UKC

Tsunami Video - AVOID - virus infected

New Topic
This topic has been archived, and won't accept reply postings.
 elsewhere 30 Mar 2011
Avoid the link to a video in the thread about a Tsunami video.

It has infected a few PCs including mine.

Anybody know how to fix the problem on Windows XP?
 Luk e 30 Mar 2011
In reply to elsewhere:

I have avg. I didn't get anything.. that I know of. The video played fine... should I be worried?
 The Lemming 30 Mar 2011
In reply to elsewhere:

I've got Win 7. I'm running Windows Security Essentials, IObit 360 Security, Malware Bytes and Ccleaner and so far I haven't found any viruses, spy or even malware. However scans are still running.
OP elsewhere 30 Mar 2011
In reply to kit perry:
The video played fine but on reboot my machine is asking me to cough up cash for AVG removal.

I'm hoping somebody will know what to do.
 The Lemming 30 Mar 2011
In reply to The Lemming:

Ho and saw the vid in Firefox, if that changes things.
 PontiusPirate 30 Mar 2011
In reply to elsewhere:

The video *appears* to be a legit YouTube embed, so its more likely that the (apparently also legit) French website it was embedded into is compromised.

No issues on Safari on my Mac... except that sounds smug doesn't it! Sorry!

PP.
 James Smith 30 Mar 2011
In reply to elsewhere: while on the issue of viruses, my computer is full of them (not from the tsunami video). does anyone know any decent free (or cheap) antivirus programs that actually work instead of just saying theyv removed the virus and actually not really done much. Ive got Avira at the moment which does a half decent job of keeping them in check but itd be nice to get rid completely
OP elsewhere 30 Mar 2011
In reply to jsmith1710:
First infection after using PCs for 20 years - no idea what's happening (written from Ubuntu machine).
Kipper 30 Mar 2011
In reply to elsewhere:

Strange - I clicked on it (after seeing the first warning, just to see what happened). No sign of a problem; I've also scanned with Malwarebytes, Spybot and MSSE and they've found nothing).

Windows 7, IE.

OP elsewhere 30 Mar 2011
In reply to Kipper:
Desktop was changed and an MS AV popped up saying it was infected and I'm not sure if that's genuine AV or scam AV!
 Chris Sansum 30 Mar 2011
In reply to elsewhere:

That's what I had. It is a scam av. If you look closely the messages it gives you aren't very good English. You're lucky if you can still use your pc. I couldn't. Will have to get IT guys onto it tomorrow.
 Tyler 30 Mar 2011
In reply to elsewhere:

An immedeate and long winded way of doing it is to disconnect from the itnernet boot your machine and when it kicks off it'll prob try to run again, look in Task Manager for any processes that look suspicious and delete any running executables that look suspicious. Obviously you'll need to be sure you're not deleteing anything legit! Try loking at creation dates of the executables and the properties of them for clues.
 Chris Sansum 30 Mar 2011
In reply to elsewhere:

PS Doug: don't worry about it. My own stupid fault for clicking on a link I didn't recognise. Going to have curry & beer to make things better!
ccmm 30 Mar 2011
In reply to elsewhere:

It's a trojan virus. Better explained here, with instructions on how to get rid.

http://www.bleepingcomputer.com/virus-removal/remove-av-security-suite
 The Lemming 30 Mar 2011
In reply to Craig Mc:
> (In reply to elsewhere)
>
> It's a trojan virus. Better explained here, with instructions on how to get rid.
>
> http://www.bleepingcomputer.com/virus-removal/remove-av-security-suite

Malware Bytes gives the All-Clear. IObit Security also comes up clear however Microsoft Security Essentials is still running after an hour but I doubt it will find anything.



 The Lemming 30 Mar 2011
In reply to Craig Mc:
> (In reply to elsewhere)
>
> It's a trojan virus. Better explained here, with instructions on how to get rid.
>
> http://www.bleepingcomputer.com/virus-removal/remove-av-security-suite

Just found out that you can run the app from their site, rather than installing it.

http://secunia.com/vulnerability_scanning/online/

OP elsewhere 30 Mar 2011
In reply to Tyler:
Unfortunately task manager & command prompt are disabled - it mucks about with paths so windows doesn't find programs.
 stewieatb 30 Mar 2011
In reply to elsewhere:

My initial thought is to hook the HDD up to a second computer and scan it from there, but I'm not sure how to guarantee it won't cross-infect and f*ck the second computer up.
 The Lemming 30 Mar 2011
In reply to stewieatb:

Could all this be a coincidence because as yet, I haven't found anything nasty?
 Horse 30 Mar 2011
In reply to The Lemming:

