Antivirus 2009

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Bob Hays - 26 Sep 2008 20:52 GMT

Would someone who knows what they are doing go to:
http://www.google.com/search?hl=en&q=%22singer+sewing+machine+cabinets%22&start=
20&sa=N
and click on the link for:
CLICK HERE! ALL INFO! singers of the 1950 era
and tell me what this is all about.

What happens has nothing to do with sewing machines, what you get is a scan of your system whether you want it or not, then it wants you to install "components" for IE antivirus 2009.
The only way I found to get out of this crap without doing anything was Ctrl+Alt+Del and End everything.

Thanks

Signature

Bob
____________________________

Reply to this Message

Tom [Pepper] Willett - 26 Sep 2008 21:00 GMT

Nobody in their right mind will go there. It's simply a page that installs
malware on your computer, like you just did.

Would someone who knows what they are doing go to:
http://www.google.com/search?hl=en&q=%22singer+sewing+machine+cabinets%22&start=
20&sa=N
and click on the link for:
CLICK HERE! ALL INFO! singers of the 1950 era
and tell me what this is all about.

What happens has nothing to do with sewing machines, what you get is a scan
of your system whether you want it or not, then it wants you to install
"components" for IE antivirus 2009.
The only way I found to get out of this crap without doing anything was
Ctrl+Alt+Del and End everything.

Thanks

Signature

Bob
____________________________

Reply to this Message

Bob Hays - 26 Sep 2008 21:17 GMT

I am in my right mind and I didn't install anything, besides, unless you know in advance what they are, you are there before you know it.
I found 4 more of these links scattered out in the sewing machine links. They all start with CLICK HERE! ALL INFO!
Now I know and hopefully others will also know.

Signature

Bob
____________________________

> Nobody in their right mind will go there. It's simply a page that installs
> malware on your computer, like you just did.
[quoted text clipped - 12 lines]
>
> Thanks

Reply to this Message

PA Bear [MS MVP] - 27 Sep 2008 01:32 GMT

It's totally irresponsible of you to post such possibly dangerous links in a
public newsgroup, Bob.

> The only way I found to get out of this crap without doing anything was
> Ctrl+Alt+Del and End everything.

Nevertheless, there's a very strong chance that your machine was already
compromised at that point! =>
http://billmullins.wordpress.com/2008/07/05/xp-antivirus-2008-morphs-into-xp-ant
ivirus-2009-still-lies/

Signature

~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

> Would someone who knows what they are doing go to:
> [MUNGE].google.com/search?hl=en&q=%22singer+sewing+machine+cabinets%22&start=20&sa=N
[quoted text clipped - 10 lines]
>
> Thanks

Reply to this Message

Bob Hays - 27 Sep 2008 05:29 GMT

I did not know they were dangerous or I would not have done so ,,, that is what I was asking about.

Signature

Bob
____________________________

> It's totally irresponsible of you to post such possibly dangerous links in a
> public newsgroup, Bob.
[quoted text clipped - 19 lines]
>>
>> Thanks

Reply to this Message

PA Bear [MS MVP] - 27 Sep 2008 08:00 GMT

Now you know.

I'd recommend that you run a /thorough/ check for hijackware, including
posting your hijackthis log to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
conjuction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://aumha.net/viewforum.php?f=30, or another appropriate forum for review
by an expert in such matters, not here.**

Signature

~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

> I did not know they were dangerous or I would not have done so ,,, that is
> what I was asking about.
[quoted text clipped - 29 lines]
>>>
>>> Thanks

Reply to this Message

Touch Base - 27 Sep 2008 20:11 GMT

Malwarebytes is effective against this infection

http://www.malwarebytes.org/

Regards,
Touch Base

What happens has nothing to do with sewing machines, what you get is a scan
of your system whether you want it or not, then it wants you to install
"components" for IE antivirus 2009.
The only way I found to get out of this crap without doing anything was
Ctrl+Alt+Del and End everything.

Thanks

Signature

Bob
____________________________

Reply to this Message

Bob Hays - 27 Sep 2008 21:35 GMT

Thanks all for the advice. Immediately after leaving the site I scanned my system with Ad-Aware, CWShredder. SpyBot S&D & Malwarebytes, nothing was found except a few tracking cookies. The site itself does not appear to be dangerous as long as you do not download and install their software. All the pop ups appeared to be legitimate "Microsoft Internet Explorer Antivirus 2009" information. Being suspicious of strange things in strange places I refused to download, that is when I was sent into an endless cannot exit loop.
This all started when I needed information on Singer Sewing machine cabinets so I did a Googol search and came across the "CLICK HERE! ALL INFO! singers of the 1950 era", this was just what I needed, and away I went. I later came across 4 more of these links but with different info. after the "CLICK HERE! ALL INFO! " .
There is no telling how many more of these links are out there waiting for Googol to find them. This should be brought to the attention of someone somewhere so that counter measures can be initiated, but I don't know who or where or how.
If anyone on these forums know how to get the ball rolling you certainly have my permission to use anything I have posted or you can check out these sites for yourself.

Good luck all

Signature

Bob
____________________________

> Malwarebytes is effective against this infection
>
[quoted text clipped - 10 lines]
>
> Thanks

Reply to this Message

PA Bear [MS MVP] - 27 Sep 2008 22:11 GMT

Nevertheless, there are instances of "XP Antivirus 2008/2009" pop-ups and
embedded adverts where the target machine can be infected without clicking
on anything...or by mistakenly clicking on a false X to close the
page/pop-up! Always close such pages/pop-up windows by right-clicking on
the taskbar icon and selecting CLOSE.

> Thanks all for the advice. Immediately after leaving the site I scanned
> my
[quoted text clipped - 41 lines]
>> Bob
>> ____________________________

Reply to this Message

PA Bear [MS MVP] - 27 Sep 2008 23:11 GMT

More:

<QP>
Trojan:Win32/Antivirus2008 is a rogue security program that displays
misleading alerts regarding computer problems or falsely reports detections
of malicious files on the affected machine in order to convince users to
purchase rogue security software. It may be installed by
Trojan:Win32/Renos.D, or manually installed by a computer user.
</QP>
Source:
http://www.microsoft.com/security/portal/Entry.aspx?Name=Program:Win32/Antivirus2008

> Nevertheless, there are instances of "XP Antivirus 2008/2009" pop-ups and
> embedded adverts where the target machine can be infected without clicking
[quoted text clipped - 50 lines]
>>> Bob
>>> ____________________________

Reply to this Message