New nasty trojan that installs a hard to remove rootkit

[DainBramaged]

TrojanDownloader:Win32/Renos.PG

TrojanDownloader:Win32/Renos.PG is a generic detection for a family of trojans that connect to certain websites in order to download arbitrary files. This may include other TrojanDownloader:Win32/Renos components, and rogue antivirus software such as Trojan:Win32/FakeSecSen or Trojan:Win32/FakeXPA.

TrojanDownloader:Win32/Renos.PG may be distributed in the wild masquerading as a video codec.


It has also been observed being downloaded to affected machines after users are prompted by fake online security scanners. See below for examples of this method of distribution being utilized in the wild:


When executed, TrojanDownloader:Win32/Renos.PG runs from its original location and modifies the registry to run the trojan downloader at each Windows start (for example):

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "MSFox" (or "Cognac")
With data: "<full pathname of Win32/Renos.PG>"

Additional registry modifications are made similar to the following example:

In subkey: HKLM\Software\Mozilla\MSFox
Sets value: Str<digit>
With data: <base64 encoded string> (for example, "x6tveq8ngbtmpknqirnnqauudxwx")

Note:These registry modifications may vary according to minor variant and the values listed may be different from those given in these examples.
Payload
Downloads and Executes Arbitrary Files
Once installed, the trojan may connect to one of a number of remote web servers from which it may download and execute other files. In the wild, we have observed servers at the following locations being contacted in this manner by TrojanDownloader:Win32/Renos.PG:

image-big-library.com
22.250.166.222
167.156.220.15
erabl-pict.com
imagerepository.com
images-base.com
the-exefiles.com
freeexefiles.com
exefileformat.com
newexefile.com

Files downloaded may include other TrojanDownloader:Win32/Renos components, and rogue antivirus software such as Trojan:Win32/FakeSecSen or Trojan:Win32/FakeXPA. TrojanDownloader:Win32/Renos.PG has also been observed downloading files and other content associated with advertising and browser redirection.

TrojanDownloader:Win32/Renos may post system information to the remote server before downloading files. The downloaded malware is generally saved to the %temp% directory, using filenames such as "~tmpa.exe".



When all was said and done, and everything in the arsenal was run to remove all of the crap it downloaded, the ONLY tool that removed it completely was Combofix



http://www.bleepingcomputer.com/combofix/how-to-use-combofix


THis one is not fun or easy to remove. I just finished cleaning a system up.


Norton or any of the anti-virus softwares will NOT remove this yet.

[hobbit709]

1. That's when I do a restore from image with Acronis.

Since NONE of my data is kept on C: drive I'm up and running again in 10 minutes. That is assuming I let something like that through in the first place.

[DainBramaged]

2. 98% of the folks here aren't experts and don't understand what or how or what you are running images

and they don't want to know, they just want their computers to start trouble free every day without having to take computer classes.

[trumad]

3. The best advice I can give to those folks

is to use Google. 9 out of 10 times there will be a solution.

Just find a good forum that discusses the problem and then a step by step of what it tells you.

[DainBramaged]

5. these new ones won't LET you even open google or a browser

Download Combofix and start it in safe mode, bets to be prepared by having it on the desktop and refreshed every couple of days.

[OwnedByFerrets]

23. +1000 on combofix

[Mojorabbit]

34. Wow I was reading the directions

and it is way over my head.

[DainBramaged]

35. Click on it and just follow the instructions it gives you

[CountAllVotes]

119. it should tell you to remove your anti virus

When you are in Safe Mode and you launch this, it conflicts with the anti virus program running. The only way to get around this is to remove the anti virus program you have installed on your computer for this to work.

I do not have this trojan luckily. I run Avira AntiVir Personal (free download) and Spybot. Nothing showed up and I ran another tool downloaded from Microsoft and that too came up with nothing.

