Worst case of infection I have seen

jqp · « **on:** 30 Jan 2009, 11:43 pm »

A friend complained about how badly her PC was working. She was worrie about all her pictures on the PC mostly. She said IE would not even work.

So I got the PC from her the other day. It has a rootkit and 8 trojans according to Spy Hunter. Two of the trojans are called "Security Manager" and "Spyware Defender 8" or somethig to that effect. One of them actually performs a scan and tells you you have spyware on your PC, asks if you want to send "the information" to their website

I ran the same Spy Hunter on my PC and had NOTHING

I am careful and know not to click on things that are inviting me to click

I did remove Security Manager from memory and from the registry and other files on disk. But at this point I could not get to the internet, the trojans intercepted everything! This will be a repartition and load of XP from scratch - it would take me a week to try to get it cleaned up and then it would be too risky. No telling if the bad guys are ahead of the virus detectors/spyware detectors, and rootkits are not anything to mess with.

So I am putting photos and docs I can find on a USB drive and wiping it out, putting on XP (she has the product key on the side of the case).

Anyone seen any bad infections like this lately?

timind · « **Reply #1 on:** 31 Jan 2009, 12:24 am »

Can't say I've seen any threats lately but my wife's Gateway laptop is the slowest thing I've ever seen. Wish I knew how to scrape off Vista so I could load XP pro on it. I have a good, legal copy of XP pro which I've loaded on other laptops but never encountered Vista till now.

BradJudy · « **Reply #2 on:** 31 Jan 2009, 12:28 am »

At my old work on a major university campus, the walk-in service center used to track the worst infestations by the number of pieces of malware detected by scanning tools. The record was in the hundreds on a single computer.

Crimson · « **Reply #3 on:** 31 Jan 2009, 12:29 am »

I've helped two of my friends in the past few weeks that had this nasty malware called XP Antispyware 2009 that was a bitch to remove.

orthobiz · « **Reply #4 on:** 31 Jan 2009, 12:51 am »

I've had Macs since 1988. Sorry there's so many viruses on other platforms.

biz

WGH · « **Reply #5 on:** 31 Jan 2009, 02:06 am »

Quote from: orthobiz on 31 Jan 2009, 12:51 am

I've had Macs since 1988. Sorry there's so many viruses on other platforms.

biz

OS9 reminded me of Windows 3.11, OS10 is not too bad.
Who would want to infect an inferior operating system anyway.

OK, all kidding aside my cousin had at least a couple of hundred spyware/adware programs. There was so much so much stuff loading it wouldn't boot.

Wayne

jqp · « **Reply #6 on:** 31 Jan 2009, 06:01 am »

Quote from: timind on 31 Jan 2009, 12:24 am

Can't say I've seen any threats lately but my wife's Gateway laptop is the slowest thing I've ever seen. Wish I knew how to scrape off Vista so I could load XP pro on it. I have a good, legal copy of XP pro which I've loaded on other laptops but never encountered Vista till now.

Maybe the laptop is too lightweight for Vista? Or maybe something is misconfigured?

You should be able to install XP on there - boot off the CD and partition the drive, then complete the installation. Have you called Gateway? THey may be able to help or tell you that XP would be fine for the laptop.

jqp · « **Reply #7 on:** 31 Jan 2009, 06:08 am »

Quote from: Crimson on 31 Jan 2009, 12:29 am

I've helped two of my friends in the past few weeks that had this nasty malware called XP Antispyware 2009 that was a bitch to remove.

She and her kids use this machine - she installed Limewire and downloaded who knows what, and who knows what the kids clicked on. I'm amazed that PCs like this, owned by pretty naive people, can even run with all the malware out there. We have all clicked on the wrong thing or run a file without thinking before we became more disciplined in our downloading, but there is so much more malware these days. Many people end up with multiple av programs and anti-spyware programs, which can cause real problems.

soundbitten1 · « **Reply #8 on:** 31 Jan 2009, 12:52 pm »

I was without my laptop a few days last week while it was getting some nasty viruses removed . The technician said it was a very common occurance lately . My wife said many of her co-workers had the same problem also with their pcs .