Nor I have I. Done a full scan with AVG, nothing found. Just restarted and nothing untoward has happened.
 Chris Sansum 30 Mar 2011
In reply to elsewhere:

One thing u can do to get limited use back is to hit f8 as you reboot. You then get the option to put pc into 'safe' mode. U get limited access, but it might give u enough to start fixing the issue. I don't have any knowledge of these things; it is just the way my helpdesk told me to get some use of system prior to the IT dept having a look.
 Chris Sansum 30 Mar 2011
In reply to The Lemming:

Don't think so as 'elsewhere' has exactly the same problem as me. Might be a few other people who can't reply on the forum because their computers are locked up too. I'm typing this from my phone.
OP elsewhere 30 Mar 2011
In reply to Chris Sansum:
nothing was picked up in safe mode

in normal mode the pc is unusable, pop ups & all programs flagged as infected, looks like http://en.wikipedia.org/wiki/MSAV

i think I'll call it a day and create a linux boot CD to back up HDD before I go futher
 stewieatb 30 Mar 2011
In reply to elsewhere:

I haven't used Windows safe mode for years - can you install stuff? If so, install AVG and set it to run a boot-time scan, then reboot. It should scan the PC before the viruses are up and running to f*ck everything up.
 Dominion 31 Mar 2011
In reply to elsewhere:

> First infection after using PCs for 20 years - no idea what's happening (written from Ubuntu machine).

Can you put the hard drive from the Windows machine into your ubuntu machine?

You can get virus scanners in linux - F-Prot, and clamAV - which will scan, and identify problems, then you can rename the infected files on the windows hard drive, and then when you boot back into Windows, they shouldn't be running.

The thing with Windows - and I'll probably get sick of saying this - is that you need to have two accounts on your computer, one with Administrative privileges, that is almost never used, and one just as a normal user. And you use the normal user account for internet and email, then if that account gets broken, you can log in with the other account.

If your computer is already f*cked, it can be difficult to create a new account because some malware stops certain things from running.

If you can, with Windows 7 (or Vista) there is a way to enable the "hidden" Administrator account, which requires you to run a command prompt in the "Run as Administrator" mode.

In the command prompt you use the following commands.

(Win 7 requires this first)
net user administrator password

(where password is something more than 8 letters, has upper and lower case and a character eg Password$)


net user administrator /active:yes

which makes it active

Then on a reboot, you should get an option at the login screen to login as Administrator

If the computer just goes straight into your account without logging in, then you need to log out to get the logon screen.
 DougG 31 Mar 2011
In reply to Chris Sansum:

Thanks, Chris.

Hope you and elsewhere (and anyone else affected) manage to sort things out. Last night I downloaded Avast, ran a complete scan, and it hasn't found anything on my laptop either. I wouldn't have dreamed of posting a link if I had thought it was in any way suspicious.

Doug.
OP elsewhere 31 Mar 2011
In reply to Dominion:

Unfortunately I lazily changed my routine XP account to admin when got sick of some glitches.

If I'm going to boot into Linux to copy my documents then I might as well try F-Prot or clamAV - good idea - thanks.

HDD won't go into my Ubuntu (netbook).

I've avoided Win 7 so far as last time I looked I could only get XP drivers for my old but working printer.
OP elsewhere 31 Mar 2011
In reply to stewieatb:
I could do a microsoft malware scan in safe mode but security essentials wouldn't install in safe mode.

Somebody at work who knows a lot more about Windows suggests SpyBot installed in safe mode so that's my next step. He suggested copying my files only (not the whole infected HDD) onto my external HDD, I'll use a linux CD rather than windows safe mode for that.

Never before had malware/virus in 25(!) years of PC use so I haven't got a clue!
 fionn 31 Mar 2011
In reply to elsewhere:

I unplugged my computer, and restarted windows in safe mode with a command to system restore. As I couldn't run anything otherwise. Everything is perfect again. Give us a bell and I'll explain how I did it. I've mailed you my number.
 Dominion 31 Mar 2011
In reply to elsewhere:

> HDD won't go into my Ubuntu (netbook).

If it's a sata drive, you can get sata USB caddies or one of these

http://www.misco.co.uk/applications/SearchTools/item-details.asp?EdpNo=3993...

which will allow you to connect "bare" sata drives via usb to any computer.

If you have Win XP Pro, then - at the login screen - hit Alt-Ctrl-Del twice, then it should offer you a login where you type in the user name, rather than click a button. Type Administrator and hope you know the password, or try without one.