In any event, if you plan to do this, remove the anti virus as the conflict announces itself when you try to run Combofix in the Safe Mode. :argh:

[OwnedByFerrets]

71. I truly hope you were joking. All you do is install, click on the exe and

follow the instructions. It used to be a bit more difficult, but its been made much much easier. However, ONLY ONLY ONLY use it when you have a big issue. Most smaller problems can be fixed by other means. You dont hammer a nail with a sledgehammer......unless you just must.:evilgrin:

edit: put combofix on several drives, on your desktop, on a jump drive, on a cd. If you have to get to your C drive by using safe mode, you can still use combofix.

[Mojorabbit]

75. I wasn't

I see a page full of instructions and screenshots and this
You should not run ComboFix unless you are specifically asked to by a helper. Also, due to the power of this tool it is strongly advised that you do not attempt to act upon any of the information displayed by ComboFix without supervision from someone who has been properly trained. If you do so, it may lead to problems with the normal functionality of your computer.
and


You should now press the Yes button to continue. If at any time during the Recovery Console installation you receive a message stating that it failed to install, please allow ComboFix to continue with the scan of your computer. When it is done, and a log has been created, you can then perform the manual install of the Recovery Console using the steps found in the Manually installing the Windows Recovery Console section.



and my eyes glaze over but I did not come of age with computers. I am an old fart. :)

[lildreamer316]

80. +2000

It's saved my ass several times. As well as my computer.

[trumad]

32. I should have added ---do it on another computer.

:-)

[Lucinda]

61. We've run across the problem of not being able to open browsers or known

malware fixers with this new crop of these little buggers. Bill had click.giftload recently. I think combofix is not recommended with that one, but I have heard its a good program.

Luckily I have several computers here, so I have been able to research on another machine when something happens. Tis the season.


Thanks for the headsup with this one.

[blondeatlast]

7. DB, I appreciate that, actually. No, most of us aren't experts and don't understand the

jargon. I had a problem with Mozilla Thunderbird the other day and went to the Mozilla boards and didn't understand 90% of what I was reading.

I dislike the way non-techies are often treated by those of us that aren't techies. I don't expect a sysad to write a pleading and wouldn't snub her/him for that inability. It isn't too much to expect the same from the tech department.

BTW, I fixed the MT problem myself but it wasn't as easy as it should have been (I had a couple of settings wrong).

:thumbsup:

[DainBramaged]

8. I post things like this often, KNOWING how few really understand their computers

and more often than not, others jump in and castigate you for having Windows and not having a Mac or Linux. But they are just snots, and uncaring.


This is for the thousnads here who don't get it.

[hobbit709]

10. When you deal with someone who brings their infected machine

in about once a month and you show them how to clean it and what NOT to do and they still show up on my doorstep once a month, you get pretty frustrated with them.
I occasionally hit some porn sites, I routinely hit some of the warez/cracker sites just to keep up with what they're up to and it's been years since I've been infected.
I had one guy come in 3 months in a row and each time he had disabled or uninstalled the antivirus. when I asked him why he said that he got tired of the Red Warnings flashing on his screen.
I asked him "What part of Danger, Danger, Will Robinson did he not understand"
The last time I fixed it I told him if he brought it back the same way I was going to charge double for stupid.
He didn't come back for over a year and that time it was because his DVD drive had crapped. I guess he finally learned because after I replaced the drive I did a full sweep and found nothing.

[peace4ever]

55. I tell all my friends to get a mac and forget about it

;)

[hobbit709]

64. If you got the money.

And Macs have their own limitations.

[peace4ever]

54. the safest, most reliable, and easiest to understand, is to reinstall the OS

combofix is complicated software...
http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/

[Taverner]

22. Hey - I use Acronis too!

Really helped when I migrated to an SSD boot drive

[Thunderstruck]

4. Hey DB, how do I go about finding out if my machine has this on it?

One of my machines sometimes pulls up a similar dialog box when I go to Google Images. Since you list a lot of image sites, I thought it might be connected.