HT cOz · « **Reply #9 on:** 31 Jan 2009, 01:02 pm »

I've been running Vista Home Premium 64bit with good luck. I think the key is using high quality parts, Asus board with Intel chipset, CoreDuo, 4gb Corsair ram, Nvidia video card with directX 10 support, etc.

Now two other computers running Vista HP total Junk its on its second moboard. The second proboem comp is a high quality pre-vista amd nvidia chipset. It crashes constantly.

Moral on my story... 64 bit is better than 32 and stick with Intel and other quality components.

jmc207 · « **Reply #10 on:** 31 Jan 2009, 03:13 pm »

Quote from: HT cOz on 31 Jan 2009, 01:02 pm

I've been running Vista Home Premium 64bit with good luck. I think the key is using high quality parts, Asus board with Intel chipset, CoreDuo, 4gb Corsair ram, Nvidia video card with directX 10 support, etc.

Now two other computers running Vista HP total Junk its on its second moboard. The second proboem comp is a high quality pre-vista amd nvidia chipset. It crashes constantly.

Moral on my story... 64 bit is better than 32 and stick with Intel and other quality components.

Sorry, but what does this have to do with viruses/malware infections???

WGH · « **Reply #11 on:** 31 Jan 2009, 03:17 pm »

Once you get the machine is cleaned up, install SpywareBlaster and SpywareGuard
http://www.javacoolsoftware.com/products.html
it will help a little.

With kids involved the cleanup process will be monthly until they grow up and move out. The best solution would be to get a squeaky clean re-install, updates and programs running smoothly then image the drive. Then in a month or two when the computer slows down again re-save the personal data, replace the old OS with the saved image and copy back the personal data. The whole process would probably take less than an hour.

Wayne

avta · « **Reply #12 on:** 31 Jan 2009, 03:45 pm »

JQP:
Had you run Windows Malicious Software Removal program?

TheChairGuy · « **Reply #13 on:** 31 Jan 2009, 04:07 pm »

Quote from: timind on 31 Jan 2009, 12:24 am

Can't say I've seen any threats lately but my wife's Gateway laptop is the slowest thing I've ever seen. Wish I knew how to scrape off Vista so I could load XP pro on it. I have a good, legal copy of XP pro which I've loaded on other laptops but never encountered Vista till now.

Tim,

Vista (64) is treating me gr8....on a Gateway laptop (bought in July 2008). Don't go 'back' to XP...it's a backwards step in so many ways.

Make sure your Gateway has 4GB RAM...Vista is a resource hog and needs it. If you don't have anti-virus and anti-adware/malware programs, you need them. Fortunately, Anti-vir (antivirus) and Spyboth Search & Destroy and Spyware Blaster are free/freeware you can download.

Keep these updated, run occasional scans, make sure you have 4GB RAM installed and make sure you have any Security updates to your operating system downloaded and your Gateway laptop should be speedy indeed. Also, make sure all of your hardware pieces have updated drivers on them...and get rid of ANY trace of Norton Anti-virus that may have come with your Gateway initially for free. It interferes with any anti-virus program you later install.

I was WAY closer to switching to MAC in 2004 (my emachines, XP equipped laptop purchase before this one) than I am now. I spent a lot of time on MAC's this time in evaluation, I didn't find the nearly 50% price gap between my Gateway and the Apple to be worthwhile, at all.

I think with Vista, Microsoft has finally made an operating system that it no longer a very poor 2nd class status to a MAC.

Seriously, I have no bone to pick with either and I'm gloriously agnostic to operating systems or brands.....but you need to optimize what you have there and I think you will be very, very pleased.

John

HT cOz · « **Reply #14 on:** 31 Jan 2009, 04:12 pm »

Someone please correct me if Im wrong but i believe the malware has to be written for the 64bit version and since the userbase is so small the hacks focus on the 32bit OS.

I could be totally wrong about this.

