The Official Malware/Antivirus Thread - Need help or general advice? Read this first!

[Sure-Oz]

Originally Posted by Galileo Humpkins

For anyone still experiencing issues with Avast, I would recommend reading this blog update:

https://blog.avast.com/2011/04/11/fa...defs-110411-1/

Had the same issue with another computer I oversee earlier today. If you do a manual update of Avast, the pop-up error should disappear.

Excellent, that explains why its stopped now. Thank You.

[Bowser]

And I'm gonna take you up on your recommendation, Fish. Our desktop is relatively new, and I don't want it to get fried out.

[Fish]

If the malware has infected the machine, it may be screwing with your internet settings. Hence the malware warning when viewing the M$ site. I'd download Malwarebytes, then reboot into Safe Mode and run Malwarebytes from there. Then after you've run a complete scan in Safe Mode and hopefully removed the malware, I'd boot back up normally and run it again.

And you won't be disappointed with Malwarebytes Pro. It's worth every stinkin penny IMO....

[Sure-Oz]

My dads cpu is getting alot of avast shit too saying its blocked like js shit like 200 times...while malwarebytes was running it popped up 20 times.

running spybot, and malwarebytes in safe right now...going to dl microsoft sec. essentials next. Also spybot found and removed a browser hijacker registry on svchost or whatever.

[Fish]

Once you run Malwarebytes Pro a little while, you'll be shocked at the frequency of the attack attempts on your machine. It will pop up a little dialog box every time it blocks something harmful. Which you'll eventually have to turn the dialog box off, because it's popping up all the damn time and becomes annoying. But it serves as a good reminder of how much harmful shit is out there waiting to exploit something on your machine.

[Fish]

Also, while this thread is humming....

If you haven't upgraded Firefox >= 3.6.16, you really should do so. There was an SSL certificate authority that was recently compromised, and some legit certificates were stolen. Some of which includes login.live.com, login.yahoo.com, login.skype.com, and mail.google.com. Meaning that those pages could potentially be spoofed and you'd never know the difference, giving hackers your info.

Both Firefox and IE could be affected by this. So if you haven't updated your browser recently, DO IT NOW!

More info:

http://www.microsoft.com/technet/sec...y/2524375.mspx

http://blog.mozilla.com/security/201...-certificates/

[Sure-Oz]

Ran Malware bytes in safe along with spybot and it was clean. if i go to the cc cleaner website or microsoft security essentials avast keeps detecting that its a bad site and stops it, weird!

i got sec. essentials another way and am installing

[Sure-Oz]

Well i ran MSE as well as malwarebytes, spybot S&D and nothing has been found, no threats. I noticed now avast isnt going batshit crazy by trying to open the MSE site or CC Cleaner site. weird

[Sure-Oz]

So i guess all those false positives with avast put a bunch of .js files from the temp internet files in there, i assume its safe to leave it there? they show no viruses but there is so many of them that i can't restore all without manually selecting since some are real malware viruses from the past.

[DaFace]

On a random Avast side note, any of you ever had it lose its ability to access the internet? I got a little minor gremlin a week or so ago. I removed it immediately, and it really didn't do anything, but somewhere in the removal process something got screwy. Avast won't update, and if I turn the web shield on, all my browsers are blocked.

I've done a full uninstall/reinstall, all of the typical scanners come up clean, everything seems fine, etc. Hosts file is fine. Hijack this doesn't seem to have anything out of the ordinary. Everything works fine except that one program. I almost don't even care (it's just my media center pc), but it's got me stumped.

[chasedude]

Originally Posted by DaFace

On a random Avast side note, any of you ever had it lose its ability to access the internet? I got a little minor gremlin a week or so ago. I removed it immediately, and it really didn't do anything, but somewhere in the removal process something got screwy. Avast won't update, and if I turn the web shield on, all my browsers are blocked.

I've done a full uninstall/reinstall, all of the typical scanners come up clean, everything seems fine, etc. Hosts file is fine. Hijack this doesn't seem to have anything out of the ordinary. Everything works fine except that one program. I almost don't even care (it's just my media center pc), but it's got me stumped.

So Avast has lost the ability to access the net now?

[DaFace]

Originally Posted by chasedude

So Avast has lost the ability to access the net now?

Yup. But that's it. Everything else is peachy. I can manually update it by downloading the file from Avast, and that works fine. Scans come up clean. I can't use the web shield (since that works as a proxy that sends all HTTP communications through Avast), but that and updating are really the only issues.

[Fish]

Originally Posted by DaFace

On a random Avast side note, any of you ever had it lose its ability to access the internet? I got a little minor gremlin a week or so ago. I removed it immediately, and it really didn't do anything, but somewhere in the removal process something got screwy. Avast won't update, and if I turn the web shield on, all my browsers are blocked.