[DainBramaged]

6. Download combofix to your desktop, follow instructions

run it as soon as you can.

[alfredo]

11. Is this the same one that has infected D Trump images?

[DainBramaged]

12. NO new and different, just discovered end of March.

[alfredo]

16. Would it be safer to run Windows on a VM?

One of my friends, Has a Mac and has Windows on VM.

[DainBramaged]

19. Maybe, but this is a new breed of shit, let's call it the Spring offensive

[petronius]

31. I was wondering about that - there really does seem to be a seasonal pattern,

doesn't there? As if all the spammers came out of winter hibernation and started looking around for someone to mess with. Or else they spent the long dark winter holed up writing code and it's all ready at once...

[alfredo]

33. I keep waiting for the same crap to come to my platform.

I guess it isn't "evil" enough for the kiddies. Yet.

[patrice]

9. I picked up a nasty one through Facebook. All MS Office disabled. Hoping the big patch

package, due out tomorrow, helps. If not, it's ANOTHER $100.00 to Symantec to MAYBE fix this shit.

And that's WITH my subscription to Norton all current, up, and running.

[Vehl]

13. good post!

Thanks for the info

I have noticed this fake alerts in some sites, and correctly ignored them for being the obvious Trojan download attempts they were. however many people do fall victim to these stuff.A commonly used ruse by these trojan infected/infecting sites is that they minimize the window..and pop up a "do you want to leave this page? Yes/No" option. Mot people press the "yes" abd it would download the trojan!

the best way to deal with this, is to press Ctrl+Alt+Del, which would open up the windows task manager...select the brwser program (eg if its Firefox, the program would be listed as "firefox.exe" and click "end program". This way we close the program without having to go through the fake yes/no popups.

Btw apart from a dedicated Anti-Virus tool(eg norton macafee) I would also suggest a really cool Anti malware program called malwarebytes.

Its free. and can be downloaded from the cnet downloads site. It found a few things that norton didn't.

[drm604]

14. K&R For Visibility. n/t

[mrcheerful]

15. The SO bought a new windows 7 e-machine tower and while I was asleep

she got that message and clicked ok. The damn thing took over her PC and by the time I woke up she wasn't able to do anything with her PC. She bought the damn thing at Best Buy who tried to talk her into letting the Geek Squad make her the rescue discs because it took to long for non pc knowledgeable to do it themselves. I said screw that and I made the rescue discs myself. Well, when I went to use the rescue discs for the virus I find that only 1 disc was filled with the information for rescue and the other 3 discs were blank, so now it will cost $150 for Geek Squad to restore her computer.

What killed me was when I asked her why she clicked ok, SO said that the box wouldn't let her do anything even when she clicked cancel. She said it was a warning from her anti virus software that was telling her that her anti virus protection was out of date and she had 2,638 trojan horse viruses, 6,793 missing files and a whole bunch of other crap, which anti virus soft ware doesn't fix or report. Then I noticed that it wasn't the anti virus soft ware box that was opening but a web page, I knew then that she was boned.

That is how they trick the nit wits into clicking ok, people are fooled into believing it's their anti virus soft ware giving them a warning, problem is most anti virus soft ware automatically downloads updates and will never open your web browser to warn you. The second trick it uses is it freezes the browser so you can't close the browser or go off page most people don't know that all they need to do is open the task manager and close the web browser or restart their pc.

[DainBramaged]

17. Alt +F4 stops it at first screen

if you click, it's over

[blondeatlast]

20. I just taped that to my computer and put a post-it on my son's.

Thank you for the info.

Simple enough but I had NO idea.

:thumbsup:

[ejpoeta]

30. thanks! i didn't know how to tstop it and shut off my computer once.

i clicked the x to shut it out and it started downloading i panicked and shut the computer off. damned viruses

[Cameron27]

36. Thank you!

I clicked...and my new laptop is dead, I can't even get to the welcome screen. (It looked completely legit, I thought it was a warning from Microsoft essentials.)

