Page 1 of 2

Check out this virus. Man, I'm impressed!

Posted: 30 Aug 2010, 00:18
by DAE_JA_VOO
So, my mum called me over, not knowing what the heck was going on with her PC. I got there and saw this:

Image



Now, I don't know about you guys, but at first glance, I thought that was totally legit. Then a couple of things gave it away, like, you know, explorer being open in Chrome, two HDDs being missing, the HDD label being incorrect, the documents folder having the wrong name, etc etc etc :P It all fell apart after that, but at first, it had me going.

I've seen pop-ups similar to this, I think we all have, but this one was just so, so good. I can totally see how people would fall for this sort of thing.

In case anyone's unsure - in this case, the moment you click that "Remove all" button, the server send your PC a present that keeps your 23 year old son busy for the next few hours formatting and re-installing windows :P

("present" is a euphemism for "horrible, terrible virus" :P )

Re: Check out this virus. Man, I'm impressed!

Posted: 30 Aug 2010, 00:37
by Bladerunner
I dunno about the rest, but it's fairly obvious to me that it's a scam.

It's running inside the web browser... Immediately red flags should be raised.

Re: Check out this virus. Man, I'm impressed!

Posted: 30 Aug 2010, 00:41
by DAE_JA_VOO
Bladerunner wrote:I dunno about the rest, but it's fairly obvious to me that it's a scam.

It's running inside the web browser... Immediately red flags should be raised.
Yeah, I'm aware of that. But when you sit down at a PC and you see that, full screen, it's a little different. Like I said, the moment I saw that it was in a browser, I knew that it was something malicious, but before I saw that, it looked pretty real to me.

Re: Check out this virus. Man, I'm impressed!

Posted: 30 Aug 2010, 01:48
by KALSTER
I fell for that thing once. It installed a program that could only be gotten rid of by downloading a special removal tool. Also fell for the "your the millionth visitor" thingy once. The fear of being revealed as an idiot has kept me pretty safe since then.

Re: Check out this virus. Man, I'm impressed!

Posted: 30 Aug 2010, 05:35
by Tribble
I can see how that would have someone fooled. Get a pop-up blocker asap.

Re: Check out this virus. Man, I'm impressed!

Posted: 30 Aug 2010, 08:16
by rustypup
meh... seen plenty of these... the number of users who fall for this is depressing...

Re: Check out this virus. Man, I'm impressed!

Posted: 30 Aug 2010, 08:18
by doo_much
Pity 'mum' isn't a forumite. Epic Fail would've been epic...

Re: Check out this virus. Man, I'm impressed!

Posted: 30 Aug 2010, 08:30
by Studio Touch Visagie
The big question is, how do you get to a fake antivirus websites by searching for cupcakes? And the answer is, they have selectively targeted mums and grandpa's (who will fall for the scam) cause those are probably the only ones that will search for pictures of cupcakes :lol: :wink: :wink:

Re: Check out this virus. Man, I'm impressed!

Posted: 30 Aug 2010, 10:27
by DAE_JA_VOO
Studio Touch Visagie wrote:The big question is, how do you get to a fake antivirus websites by searching for cupcakes?
Right?! This is the one thing I didn't get. My mom uses the net specifically for baking related stuff (she bakes epic cakes as a hobby), and she landed at this pop-up from a cupcake google search :|

Re: Check out this virus. Man, I'm impressed!

Posted: 30 Aug 2010, 21:30
by Belix
ah, the number of times someone at work has called me to say something along the lines of "see, i told you the company antivirus was ****, look how many viruses I have". as said, getting rid of it is a pain in the rear.

Re: Check out this virus. Man, I'm impressed!

Posted: 30 Aug 2010, 22:32
by Xiphan
I've encountered this as well, my sister had it on her machine a while back, it was fairly easy to remove but still annoying nonetheless. I remember when I opened her browser again it was still there. So long as you close the tab you can't get infected or at least shouldn't. I've also had to remove it from a work machine once. The thing is it doesn't hide itself very well, but it does make it hard to open anything as it blocks most programs from running.