I've done a full uninstall/reinstall, all of the typical scanners come up clean, everything seems fine, etc. Hosts file is fine. Hijack this doesn't seem to have anything out of the ordinary. Everything works fine except that one program. I almost don't even care (it's just my media center pc), but it's got me stumped.

Hmmm.. That's weird.. never heard of such a thing.

You might try Avast's uninstaller app... http://www.avast.com/uninstall-utility

Usually when they release their own uninstall app, it's because the Windows one isn't sufficient in some cases. I'd uninstall through windows, then run the Avast uninstall and let it clean up anything the Windows uninstaller might have missed. Then reinstall newest version. You might try and uninstall/reinstall with another admin account too. Determine if it might be a user setting specific to your account.

[DaFace]

Originally Posted by KC Fish

Hmmm.. That's weird.. never heard of such a thing.

You might try Avast's uninstaller app... http://www.avast.com/uninstall-utility

Usually when they release their own uninstall app, it's because the Windows one isn't sufficient in some cases. I'd uninstall through windows, then run the Avast uninstall and let it clean up anything the Windows uninstaller might have missed. Then reinstall newest version. You might try and uninstall/reinstall with another admin account too. Determine if it might be a user setting specific to your account.

Yeah, I tried that. Haven't done it from safe mode, which I've seen suggested on other forums. I'll try it from a different account as well, just to say I did.

It's kind of a weird issue. It doesn't really matter that much, but it's certainly perplexing.

[Fish]

Google Image Poisoning and FakeAV attacks

FYI on Google Image Poisoning.... which is the general cause for the FakeAV popups that so many people have issues with.

These FakeAV programs are rather tricky, in that they're not easily classified, and they never work the same. Therefore, your various AV/Spyware/Malware scanners might not think that it's malicious behavior at the time of infection.

The FakeAV attacks seem to come in 3 flavors of increasing complexity:

1) "The Nag". Terminate the process and delete the file. Doesn't care that you run other programs.

2) "The Pain in the Ass". Doesn't let you run any exe because it latches into the .exe file registry keys. We have an inf that reverts the registry change, then we terminate and delete the exe.

3) "The Real Pain in the Ass". Does the same as number two, but has the additional side effect of fudging permissions all over the system. It screws them up so bad that you can't run any of your applications anymore. When computers get these, we usually just reimage them. But they can be salvaged if it's worth a bit of work to you.

If you've experienced these, here's why you got it, and here's how to prevent it in the future.

Full article: http://isc.sans.edu/diary/More+on+Go...oisoning/10822

Another very In-depth article with additional info: http://blog.unmaskparasites.com/2011...earch-results/

For last couple of weeks we received quite a bit of reports of images on Google leading to (usually) FakeAV web sites.
Google is doing a relatively good job removing (or at least marking) links leading to malware in normal searches, however, Google’s image search seem to be plagued with malicious links. So how do they do this?

The attackers compromise a number of legitimate web sites. I have noticed that they usually attack Wordpress installations, but any widely spread software that has known vulnerabilities can be exploited.
.
.
.
.
.
Now, when a user searches for something through the Google image search function, thumbnails of pictures are displayed. Depending on the automatically generated content in step 3), number of links to the web page and other parameters known to Google, the attacker’s page will be shown at a certain position in the results web page. The exploit happens when a user clicks on the thumbnail.
Google now shows a special page that shows the thumbnail in the center of the page, links to the original image (no matter where it is located) on the right and the original web site (the one that contained the image) in the background. This is where the “vulnerability” is.

The user’s browser will automatically send a request to the bad page which runs the attacker’s script (the one set in step 1). This script checks that the request’s referrer field and if it contains Google (meaning this was a click on the results page in Google), the script displays a small JavaScript script.

This causes the browser to be redirected to another site that is serving FakeAV.

As we can see, the whole story behind this is relatively simple (for the attackers). There is a number of things to do here to protect against this attack, depending if we are looking at servers or clients. For a standard user, the best protection (besides not clicking on images) is to install a Mozilla Firefox addon such as NoScript. Google could step up a bit as well, especially since this has been going on for more than a month already and there are numerous complaints on Google’s forums about this. Since there are so many poisoned images they could maybe modify the screen that displays the results so it does not include the iframe – that will help in first step only, since if the user lands on the malicious web page there is nothing Google can do really.

Here's the link to NoScript. The thing about NoScript though, is that it can be overkill in many situations, and requires you to fine tune it or add exceptions to make some of your normal websites function properly. This normally just consists of navigating to your trusted websites and telling NoScript to allow an exception for that site. But for some people, I imagine it could be confusing. If you have any questions about it, post em in here....