If Windows XP Home, you can get at the Administrator account only in Safe Mode, which you get to by hitting F8 before windows starts loading...
 Chris Sansum 31 Mar 2011
In reply to elsewhere:

Been to see our techies. Was advised to go into safe mode then download & run a piece of software called 'malware bytes'. Have left laptop with them to do this. Will let you know the outcome! Techie said it probably wasn't a virus.
 Chris Sansum 31 Mar 2011
In reply to elsewhere:

Ps he said you can download this in safe mode.
OP elsewhere 31 Mar 2011
Pity it's not a laptop so i'll have to do it myself.

It looks very much like scare ware scam - unusable PC, loads of warning & buy this software message.
OP elsewhere 31 Mar 2011
In reply to Chris Sansum:
Thanks for the info.
OP elsewhere 31 Mar 2011
In reply to Ed Boyter:
Thanks, got the email. I may be in touch.

I'm not familiar with system restore and I've not set up my PC to create system restore points (oops), so unless XP SP3 has done it for me I'm in trouble.

I'm starting to look very complacent.
 The Lemming 31 Mar 2011
In reply to elsewhere:

Has this virus only infected computers running XP, or have others who run Vista and Win 7 been infected as well?
OP elsewhere 31 Mar 2011
In reply to The Lemming:
That's what it looks like, but I can only speak for XP.
 fionn 31 Mar 2011
In reply to elsewhere:
> (In reply to Ed Boyter)
> Thanks, got the email. I may be in touch.
>
> I'm not familiar with system restore and I've not set up my PC to create system restore points (oops), so unless XP SP3 has done it for me I'm in trouble.
>
> I'm starting to look very complacent.

Cool.

It's really easy. I can talk you through it in 5 minutes.
 fionn 31 Mar 2011
In reply to The Lemming:

It infected Vista.
 Chris Sansum 31 Mar 2011
In reply to elsewhere:

IT dept removed the offending program. Can't give you the name of the program as apparently it renames itself every time it is installed. Anyway they've told me to now go into Malwarebytes and run a 'full scan'. Then when it prompts you, click 'remove selected'. They said this one keeps coming up - they had 19 people with the same problem one morning. Anyway hopefully that means they're clued-up on how to resolve. Not a virus, just a program that keeps prompting you to buy dodgy software.
 Kid Spatula 31 Mar 2011
In reply to elsewhere:

You'll have a system restore point from the last time you recieved an update to Windows. It won't be that long ago. Just do a system restore and BOOM no crappy adware.

Virus scanners won't detect this type of threat as it comes through Java. Also make sure your Java is up to date.
pasbury 31 Mar 2011
In reply to elsewhere and anyone else infected:

I can highly recommend signing up and posting on the BleepingComputer forums. You get one to one advice from volunteer techies and they are extremely thorough - guiding you through the use of some hefty anti malware software.
I had a rootkit on my machine that was redirecting my browser and installing all sorts of shite all the time. They fixed it.

Start here: http://www.bleepingcomputer.com/forums/topic34773.html

It's all free but the downside is you have to be patient after your first post as all problems are dealt with in order.
OP elsewhere 31 Mar 2011
In reply to Chris Sansum:
Sounds like a solution, thanks.
Looks like I'll be faffing with home PC this evening.
 control freak 31 Mar 2011
In reply to The Lemming:
> (In reply to elsewhere)
>
> Has this virus only infected computers running XP, or have others who run Vista and Win 7 been infected as well?

Win 7 on mine. IT here won't look at my laptop as it's not a work one, can anyone help a VERY non techie person out with what to do please as I don't understand a lot of what has been said here? Thank you.
 control freak 31 Mar 2011
In reply to elsewhere: I have exactly the same thing. AVG hasn't seen a threat but the MS virus removal tool (it's very opbvious that it's a hoax) won't go away. Annoyingly, I hadn't meant to click on the tsunami link in the first place but had opened the wrong thread...
 DougG 31 Mar 2011
In reply to control freak:

My head is hanging in shame here. So sorry, everyone.
In reply to DougG: I got the same one too. Tonight's fun task is getting rid of it. Fortunately it seems like it doesn't do horrific damage to your machine, just tries to get you to sign up to their fake software.
 control freak 31 Mar 2011
In reply to elsewhere: A huge thank you to Ed Boyter for his help just now.
 fionn 31 Mar 2011
In reply to control freak:
> (In reply to elsewhere) A huge thank you to Ed Boyter for his help just now.

Glad to help
OP elsewhere 31 Mar 2011
In reply to control freak/Ed Boyter:
Did you fix it using the system restore or was it anti-virus/malware programme?
 control freak 31 Mar 2011
In reply to elsewhere: System restore.
OP elsewhere 31 Mar 2011
In reply to control freak:
Sounds like a top tip - THANKS!
 fionn 31 Mar 2011
In reply to elsewhere:

System restore.

