Scary malware/virus!

theheyes · 1 Mar 2011 at 21:04

Hikari Kisugi said:
Out of interst, what do people install java for on windows 7 nowadays? Are there specific sites and apps which require something like it to be installed.
I have 7 since launch, purposely never installed java, thus have never updated it, or I hope been subject to issues arising from its installation.
I am unaware of internet sites that don't work for me when running ie8 in protected mode from a user account with UAC on.

What am I missing out on?

It's a common misconception, but Javascript is not Java. The common browsers all have Javascript interpreters built-in, it's not something you install. If you want to see the web without Javascript you can disable it in your Internet Options/security tab.

Some sites do require actual Java which will download the bytecode and run it on your machine in the browser window, but you don't see them very often.

3dcandy · 1 Mar 2011 at 21:08

Biggest things that I've seen contributing to this are, in no particular order : running older versions of IE, running XP, not blocking ads, user interaction (allowing the payload to be delivered by clicking on a dialogue box, no doesn't always mean no!)

Seen it on about 10 machines so far....

Deleted member 77746 · 1 Mar 2011 at 21:09

Yeh, there is still some things like chat rooms, online gui clients e.t.c that use java. I still install it on Windows 7 but I still would love to see where this scareware come from.

dpbadger · 2 Mar 2011 at 06:07

The BBC has this on it.
http://www.bbc.co.uk/news/technology-12608651

ivrytwr3 · 4 Mar 2011 at 19:26

Work colleague had this on her lappy. Connected to the work wireless and did this:

Safemode with networking
installed mbam.
Did the mbam updates.

Visted a few sites for a few hours - all seemed fine. Colleague took lappy home, but following day announced:

"All i did was boot up, open my hotmail account, started to type an email and suddenly the systemtool virus was back."

What do i do now? I can clean the virus again, but when she gets home it will 'appear' again

(I didn't do anything with system restore)

Destination · 4 Mar 2011 at 19:40

turn off sysem restore, and then clean, then delete all old system restore copies

possibly runa rootkit scan, we've a single machine in work that every 6-8 days will become reinfected with something that our support company claim is eliminated.
Going to make them reinstall, as we're fed up and I CBA wasting worktime on computer support i don't get paid to do.

The system appears clean to symantec corporate and to MWB for several days and then randomly shows signs of infection again.

Swordfish · 4 Mar 2011 at 19:45

ivrytwr3 said:
Work colleague had this on her lappy. Connected to the work wireless and did this:

Safemode with networking
installed mbam.
Did the mbam updates.

Visted a few sites for a few hours - all seemed fine. Colleague took lappy home, but following day announced:

What do i do now? I can clean the virus again, but when she gets home it will 'appear' again

(I didn't do anything with system restore)

I seen these exist on flash drives/external hd with a hidden autorun file/ Perhaps she got re-infected that way.

Draeger · 4 Mar 2011 at 19:49

ivrytwr3 said:
What do i do now? I can clean the virus again, but when she gets home it will 'appear' again

(I didn't do anything with system restore)

Try running Combofix, it did the trick for me and got rid of the malware completely in one fell swoop. Also, turn off system restore / system protection ( you may have to edit the registry to do this if the malware, like it did with me, removes your "System Protection" tab under My Computer ).

Terrier_Jimlad · 4 Mar 2011 at 20:22

Also had a lass from HR bring her laptop down with this earlier. Safe mode and scans with Malwarebytes found one or two things, rebooted and scanned again all clean, scanned with TrendMicro Officescan, and then Eset Online Scanner all clean. Got her to log back in and bam it was straight back there, so clearly something in her local profile. Ended up slapping Autoruns on there which found some weirdly named exe in her profile which wasnt picked up by any AV suite ... decided to remove her profile anyway and let her create a new one

Damn things

HighlandeR · 4 Mar 2011 at 22:39

you guys are lucky only getting 10-15 pcs, me and the other engineer at work we gone thru at least 50 of these this entire week alone !