Going to take the damned thing to the Geeks this weekend, but I'm sending this to everyone I know right f'n now. Pisses me off.

Thank you, thank you, thank you.

[DainBramaged]

38. restart in safe mode (F8) as you boot up

try and run your virus scanner to kill the extra bits this piece of shit downloads, then follow the instructions in this thread.

[Cameron27]

42. Thanks

I'm not going to touch it though, I'll wait for my tech-savy sons to do that. I can't wait to show them your OP though, I swear they thought old mom was daft when I told them what happened.

[ChiciB1]

56. When Do You Hit F8? When It First Starts To Boot UP? I've Had To Simply

pull the plug to turn my PC off a couple of time, but I thought it was because I cleaned everything off my PC and might have installed Windows XP incorrectly? I got a message telling saying something about incorrect CPU setting and I have NO IDEA what to do!

I think I'm in big trouble. Do you think I should follow your instruction now?

Thank you.

[DainBramaged]

70. Yes

[blondeatlast]

18. We aren't nitwits, thank you very much. I bet you couldn't write

a court pleading--but that doesn't make you a nitwit. It makes you not an expert or practitioner in the same field I'm in, that's all..

[Taverner]

21. Ummm......

...

Did you find the cup holder on your computer yet?

:rofl:

[blondeatlast]

24. You're precious, you know that?

Apparently you're also one of my biggest fans...

[mrcheerful]

25. I'm talking about the nit wits that have this kind of stuff happen over and over without learning a

thing about how to keep it from happening again. I'm far from being an expert but after my third pc being ruined from these trojan horse scams I learned how to stop it from being down loaded onto my pc. SO has ruined 6 pc's from getting these viruses. In another words, I too was a nit wit until I got edumactated.

The first pc that got destroyed from a virus was a windows 3.1, then a 98 and last one was a ME. I learned the hard way, get malware software, anti virus software and learn how to protect yourself or it gets real expensive real fast. First lesson don't panic when these things pop up, visiting porn sites has risks and don't worry everyone watches some form of porn so your not the only pervert seeking porn on line, lol.

[Cobalt-60]

111. ME didnt need a virus to crash

I had that turkey on a laptop.
It was so unstable I had to use restore disks every other month.
You're right about the behavior.
As long as they keep biting at the bait that got them the first time
their machine will be infested.

[peace4ever]

57. no you are not, some computer folks have no tact or grace

:hi:

[Rebubula]

112. Jeez...

...no one was attacking you personally. Yet you respond in that way.


Well done.

[patrice]

29. My previous experience with Geek Squad: $400. and they still "had" to format my C: !!!! nt

[Egnever]

110. $400! Weeee I dont know how they get away with it.

The geeks squad is hit or miss and rarely better than a local geek. Not to mention their prices are ridiculous.

[lildreamer316]

81. Please see my post downthread..

I know you fixed it, but when this window opens on my PC all I have to do is to go to Task Manager and end iexplore.exe (obviously the bottom/root one, you know what I mean; show her) and it keeps it from installing on my comp. Has worked about ten times now when I've surfed onto bad sites. Simple and a lot easier than all this other stuff.

[dipsydoodle]

26. Apparently

to use Norton to show its presence it needs a full system scan in SAFE MODE.

Anyone know how to restart XP Pro in SAFE MODE ? I've tried pressing F8 and that does sfa.

[DainBramaged]

43. F8 during start up as the computer FIRST boots

[dipsydoodle]

44. Ta.

.

[Jamastiene]

90. Hold F8 down right after you hit the power button to turn the computer on.

Hold the F8 key down until you see the screen. If you do it that way, you will get into the screen that lets you boot into safe mode. That's the way I do it.

