Author Topic: New malware attack going around  (Read 895 times)

Offline Blackwulf

  • Copper Member
  • **
  • Posts: 160
New malware attack going around
« on: April 03, 2011, 10:06:14 AM »
I had a run-in with this stupid thing this morning, so thought I'd pass along a heads-up for those who are not computer savvy.

A new malware attack is going around, nicknamed "Lizamoon" it is the usual SQL code line that redirects your browser to a web page that does a fake scan of your computer, and of course finds all sorts of viruses that you have to delete right away with their special software! It also has an annoying pop up window that blocks you from being able to just browse away.
There is no way to know if web page you are going to is infected, so once this pops up you have to deal with it, which is fortunately very simple. This piece of crap has infected a huge number of websites, not just the usual culprits, so you are likely to run into it no matter how safe your browsing usually is.

1. Do NOT click to download or run the app.  This is a no-brainer.
2. Do NOT click to close the pop up window, it usually is coded to give permission to run the app as though you had clicked "yes" no matter what you click on, including the red X button that normally closes a window.
3. Hit alt-ctrl-del and bring up the task manager.  Highlight your browser in running apps, and close it using task manager.
4. Delete your temporary internet files and browsing history using CCleaner (recommended) or manually.  If your browser asks to restore session, tell it no.  Not an essential step if you use an old browser, but better to be safe and not have any links or code from this hanging around. Also after closing this way, some browsers will restore session automatically if you don't delete the temp files, and that will just take you right back to the malware.
5. I call first dibs to hang the originator of this by his family jewels with piano wire.


Offline MaSonZ

  • Gold Member
  • *****
  • Posts: 2074
Re: New malware attack going around
« Reply #1 on: April 03, 2011, 10:10:26 AM »
what about a system scan with an anti-malware / virus cleaner?
"Only the dead have seen the end of war" - Plato
HogDweeb

Offline Blackwulf

  • Copper Member
  • **
  • Posts: 160
Re: New malware attack going around
« Reply #2 on: April 03, 2011, 12:20:25 PM »
A lot of the anti virus software will miss this one if it gets on your system, but it is easy to avoid, hence my post.  My post is about keeping it off your system in the first place. 
There are a lot of people who don't know the trick of using task manager to close their browser.  The only nice thing about this one is if you don't give it permission to download and run on your system, it can't. 
Just having your web browser redirected is not enough to infect your system, so don't panic if the web page pops up, just follow the steps above.  I hope they never figure out a way to make it auto install.
The infection is on the server side, and has been installed on the web page, not your system, unless you accept the download.  It would be dead in the water if more admins kept their software up to date, and understood security better.  Deleting the temp files will prevent you from just being brought right back to the scam page, as well as deleting any code your browser may have pre-fetched.

Offline MrRiplEy[H]

  • Persona Non Grata
  • Plutonium Member
  • *******
  • Posts: 11633
Re: New malware attack going around
« Reply #3 on: April 03, 2011, 01:04:54 PM »
Using firefox + noscript this will not even happen.
Definiteness of purpose is the starting point of all achievement. –W. Clement Stone

Offline MaSonZ

  • Gold Member
  • *****
  • Posts: 2074
Re: New malware attack going around
« Reply #4 on: April 03, 2011, 01:05:28 PM »
Using firefox + noscript this will not even happen.
i should be safe then if this is the case  :rock
"Only the dead have seen the end of war" - Plato
HogDweeb

Offline DREDIOCK

  • Plutonium Member
  • *******
  • Posts: 17775
Re: New malware attack going around
« Reply #5 on: April 03, 2011, 03:00:08 PM »
Using firefox + noscript this will not even happen.

Unless your like my wife and instead of enabling only the part of the page she wants to see will choose "allow all this page"

For those that havent figured it out on their own yet. you can choose to either permanently enable or temporarily enable only the parts of a page you want to see.
Say if a page had a video you want to see. move the mouse pointer over where the video is and look at the bottom of the window. the properties of that link/video should show up there. Then just right click on the page and go down to "no script" and  allow the properties of the video or other portion you want to view.
That was you can see what you want to see and not enable the entire page.
Death is no easy answer
For those who wish to know
Ask those who have been before you
What fate the future holds
It ain't pretty

Offline Blackwulf

  • Copper Member
  • **
  • Posts: 160
Re: New malware attack going around
« Reply #6 on: April 05, 2011, 08:19:30 AM »
Thanks for the info, upgraded to FF + NS  it works great!  I also like the download them all addon, very handy at times.

Offline dedalos

  • Plutonium Member
  • *******
  • Posts: 8052
Re: New malware attack going around
« Reply #7 on: April 05, 2011, 03:58:23 PM »
Had no idea SQL could do that
« Last Edit: April 05, 2011, 04:00:21 PM by dedalos »
Quote from: 2bighorn on December 15, 2010 at 03:46:18 PM
Dedalos pretty much ruined DA.

Offline Dichotomy

  • Plutonium Member
  • *******
  • Posts: 12391
Re: New malware attack going around
« Reply #8 on: April 05, 2011, 05:16:31 PM »
oh fantastic.. bet I'll be seeing this at work in the next few days
JG11 - Dicho37Only The Proud Only The Strong AH Players who've passed on :salute

Offline DREDIOCK

  • Plutonium Member
  • *******
  • Posts: 17775
Re: New malware attack going around
« Reply #9 on: April 05, 2011, 05:16:55 PM »
Thanks for the info, upgraded to FF + NS  it works great!  I also like the download them all addon, very handy at times.

Especially when downloading skins
Death is no easy answer
For those who wish to know
Ask those who have been before you
What fate the future holds
It ain't pretty

Offline SlapShot

  • Plutonium Member
  • *******
  • Posts: 9121
Re: New malware attack going around
« Reply #10 on: April 06, 2011, 12:19:05 PM »
SlapShot - Blue Knights

Guppy: "The only risk we take is the fight, and since no one really dies, the reward is the fight."

Offline dedalos

  • Plutonium Member
  • *******
  • Posts: 8052
Re: New malware attack going around
« Reply #11 on: April 06, 2011, 01:01:19 PM »
:rolleyes:

Shut it old man.  I know how to inject sql statements.  Everyone knows if the look at Wiki.  I don;t get how you can get a virus from it
Quote from: 2bighorn on December 15, 2010 at 03:46:18 PM
Dedalos pretty much ruined DA.

Offline SlapShot

  • Plutonium Member
  • *******
  • Posts: 9121
Re: New malware attack going around
« Reply #12 on: April 06, 2011, 02:59:49 PM »
Shut it old man.  I know how to inject sql statements.  Everyone knows if the look at Wiki.  I don;t get how you can get a virus from it

I was agreeing with you ... :huh

Maybe he was thinking ... javascript ?
SlapShot - Blue Knights

Guppy: "The only risk we take is the fight, and since no one really dies, the reward is the fight."

Offline Masherbrum

  • Radioactive Member
  • *******
  • Posts: 22416
FSO Squad 412th FNVG
http://worldfamousfridaynighters.com/
Co-Founder of DFC

Offline dedalos

  • Plutonium Member
  • *******
  • Posts: 8052
Re: New malware attack going around
« Reply #14 on: April 06, 2011, 03:16:37 PM »
I was agreeing with you ... :huh

Maybe he was thinking ... javascript ?

Oups  :D
Quote from: 2bighorn on December 15, 2010 at 03:46:18 PM
Dedalos pretty much ruined DA.