Lyndon · « **Reply #15 on:** 31 Jan 2009, 04:23 pm »

John,
I would respectfully disagree on Vista.
I hated it when I bought my new laptop last year, and was not about to buy another 2 megs of RAM. I bought a new HD and loaded up my XP Pro, only to find that HP were jerks about someone doing that, and wouldn't provide any support or drivers to make it all work. Then I spent two weeks of hell haunting forums and digging on the net to get the drivers that would work. My fault. But I still wouldn't want the Vista. I would have paid the $20 that a guy was asking on eprey for a disc with those darn drivers!
At work, I had some nasty malware, that had taken over my browsers, and it would redirect any search to other sites. It had also disabled Spybot and any other search and destroy programs. I had the IT guy come, and he was not very good. After an hour he announced they would come back next week and blast my HD and reload everything.
I spent a couple of hours researching the usual culprits that exhibited this, and found the backdoor to disable the malware, and clean it out of the system.
I think the newest form of Vista, x7?, might not be too bad, but it was already announced last night that there was a security hole in the beta version, and that MS was not going to patch it until the commercial version is made available in August. Good grief.

Lyndon

TheChairGuy · « **Reply #16 on:** 31 Jan 2009, 04:40 pm »

Lyndon,

I'm certainly no Mr. Softee fanboy, but I've been running computers for approximately 15 years now nearly non-stop in various businesses....and until this laptop and Vista 64, have had issues much as described. I was TOTALLY ready to go MAC 7 months ago.

I certainly became more informed on IT along the way and that has helped.....but, I truly see significant differences in Vista over the prior operating systems.

If you don't shove 4GB RAM in your Vista machine....the rest is mostly moot and you will not have good results with it. It is a power hog...give it juice and it will reward. All the rest are 'trimmings' helpful to a good operating system...as Vista is. This 'puter and my commands to it are nearly instantaneous.

Put an (Cruzer or other) Flashdrive drive/stick in and you can use ReadyBoost for additional buffer for a wee bit more speed, even, with Vista.

http://en.wikipedia.org/wiki/ReadyBoost

If you have your turntable on a shaky shelf...it'll sound like hell no matter what you do. Give your Vista machine 4GB RAM...and tweek from there

John

TONEPUB · « **Reply #17 on:** 31 Jan 2009, 04:51 pm »

Hah, here's a good one for all of you...

I run Vista on a Mac Mini native (no Parallels) and it works fine!

I needed a windows box that didn't take up a lot of space, so I bought
a Mac Mini, wiped it clean and just installed Vista as the only operating
system and it runs fantastic!

Haven't had a glitch in six months.

Weird.

jqp · « **Reply #18 on:** 31 Jan 2009, 05:28 pm »

Quote from: WGH on 31 Jan 2009, 03:17 pm

Once you get the machine is cleaned up, install SpywareBlaster and SpywareGuard
http://www.javacoolsoftware.com/products.html
it will help a little.

With kids involved the cleanup process will be monthly until they grow up and move out. The best solution would be to get a squeaky clean re-install, updates and programs running smoothly then image the drive. Then in a month or two when the computer slows down again re-save the personal data, replace the old OS with the saved image and copy back the personal data. The whole process would probably take less than an hour.

Wayne

Yeah, this machine was so bad when I got it from her that it could not connect to the internet, nor could it run AVGFree antivirus which I had installed on there some time ago.

The browser was completely hijacked, with a long line of trojans wanting to be next

These trojans will often disable the protective software on the machine, and are often written to exploit known holes in them! Part of the problem is that she apparently added new protective software from a new ISP so things were getting messy (only 1 antivirus and 1 antispy program should be on a PC at a time!) - add to that the impulsive downloading of mp3s and viral videos from God knows where by them and the neighborhood kids....

So avta , no I did not run Windows Malicious Software Removal program, which is a must do for any XP - with a rootkit I decided to repartition and reinstall. I have to get this PC back to her before it takes up all my free hours for the next month! If I could trust her to follow through and know what to do, I would have her go to one of those sites that helps you de-louse your machine using freeware tools, such as HiJackThis (CastleCops, WindowsBBS, etc). But that can take a week, too!

Last night I backed up all 10GB of her pics and music and any docs to a USB drive I had her buy. Now she has a backup drive!

Today I am repartitioning and installing XP - her key code is conveniently located on the sticker on her case. Listening to a little music

pardales · « **Reply #19 on:** 31 Jan 2009, 05:30 pm »

You know, I had this really bad rash that just would not go away.......um......whoops....wrong thread.....sorry.