350X

russian porn virus ?

My mothers laptop got infected with a bunch of stuff, it infected FF, Opera, IE, installed bookmarks, shorts cuts, quick launch icons.....

most of it said Mail.Ru on it, a wrong click had 90 porn pages load up, and some very questionable porn at that. I thought it was all gone but it happened again the next night.

not finding anything with Avast

anyone ever run into this?

worst part is, it was tethered to my phone at the time, why it was able to do all it did so fast, as the laptop is usually on slow dialup.

ApparitionXVII

4G LTE BLAZING VIRUS

If I may, I would totally recommend downloading and running Malwarebytes, and be sure to turn off System Restore on the C:\ beforehand. May be able to get rid of it... it's a good little product.

Angus19

I'd second Malwarebytes. I run Malwarebytes, Avast and McAffee and never have virus problems. Either that or switch to Ubuntu for any "questionable downloads"

9to5cynic

Hmm... I'm guessing it might have had local copies of all the larger files (as to why it was able to load so fast)...

But seriously, I'd probably just nuke it start over. Especially if some really questionable content was on the machine. But that's me. And really, you never know for sure exactly what the program is going to do... there could be parts missed by the AV software....

That's the stuff that makes me nervous, and a clean install of most modern OSes take only a half an hour or so. Hopefully important files were backed up. I would scan anything that you need from that computer with some AV just to be sure all the files are clean.

__________________
Nandroid Backup Script|unanswered threads|BabyBlues Breast Cancer Pledge

350X

but a clean install can't wipe a hard drive clean, ive nuked hard drives, made them smoke and a recovery program still finds more then everything.

only a complete HD change will remove anything loaded onto it and yes, it was either some photo tricks or some illegal as F stuff.

CodeMonkey

Use the live CD tool DBAN to wipe the drive before a fresh install.
Change passwords on all accounts used on the laptop from another machine asap.

__________________
Monkey see, monkey do.

cursor system

It is obvious that the PC has been infected by virus. The next thing you should focus on is how to remove it.

9to5cynic

Yeah, hit it with DBAN and reinstall windows.

350X

I ran malwarebytes before and even now all it finds is that I have the MS firewall n virus turned off, I use zone alarm n avast instead.

mikedt

Best advice. Once you've hit a HDD with DBAN, there is absolutely nothing left, no lurking nasties or anything.

__________________
The People's Guide to Android in the People's Republic.
Honorary Grand Poobah Shenzhen University English Corner.
http://welcometomychina.tumblr.com/
There are nine million bicycles in Beijing.
There are nine million Androids in Shenzhen.

350X

Anyone got a direct link to the DBAN CD/DVD iso I should download and use???

google is flooded with stuff, pick my poison for me

mikedt

Has direct URL to the SourceForge DBAN ISO.
DBAN Download | Darik's Boot And Nuke
Download Darik's Boot and Nuke from SourceForge.net

350X

Oh Lord that how out of touch I am, I thought you were talking about some linux distro, why I wasn't finding it.

that thing look dangerous, I don't even want that iso in my machine to bunr it, in fear of setting off the bomb

CodeMonkey

It's a very handy tool to have - I use it to prep laptops for resale on eBay (military wipe and fresh windows install).

mikedt

Yeh it's a secure data destroyer, that's all it is. DBAN, Darik's Boot And Nuke. It doesn't know about partitions, formats, boot sectors or anything like that. It totally fills the HDD with random data or zeros, and do it how ever many times you want. Useful if you're selling your old PC on Ebay.

9to5cynic

If I'm not mistaken, DBAN is also DoD cleared....

cookiefrog

Combofix is awesome make sure you download it from bleepingcomputer.com only as it is so good that there is a fake one out there.

Then run malwarebytes. On most cases a single tool does not provide a clear cut solution.

Speed Daemon

Booting from a known-clean, read-only disc with the latest anti-malware tools is by far the best way to go. CodeMonkey's advice about that id #1. I'm not familiar with DBAN, and in the past I've had some great success using a command line Windows PE version of Emisoft's A2 product. So there's one more anti-malware product that has worked well for me in the past, and can be built into a WinPE or ReactOS environment, as well as its own free Emsisoft Emergency Kit image.

9to5cynic

DBAN will write to the hard drive all ones or zeros (I believe it does random as well), and it does several passes (if you allow). IIRC it passes DoD clearance. So it completely destroys the data on the disk. That way, there is no lingering 'questionable' content on the disk whatsoever.

350X

Looks like I wasn't the only one, and or the word get back to the right people. I haven't nuked it yet as I gotta get my Mother to say what needs backed up [her laptop], but anyways last night I clicked a missed shortcut link, which of course tried to load several pages, but all of them were now dead links to those parked domain or bad DNS pages.