Beware, webpage traps still live...

[stilly]

So today I found myself looking for "PPSH-41 CONVERSION" on google and I came across several cool sites that allow me to turn the ppsh41 into a 9mm with only a BARREL change out and a MAG WELL adapter! OH JOY! And the coolest part is that it uses STEN MAGS! HEY! I already have like 8 of those or something! I was going to buy an MPA side cocker but now I might go with this adapter kit instead since I can use my mags for it. Then for photos I can take out the adapter and put in the drum and look evil!

ANYWAYS, I right clicked to "open in a new tab" a page that had ppsh-41 something but I THOUGHT it was a .xx.vs site. Next thing you know I see a message pop up telling me that SAFE SHIELD has been installed! HEY WTF? BATTLE STATIONS! DIVE DIVE DIVE!

I immediately double clicked on Net Limiter and saw that my IE was taking in MASSIVE amounts of data (the program was trying to get a foothold into my system) The window popped up telling me that I was infected and stuff I ignored it and told it to close and fought with it for a few clicks then I told netlimiter to kill all connections in IE and not seeing that it did that fast enough I pulled out the cat-5 cable from my computer in the back. Then Since I had updated SPYBOT sometime last week, I ran that, did a regedit and saw that no programs were set to run anywhere (I did not want any surprises when I reboot) and I went to task manager and killed off two or three non familiar looking exe files which made the stupid little BLUE SHIELD icon leave the system tray and THEN I went back to spybot and did an immunization (some things had not been put in I guess) and then a full system scan. I went outside, came back in and saw the only thing that spybot had found was that my security center was not turned on... WTF?

So I ran CCleaner and killed all the temp files, rebooted the machine and plugged it back in and I have been clean ever since. I guess this was just a large dopey bird hitting the glass window of my PC? :\ How many more of those are out there? The LAST time this happened I was looking for a COWEL GASKET for the Jeep and some POS loser *** hat put a webpage that had a 1984 jeep cj7 cowel gasket and it was infected and I ran right to it...

Anyways, today was a different story but what I found came from about 14-17 pages into the google search...

Beware, this crap is still out there.

[Demonicspire]

Things like this happen. And there are a few answers to this. Yeah maybe it was a really stupid attack. Internet explorer has some exploit problems. the other, more sinister possibility is that its still in your system lying dormant. The sad truth is, the really good stuff can run rings around your virus scan. The worst, worst, worst stuff has about a 10% detection rate.

Its kind of funny really, you have virus software developers who rent their services to other criminals, and offer tech support and updates to keep up with antivirus software. So if someone REALLY wants in, they'll get in and stay in until you reinstall your OS. The bright side of that is that its usually automated, and they harvest so much data that the chances of your stuff specifically being abused are kind of low. I think a credit card number sells for about $1.50 on the net, not exactly a scarce commodity.

So, if you're really worried, reinstall windows. I had an annoying incident a couple of days ago with a virus that took over my grandma's computer and sent me a bugged email. I think I caught what it was, but it always makes me tense because you can never tell.

[the86d]

One method that I suggest (yet do not always do, for myself but do it all the time for others,) is to install Windows, install all drivers, then do a full image/drive backup onto another drive. You can restore this at a later date, and it won't be outdated with Adobe Reader 9.x when you restore, but will have nothing but a clean Windows install that can be updated current, and take less time to get things going, as Windows ALWAYS needs a reinstall eventually.

Clonezilla has not been used on 7 by me yet, but worked well on XP, and others...

You should never have to reinstall again if you backed up to a drive you unplug after the backup, and you can even use the smallest drive you have laying around... This will not help if you have a M/Board replacement in all cases though.

[Cowboy T]

And this is one big reason why I now use GNU/Linux (Ubuntu). Seriously, it's immune to just about all of this crap, in addition to being easy to use as Microsoft (in my experience).

[the86d]

I have a machine for a family friend, and luckily I saved an image... I don't know what people do on the Internet, but it is NOT good!

I am not a big fan of *buntu, as Slackware has always worked on everything, while *buntu has failed to even detect drives (due to chipset?) or would almost finish an install, but then fail while installing the bootloader.

[Fate]

Get a Mac.

(it had to be done).

[njineermike]

And this is one big reason why I now use GNU/Linux (Ubuntu). Seriously, it's immune to just about all of this crap, in addition to being easy to use as Microsoft (in my experience).

No, it's not. Linux has virus issuess, and there are scanners for it as well.

https://help.ubuntu.com/community/Linuxvirus

And before the "You don't really know" comments, I'm an electrical and controls engineer who spends all day, every day dealing with industrial security concerns with computers and servers that run complex control systems and data servers all reportable to the Federal Government for intrusions. There is a LOT more going on behind the scenes you are completely unaware of than you could possibly imagine.


In short, run anti-virus, run Spybot, run a registry monitor, run EVERYTHING within virtual machines, and don't trust anything you see without verification, no matter WHAT it loks like or who it's from.

[stilly]

I posted this as a warning and because it was fresh in my head and I was able to post steps that I did to take care of it so that others can see and maybe follow should it happen to them.

When it comes to asshats like this that attack the comp I have my anti-asshat armor that I put on and go remove them myself. My master system has been running since 2005 and I am NOT about to reimage it. Mainly because I have too many passwords saved, too many little items installed, too many this and thats and all that. Somewhere along the line windows has begun to store my documents BACK on the C: so an image is out of the question. This machine is a battleship with a lot of post war damage that has been fixed and it still runs.

**** the macs. (no, the mac comment did not need to be said) I doubt that I will ever run a mac since PC is my life and blood and why the hell would I ever care to run a computer where you can remove or add a stick of ram and wipe out the password?

I have my NAS based from this system and I lost the install software so I pretty much need this without spending too much time messing with it.

I am fairly certain about this POS attack being wiped out since I recognize the method and the name and I know what it does. IT was just a rogue POS that tried to get in and tell me that I was infected. I wish I remembered what the page was though so that I could go back and save the code.

I aint gonna run any linux ubuntu or any of that crap on this machine. It is too involved and I do not have the system that I can just wipe off and get something else going. What will run my netlimiter? What will run my agent? What will run my PC based games? What will run my image burner? what will run my treesize pro? What will run my acdsee and photoshop? The answer is NOT a new os.

Have fun.

[Joe]

Step 1. Don't use IE.

[NSR500]

Linux

/Thread