[nc4bo]

27. That explains it! Was googling photos of cattle/calves for a pastel painting I'm doing and

found a really nice albeit small one and when I clicked on it, Avast sent up a red flag that it contained some nasty ish - in fact, it said image host contained a trojan - gave the name of it but I got out without reading all the info but it definitely blocked all communication from that site.

I hate this crap with a passion!!!!!!!!!!!

[whathehell]

28. Hell, I thought you were talking about a condom...

just checking to see what the "rootkit" was.:evilgrin:

[DainBramaged]

37. Lines of defense

a GOOD Virus scanner (Kaspersky and Microsoft Security Essentials are my favorites)

GREAT anti-malware scanners (Malwarebytes, IObit 360, and for $20 Pareto Logic XoftspySE, those are the best)

Always back up everything precious to you onto a thumb drive, eternal drives or cd's for that matter.

[ChiciB1]

58. Does Malwarebytes Still Have A "Free" Version? I Use AVG For Viruses

but haven't downloaded a malware yet. Oh, I'm really confused... I'm so PC challenged!

[DainBramaged]

69. Yes, free Malwarebytes is available,

and in safe mode BEFORE I got the rootkit out, it got all of the other garbage the rootkit installed. But get out of AVG and into Microsoft if possible, AVG too slow and bloated.

[ChiciB1]

94. I Downloaded Malwarebytes & It Found Nothing... BUT The Place I

take my PC to tells me that AVG is THE BEST to use, all the time. Are you suggesting Norton? I was told NOT to use Norton.

I have had notices saying that my last session ended incorrectly and would I like to return to my last settings and I've always said yes, mainly because of having to UNPLUG to shut down my PC!

BTW, I only using the FREE version of AVG which may not be enough, but again have been told that THIS is the one to use. I take you at your word, but I may have other problems. I'm using a Sony three-in-one PC that was given to me, but had the techs download Microsoft Internet, but I have NO SOUND! I HAD sound until I decided to get rid of all the previous person's files and put them on hard drive of it's own. Now I'm told I need to take it in to get a another sound card installed. I checked the Sony website but they want "bucks" to help me out. Also, Microsoft wants "more bucks" than Sony to help me out.

Sorry for the late reply, some people came over and I had to leave my PC, but I did download malwarebytes and nothing was found.

I really DON'T know what is going on with this PC or really how to fix it. I think I'm in over my head using this Sony, but I did have 500 GB put on a new hard drive BEFORE I cleaned the PC. I'm ready to hook up my old PC with only 80 GB but I've already spent about $300.00 getting THIS one operable. Thought it would be much nicer, but it keeps me soooooooooo confused. AND, I don't have sound now! I also use Verizon for my internet connection.

Sorry to bother you with all this, but you DO seem to know MUCH more than I. I'll check back later today to see if you have replied. I KNOW it's not your job, I may just need to spend MORE money on this monster and take it back in. Need to go do some work right now.

Thank you!

[DainBramaged]

98. Microsoft Security Essentials

http://www.microsoft.com/en-us/security_essentials/default.aspx

[ChiciB1]

101. THANKS A LOT! And Uninstall AVG & Malwarebytes... Correct? n/t

[DainBramaged]

103. ONLY AVG, not malwarebytes

MSE will coexist with AVG until you uninstall it.

You're doing good!!!

[ChiciB1]

105. Thanks Again, You've Been A GREAT Help To Me! I'm Exhaling A Little

NOW. Maybe I'll be able to figure out how to fix some of these other glitches in time! I don't seem to have a virus though, but I'm VERY GLAD you started this thread!
:thumbsup: :hug:

[hunter]

39. I tried to watch the free movie you posted...

... but when I click on it nothing happens.

Same with your helpful anti-virus message.

I didn't understand all that other stuff you wrote. :wtf: Computer stuff is so confusing.

Are you trying to play some sort of joke on us, DainBramaged???

:shrug:

[DainBramaged]

40. It isn't a movie, just the IMAGE it puts up on your screen

And I'm sorry computer stuff isn't easy. It wasn't for me 20 years ago.

