Be Excellent To Each Other

GJ was using her PC yesterday, when suddenly XP Antispyware 2012 appeared, and said her pc was infected with all manner of keyloggers, trojans and whatevers. From what I could find out, this was all rubbish, and the only thing wrong with her pc was that it had XP Antispyware 2012 on it. I think I've got rid of it, but my questions are:

1. Have I got rid of it, or are we in format and reinstall, just to be safe territory (from what I can see it doesn't do anything malicious, just tells you your pc is full of junk and that you need to buy this software to fix it, so unless it rears its ugly head again, I don't think it's secretly stealing all her bank details in the background)?
2. Where did it come from, and why did a running and updated Microsoft Security Essentials let it through?

I'd be tempted to run a HijackThis scan on it - it'll basically show you everything that starts up, runs in the background etc as a list so you can nose through it and remove anything that looks suspicious.



The first word of your post.

It will have come from a seemingly legitimate website. MSE will have let the message appear because it's not a virus in itself, it's just a web page made to look like a proper anti-virus warning message.

I've seen those webpage ones that say they're scanning your computer, but you can just close the tab and it's gone. This wouldn't let me browse to any sites because it said they were all untrusted, and wouldn't let me open things like regedit or a command prompt because it said they were trying to connect to the internet.

Nah. XP Antispyware 2012 isn't a 'trick you into downloading' one - it installs totally without user interaction by a drive-by exploition of a number of unpatched vulnerabilities, in most cases (IIRC) Java ones.



SANDBOXIE!

Amen.

I stand corrected.

So Goddess Jasmine's porn habit as finally caught up with her... We all said it would happen one day soon. She was warned if she was going to spend time visiting those kinds of sites she should get a Mac, but she just would not listen.

FTFZ

XP AntiSpyware 2012 sounds like complete malware then, is it doing any damage?

Just to the sanity of those of us who have to get rid of the fucker

Standard answer whenever security is breached.

Nuke from orbit, reinstall from backup

That's what it usually boils down to, yes. But we have to be seen to make an effort to remove first. Oh, yes.

It just pops up a window saying "buy me and I'll fix your computer" whenever you try and do anything. From what I can see, it's now gone, but whether it's gone, or merely gone, I don't know.

Guarantee there's also a rootkit install - selling off a machine as a compromised box that can form part of a botnet is an easy extra revenue source.

As always, like Dave says: format, reinstall.

Had a phone call at 10pm from a guy at work whose Mother-in-Law has something similar on her laptop. I remember now why I don't give my mobile number out readily.

Do a search for rkill.exe and run it in safe mode. Removes it completely. Then run Malware Malabytes (or whatever it's called-sounds similar).
I had this and cured it completely with the above.
Then run Sandboxie. Forever.

Something like this infected my brother's mate's laptop and I had the joy of fixing it via my brother (who isn't tech-savvy at all) on the phone. In the end it involved running a bit of anti-malware software in safe mode. A bollocks chore but it fixed it.

What is sandboxie?

The wife had the same issues with this stupid malware a while back. I recall posting about it. I think the Malware Malbytes thingy fixed it one time, and the other time I just told Windows to go back in time by a few weeks, and it was fine.

It's a launcher that runs your browser sandboxed so anything that goes wrong can't affect the rest of the system.

Do I get to play in the sand?

You can piss in the sand if you want. It'll still empty it out whenever you want.

apart from it isn't (as of last night) compatible with Firefox 5.

Well that's a bit shit. I wonder why not?

Well there's your problem. Stop trying to use an inferior browser.

what would you recommend, given Chrome won't run on my computer.

Get a 360.

I have been suitably nuked and am back up and running, thanks guys.

/Jazzy's PC

I suspect the process name might vary. On the laptop I was looking at it, it was kek.exe, so I killed that off, removed the actual file itself then did the usual clean up stuff and it seemed to do the trick. Ideally I'd have wiped it, but I wasn't going to spend too much time on it.

Totally read that as ‘suitably naked’.

Well it is a bit warm today...

And there's never a time to be unsuitably naked.

It still won't connect to the internet for more than two mins at a time.

*Shops for a laptop*

*hugs phone*

If it's a complete reinstall, it might be worth looking for newer network drivers.

I'm pretty sure Joans did that. It had been happening last week too.

After eventually finding out what card it was I downloaded the latest ones from the Linksys site. Wireless networking is a bit of a strange voodoo to me though I'm afraid, I used to have the same problem with my parents PC, every so often it would just point blank refuse to see any wireless networks (sometimes none at all, sometimes it would see all of them except our router), no amount of fiddling with it would fix it, it would just stop sulking and start working again after a bit. We have got another card lying around, so I might swap them over and see if that helps.

Fake edit - What she said ^^^

You need to take the technological curse of GJ's house into effect too.

I may have a spare PCI wireless card around here somewhere. For some reason, it seems like the case of my PC has some kind of odd effect on wireless round the back of my computer so I end up running a USB extension cable from the front and trailing an adaptor from that. Stupid, but it works.

It did seem to be working fine until I actually put the pc back into the desk at which point the signal strength dropped from excellent through every stage to low. Having said that, my pc in the other room permanently has no bars of signal, but works perfectly well.
I'll swap the cards later and see if it does anything, if not, I'll just drill loads of holes all over the place and run cables through the ceiling (or give up and cry).

So far the swapping of cards has worked.

*Hides drill just in case*

Unbelievable. Ten seconds after I posted the net went down again.