Although you need to do it from a start-up in safe mode, with a command.
OP elsewhere 31 Mar 2011
In reply to Ed Boyter:
Is that
%systemroot%system32restorerstrui.exe [UKC seems to strip out the slashes]
according to the instructions at
http://support.microsoft.com/kb/304449

THANKS VERY MUCH
 Ridge 31 Mar 2011
In reply to elsewhere:

Just a point to the rest, my (paid for) version of malwarebytes picked it up when I clicked the link (before this thread), so that might be worth getting if the free stuff doesn't detect it.
 The Lemming 31 Mar 2011
In reply to Kid Spatula:

> Virus scanners won't detect this type of threat as it comes through Java. Also make sure your Java is up to date.


How do I know if I have Java installed?

Just typed Java into the search box and got nothing.

Does this mean that I am not using Java?
 fionn 31 Mar 2011
In reply to elsewhere:
> (In reply to Ed Boyter)
> Is that
> %systemroot%system32restorerstrui.exe [UKC seems to strip out the slashes]
> according to the instructions at
> http://support.microsoft.com/kb/304449
>
> THANKS VERY MUCH


I entered ...

C:/windows/system32/rstrui.exe
 Toby_W 31 Mar 2011
In reply to elsewhere:

Ah so that's where that came from. Got rid of it using superantispyware and windows own virus security essentials. My java was a little out of date and it seems to exploit a weakness in the older version.

Cheers, it's always nice to know where these things come from.

Toby
 Toby_W 31 Mar 2011
In reply to Toby_W: Oh yes as someone above said do it in safe mode.

Cheers

Toby
OP elsewhere 31 Mar 2011
System restore within safe mode according instructions to
http://support.microsoft.com/kb/304449
seems to have worked to take my PC back a few days.

Thanks to Ed for pointing me in the right direction.

Looks like the AV I get from work is due to expire.

Is Microscoft Security Essentials any good?
OP elsewhere 31 Mar 2011
System restore within safe mode according instructions to
http://support.microsoft.com/kb/304449
seems to have worked to take my PC back a few days.

Thanks to Ed for pointing me in the right direction.

Looks like the AV I get from work is due to expire.

Is Microsoft Security Essentials any good?
 The Lemming 31 Mar 2011
In reply to elsewhere:

> Is Microscoft Security Essentials any good?

I'm pleased with it. The funny thing is that I can't really find any reviews or websites that actually test one AV against another to see which is Top Dog.

There probably are such inpartial sites but I can't find them. Till then, I'm sticking with Free AV.

 Dominion 31 Mar 2011
In reply to elsewhere:

> Is that
> %systemroot%system32restorerstrui.exe [UKC seems to strip out the slashes]


FYI

if you put 3 slashes in your post UKC will put one in when you submit it

Although if you preview your post, you'll have to add them back in again before submitting...

 Dominion 31 Mar 2011
In reply to The Lemming:

> How do I know if I have Java installed?


http://www.java.com/en/

 The Lemming 31 Mar 2011
In reply to Dominion:
> (In reply to The Lemming)
>
> [...]
>
>
> http://www.java.com/en/

Just tried your link and I DO NOT have Java installed, so what I've never had, I'll never miss.

And probably a reason why I did not get infected.

Cheers
 streapadair 31 Mar 2011
In reply to DougG:
> (In reply to control freak)
>
> My head is hanging in shame here. So sorry, everyone.

No need to beat yourself up, Doug (somebody'll be round to do it for you - only kidding), just one of these things.

Curiously, I clicked on the link (XP Pro, SP3, AVG free) and have had absolutely no problem. Go figure.



 Dominion 01 Apr 2011
In reply to streapadair:

> No need to beat yourself up, Doug (somebody'll be round to do it for you - only kidding), just one of these things.

It's worth pointing out that Spotify got "hacked" last week, and were delivering "malvertising" to users of their free accounts...

See http://www.bbc.co.uk/news/technology-12891182 for details, and an image of the "hard drive failure warning" that someone was on about last week that he was going to have to fix for his sister...


> Curiously, I clicked on the link (XP Pro, SP3, AVG free) and have had absolutely no problem. Go figure.

Which web browser, though?

 streapadair 01 Apr 2011
In reply to Dominion:

Firefox, Dom, second-latest version.
OP elsewhere 01 Apr 2011
In reply to streapadair:
Same OS & browser (FF 3.6ish) as me, looks like I need to change my anti-virus.

I've learnt that system restore exists and is a very good thing!

New Topic
This topic has been archived, and won't accept reply postings.
Loading Notifications...