[zbdent]

41. I never had a problem uninstalling a Trojan ...

Oh, wait ... are you talking about some OTHER kind of trojan?

My bad ...

[CountAllVotes]

45. do not do this

Unless you really know :wtf: you are doing.

If you are running an anti-virus, running Spybot and clear your cache, etc. often you shouldn't have any problems unless you click on things and visit sites you shouldn't.

If you run into something asking for your permission, do not answer yes or no, simply close the box.

:kick:

[DainBramaged]

47. This is to A-L-E-R-T people to the threat and to U-N-D-E-R-S-T-A-N-D how to deal with it.

an ounce of prevention is worth a pound of cure.

[Rebubula]

113. Actually....

...closing the box does nothing. Any action installs the root kit.


You are basically screwed as soon as it appears.

[cliffordu]

46. Don't fear the penguin.........

[cleanhippie]

48. Yet ANOTHER reason I am glad I switched to a Mac.

two years, no anti-virus, no crashes, no problems. The damn thing always just works.

[DainBramaged]

49. That's not the damn point here, quit gloating

You folks just can't leave well enough alone can you?

[cleanhippie]

50. Come on now, I did not bash PC's or say anything negative about PC's at all.

Just stating a fact. No need to be jealous or angry, you can get a Mac too. Its not an exclusive club.


More pricey? A little, but like I said, the damn thing always just works.

[DainBramaged]

65. I OWN a 1 year old Mac mini, so stop being so condescending to PC owners

and I fucking bought it new, and I STILL PREFER PCs


Join my fucking ignore list, that is an exclusive club.

[cleanhippie]

77. Awww, somebawdy didn't get a visit from santa this year. Poor baby.

I can see why you get coal in your stocking.

:rofl:

[ChiciB1]

102. Just BECAUSE I Came Here To Check For I Reply, I Didn't See YOUR Info

about "the MAC" stuff! My daughter keeps telling me to trash both of my PC's and get one, BUT here's a downer about the MAC's they own. I mean she really jumps on me about this and thinks Windows is JUNK!

She is going to college and does most of her testing online, ONE PROBLEM she has is that she can't SEND some documents and/or statements they need because they don't accept it from her MAC! She AND her husband have been over here using MY PC 3 times in the last 10 days. I'm not sure exactly what the hook-up problem is, but she's really ticked because she has to come over HERE to complete certain things through Windows!

Sooooooooooooo, maybe I got the last laugh anyway! Except, half the time I can't figure out much "techie" stuff!

[999998th word]

87. I have a Mac & it has started to ?crash? -its 2 1/2 yrs old.

My son who is a tecchie gave me a pc he put together from spare parts.It worked well but I think he got tired of the calls from mom

so he recommended a mac.I dont know what I did & am reluctant to bother him but it' Kicks me off 'certain sites-Daily Kos sometimes this one.No porn-too old:)

What could I have done. I try to be careful with where I go but I'm afraid its an id10T error?

just sayin' Mac's arent infallible .

[cleanhippie]

91. No idea.

Maybe thats a problem with a Mac, the things works so well, that one never needs to learn to troubleshoot problems, then when there IS a problem, we have no idea how to fix it.

I know there are Mac forums that discuss these issues and possible fixes, a simple google search will lead you there. Good luck, and let me know if you find out what the problem is.

[peace4ever]

59. that is the primary reason i give to my friends, especially folks brand new to computers

switch to a mac, and don't worry about viruses and paying for anti virus software.

use the very easy to use time machine backup program, and forget about it.

:hi:

[DainBramaged]

66. Another preacher

bullshit

[cleanhippie]

92. Another hater

bullshit

[cleanhippie]

78. Ditto.

I just works. I wonder why that makes some people so angry?