With regards to how people who look at innocent things can come across this it's all exploits on weak websites. I have a friend who played around with the exploits on some websites, he would do harmless things like change the name of the song currently being played on a local radio station or add products that don't exist to an online shop for a ludicrous amount of money. He also knew how to make legit websites load then redirect to another site which is most likely what happened to your mom, she clicked a link and saw her cupcakes load then the site redirect kicked in and came to what you see above.

To be safe make sure users know what the interface for the AV you have installed looks like, then tell them if it doesn't look like that then don' click on anything or just close the browser, knowing the Alt-F4 shortcut can also help them.

Re: Check out this virus. Man, I'm impressed!

Posted: 07 Sep 2010, 08:33
by andrekruger
yip, that is a good ol trojan right there, and malwarebytes takes care of it.

:mrgreen:

Re: Check out this virus. Man, I'm impressed!

Posted: 19 Nov 2010, 23:13
by A_BULLET
I got two of them one had something with a bee and said it was some antivireus, the other was the one shown at the top.
System restore worked on them!dunno why but after sys restore i could uninstall them normally!

Re: Check out this virus. Man, I'm impressed!

Posted: 23 Nov 2010, 09:35
by chowzen
erm...get a MAC

Re: Check out this virus. Man, I'm impressed!

Posted: 23 Nov 2010, 10:26
by rustypup
Image

Re: Check out this virus. Man, I'm impressed!

Posted: 23 Nov 2010, 10:54
by Bladerunner
I've heard good things about macs from several homosexuals...

Re: Check out this virus. Man, I'm impressed!

Posted: 23 Nov 2010, 11:10
by ryanrich
Bladerunner wrote:I've heard good things about macs from several homosexuals...
Good to know you associate with several homosexuals... :lol:

Re: Check out this virus. Man, I'm impressed!

Posted: 23 Nov 2010, 11:14
by ADT
Bladerunner wrote:I've heard good things about macs from several homosexuals...

:lol: ~ LMPA

Re: Check out this virus. Man, I'm impressed!

Posted: 23 Nov 2010, 12:04
by Bladerunner
Well certainly you have nothing against homosexuals?

Re: Check out this virus. Man, I'm impressed!

Posted: 23 Nov 2010, 12:49
by ryanrich
No, but apparently you do as your statement was a clear attempt to insult Mac users by likening them to homosexuals. Allowing your computer to not be infected by a virus comes down to user prevention first and foremost and not the specific hardware or OS you're running, although obviously Windows is targeted more than Linux or Mac OS by malware attempts and viruses considering it has over 90% of the OS market share.

Re: Check out this virus. Man, I'm impressed!

Posted: 23 Nov 2010, 12:54
by DAE_JA_VOO
Bladerunner wrote:I've heard good things about macs from several homosexuals...

Wow. Just wow.

Re: Check out this virus. Man, I'm impressed!

Posted: 23 Nov 2010, 13:05
by GreyWolf
DAE_JA_VOO wrote:
Bladerunner wrote:I've heard good things about macs from several homosexuals...

Wow. Just wow.
on the one hand: shame on you BR.

on the other: ha ha ha

Re: Check out this virus. Man, I'm impressed!

Posted: 23 Nov 2010, 14:06
by Bladerunner
ryanrich wrote:No, but apparently you do...
I do not.

Re: Check out this virus. Man, I'm impressed!

Posted: 28 Nov 2010, 05:00
by Xiphan
chowzen wrote:erm...get a MAC
Right... That's why the following exists:

Image

Because Macs are the perfect example of an OS that doesn't fall victim to viruses. :roll:

Re: Check out this virus. Man, I'm impressed!

Posted: 28 Nov 2010, 11:40
by DAE_JA_VOO
Xiphan wrote:
chowzen wrote:erm...get a MAC
Right... That's why the following exists:

Image

Because Macs are the perfect example of an OS that doesn't fall victim to viruses. :roll:
The fact that an anti virus app exists for the Mac doesn't mean it's necessary. 99.9% of Mac users are "unprotected" and have never had a virus.