Seems theres variants of it going around but heres the full details and removal instructions here:

http://www.bleepingcomputer.com/virus-removal/remove-system-tool

Short end of the fix is:

Goto Safe mode with networking support
Run Rkill to kill any virus/spyware/malware process
install and UPDATE malwarebytes or download malwarebytes offline definition update file here:

http://malwarebytes.gt500.org/

Run full updated malwarebye scan
download combofix and update to latest one online>make sure u reboot pc after combofix has run otherwise no software works!

Seems as long as malwarebytes/combofix are updated it will 99% work, ive noticed if there not up to date theres less chance of it working seems the latest offline updates arent that up to date sadly !

Crowort · 4 Mar 2011 at 23:04

A better idea for updating malwarebtyes is to manually copy the definitions of a clean and updated PC.

Duke · 5 Mar 2011 at 08:05

Sometimes you can also just delete it via safe mode. Either in program files or appdata you can find the exe or folder, it always has a random character folder name so is easy to spot. Then run MBAM to make sure.

.Kencs · 5 Mar 2011 at 08:24

Has this exact thing myself the other week. Safe Mode, run Malware scanner, remove it, restart, jobs a good un.

Sirrel Squirrel · 5 Mar 2011 at 09:28

O dear, my wife has managed to infect her user on Windows 7, it's fully up to date and has MS Essentials running. The admin user is unaffected though.

JaseUK · 5 Mar 2011 at 10:03

My mother in law had this the other day and was infected shortly after doing something on facebook.

Safemode and malwarebytes removed it no problems

Terrier_Jimlad · 7 Mar 2011 at 09:49

JaseUK said:
My mother in law had this the other day and was infected shortly after doing something on facebook.

Safemode and malwarebytes removed it no problems

Had another lass bring a laptop in today, she also said she was just chatting to a friend on Facebook and it popped up.

Wonder if there is a rogue advertisement on the loose on Facebook

Combofix/Malware update seems to do the trick

Dano · 7 Mar 2011 at 10:01

Had a pc brought to me on Sat after this had been 'removed' by a local pc shop, they said it reinfected the machine within minutes of it being turned back on with them having done nothing more that open an email from the neighbourhood watch police liason.

Was a vista machine and only SP1, can't beleive the shop let them have it back without informing them of the updates required or even doing them, shops response when told it had re-infected? We'll need to wipe it as it's too hard to remove :eek:

I didn't like to ask how much they got charged for such a service.

Fens · 7 Mar 2011 at 10:37

Spent much of the weekend running around removing this from my mum's, girlfriend's and a couple of friends machines...all were infected browsing major sites such as hotmail/facebook/ebay/autotrader etc. Nasty stuff, must be keeping a lot of IT support people very busy at the moment!

esK` · 7 Mar 2011 at 10:53

I've been seeing this a lot recently on clients machines, In vista and win7 its in the c:\ProgramData folder and its usually named using random letters and numbers and makes no correlation to anything. You boot into safe mode and remove it manually and then when the system is back up and running scan through with malwarebytes or another trusted scanner. Yet to come across this in XP but I would put a nickel on it that it'd be in a similar kind of place.

Terrier_Jimlad · 7 Mar 2011 at 19:14

esK` said:
I've been seeing this a lot recently on clients machines, In vista and win7 its in the c:\ProgramData folder and its usually named using random letters and numbers and makes no correlation to anything. You boot into safe mode and remove it manually and then when the system is back up and running scan through with malwarebytes or another trusted scanner. Yet to come across this in XP but I would put a nickel on it that it'd be in a similar kind of place.

on XP I think it was in C:\Documents and Settings\All Users\Application Data

It's worrying that these people are getting infected from very well known major sites. Anyway, the girl's laptop I fixed earlier, she just brought in a huge tub of celebrations and a 6 pack of Becks to say thanks - Winner!