[madokie]

51. But does it bother my linux machine?

otherwise all I can say is 'go linux'

[DainBramaged]

67. Not fair to those who aren't savvy, just not fair and frankly, insulting

[madokie]

73. Why would it be insulting

pointing out the fallacies of winblows :-)

I'm only about a year into the linux world so if I can do it anyone can. I even have autocad running on my linux box so if I can do that anyone should be able to also figure linux out.

[LLStarks]

104. Have you ever heard of a Linux rootkit? I haven't. Linux can be exploited, not infected.nt

[madokie]

106. I was basically just giving DB a hard time just cause I could. :-)

As I truly love the guy if you get what I'm saying

[Egnever]

109. Well you need to look harder perhaps? Cause they are out there.

http://packetstormsecurity.org/UNIX/penetration/rootkits

just cause you havent heard of them doesnt mean they dont exists and pretending linux or mac are not vulnerable to these things only leaves yourself wide open to them.

There is no such thiong as a 100% secure operating system and anyone that tells you there is is either lying to you or woefully missinformed.

[femmedem]

52. Thank you! n/t

[MadHound]

53. Glad I have a Mac,

Don't have to worry about this kind of crap.

[Occulus]

93. Yeah you do

Safari was hacked in about five seconds at pwn2own this year.

[forty6]

60. Questions you should have answered in your first post:

What association do you have with the folks with the ONLY FIX you have found?

Why did YOU post this here, and not someone from a reputable virus/worm fix site?

Where did you get this? What did you click on? What computer are you using, virus/worm guard, etc....operating system, and maybe your IP address, and why this, (among thousands of threats per month) were not intercepted by the ISP before they got to you?

I would like full discosure before I go further with your unique in the world WARNING!!!

[forty6]

62. By the way, everyone who knows anything about computer viruses KNOWS

norton is for fools who like to spend money to make them feel safe.

[Egnever]

107. And anyone who knows anything about computer viruses also knows what combofix is

Also Norotn isnt for fools it has detection rates that are equal to or better than a lot of other antivirus solutions while still having a low false positive rate.

It certainly isnt the best security solution out there but it is also far from the worst.


I dont think you really know much about viruses though.

[DainBramaged]

68. Re Read the OP

And I don't care if you want full disclosure, don't follow my instructions, simple. If you're scared, go do your own research.

Buh bye

[forty6]

95. Microsoft has an article about this in MARCH, 2011...which states

"Most antivirus software can detect and prevent infection by known malicious software. To help protect you from infection, you should always run antivirus software, such as Microsoft Security Essentials, that is updated with the latest signature files. For more information, see http://www.microsoft.com/windows/antivirus-partners/."

[Rebubula]

114. Word to the wise

Microsoft is full of shit and anyone that depends on their so-called protection against the constant onslaught of the Internet assholes is a fool

I use a PC and am a cheerful Mac Hater (mostly because I am a Network Admin and Mac users are the bane of my network) - but to post the MS article like it is Biblical diction is myopic.

[forty6]

117. The Biblical Truth? Hardly find that in the Bible, nor in Micro$oft..but

The date of this thread is a full month AFTER Micro$oft carried an article about this threat on their own web site. I am not defending Micro$oft, but questioning why this thread is even needed, since this threat is non-existent for people who maintain their computers with ANY reasonable degree of regularity.

To claim, as the OP does, that this threat is NOT dealt with by others is FALSE.

THAT is what I am pointing out.

[Rebubula]

116. Wow...and I though that I was paranoid.

Awesome post.


LOL...thinking DB is some sort of Spyware plant or employee of a virus company pimping his wares....awesome.


As for your question ' Why did YOU post this here, and not someone from a reputable virus/worm fix site' - this is laughable. This is a public site that many people post ideas and thoughts. Sometimes we post advice.

[yellowcanine]

63. The title really threw me for a bit as I usually associate "trojan" with condoms.

[Shagbark Hickory]

72. When are some of the solvent countries that aren't bogged down in war going to catch these fuckers?

[DainBramaged]

74. 'Bagger state of the art

[upi402]

84. That's so fail

Ha! No duct tape what.so.ever.

