensible than me.

I still got it, and was running Microsoft Security Essentials at the time, which up til now has been top notch.

Hmm. No option for Safe Mode is coming up. Trying F8, but the only things it seems to allow is F2 (BIOS) and F12 (with the bafflingly limited choice of 1: CD Drive or 2:Hard Drive). Will google her laptop make and see if its another key now...

Argh. 'No Safe Mode start up option for Advent laptops'. Twats. Infuriating because in normal mode System Tools won't let me run the anti-virals. Think I need safe mode to even execute 'em. Is there a way of restarting the computer and forcing it to automatically go into Safe Mode without pressing keys in setup? Sort of a 'restart in safe mode' option? Even aborting boot-up in the final stages of windows loading doesn't present a 'Your computer failed to boot want to try safe mode' type thing.

http://www.avg.com/us-en/avg-rescue-cd

AVG Rescue CD. Burn the iso to a disc, boot from disc, keep pc wired to network, avg will update.

Bypasses the OS completely

Crumbs, it won't let me do anything. No System Restore, no MSConfig, hell, not even any notepad option. Claims each one is infected and cannot be run each time. Which is a lie, obv. Think I'll try and nuke the site from orbit*. I guess if I pop in an XP disc it'll give me the option.

*It's the only way to be sure.

It is, indeed, the only way to be sure. I personally never trust an infected PC again.

Bombs away!

Shit, my girlfriend's sister has got this, just logmeined to her pc running that too.

She had MSE too

I guess it's not quite as good as I'd hoped.

running malware bytes now

Malc

Just caught it again (System Tool 2011) whilst running Sandboxie.

Went to Sandboxie, clicked Delete All Files, and lo, the virus just disappeared out of the system tray.

Great suggestion Crasto.

o/

\o

Risk free porn for the win.