FAIL

[999998th word]

88. On the same site I saw someone repurpose those for bookcases.

The baggers also put a thick blue plastic tarp as a liner in the bed of their pick up truck fill it with water & instant swimming pool.

[TroubleMan]

76. Combofix is my ace in the hole.

I've used it hundreds of times.

[lildreamer316]

79. THE SECOND you get the security scan popup, end the session in Task Manager.

It's the quick and easy way to avoid it, if you have Windowz, of course.

[upi402]

83. is 'ctrl alt del' alright?

I hit the red X or just 'ctrl alt del' when I suspect a spoof popup dialog box warning. I just changed from Norton to webroot and webroot searches come up with more stuff.:shrug:

[lildreamer316]

86. DON'T click on anything. Yes;just 'ctrl alt del'.

Whenever it comes up, just don't take any chances by clicking on ANYTHING else. Immed. do the control-alt-delete and stop iexplorer.exe (if you have IE8 or up, you have to stop the 'root' iexplorer.exe; so bring up Task Manager and click on Mem Usage until the largest number is at the top; then find the lowest iexplorer.exe on the list and end it).

[6000eliot]

89. I did this because of a warning I read here.

Does this mean the rootkit didn't install itself on my brand new laptop?

[DainBramaged]

100. Yes

[madfloridian]

82. Norton Internet Security 2011 seems to pick up on it.

Here's a page from their forum. It seems they pick it up on a full scan, which they run all the time it seems to me....But they also suggest their Power Eraser. I have not had to try it as they caught mine before infection. I did not click it, just restarted, then I got their notice.

"How can I remove Misleading Applications?

You can perform a scan with your Norton product to detect and remove these applications from your computer. If the scan with latest definitions does not detect any misleading applications, we recommend that you download and run Norton Power Eraser.

DOWNLOAD NORTON POWER ERASER"

http://us.norton.com/support/kb/web_view.jsp?wv_type=public_web&docurl=v54173519_EndUserProfile_en_us

[MilesColtrane]

85. I feel your pain.

(Well, not literally.)

[mistertrickster]

96. My work computer was infected with this. Techies had to wipe the hard drive and start over.

nt

[DainBramaged]

99. It is nasty, and I have been testing it on a clean system also infected on purpose

NONE of the anti-virus software EXCEPT Kaspersky removes it completely, even my favorite Microsoft Security Essentials, and it EMAILS TO A WINDOWS LIVE EMAIL ADDRESS for new instructions. It is a terrible bot, used for creating botnets. and it seems to wait for instructions before activating. There are periods of zero CPU activity and then it will jump to 100% and network activity goes nuts. Combofix is the only free defense against it right now.

[Egnever]

108. They didnt have to... its easier.

[mistertrickster]

118. Right . . . that's what they said too . . . nt

[AlabamaLibrul]

97. I don't mean to be a shitbug,

and with all due respect to OP, perhaps I should go into the business of "repairing computers" on the software end if there are that many people constantly susceptible to this sort of thing.

It seems a lot of people are taking their computers to a corporate place for a lot more than what I could reasonably live off of if I was getting work like they are.

[Rebubula]

115. Computer Age

The advent of the Computer age was the greatest thing that ever happened to me.

I was (lol..still am in many ways) a slacker hippy with a good mind, but not a lot of motivation to become a 'suit'. I was bogged down in restaurant and retail jobs and wanted more, but had no skills for the high paid work force. Started MS and Cisco courses in 2000 and have been happily employed in the computer field since then.


Computers and the Internet are not going away and being in the support\repair side of the business will always guarantee work.

[octothorpe]

120. Guaranteed work you say?

Just wait until the GeekoTron 2015 robot is released!

It will route your packets, protect your intrusionables, crush malicious codez and much much more.