Author Topic: FBI scam Trojan/virus  (Read 1346 times)

Offline Bizman

  • Plutonium Member
  • *******
  • Posts: 9690
Re: FBI scam Trojan/virus
« Reply #15 on: November 15, 2012, 06:10:25 AM »
Adobe products are OK per se, but since they are widespread to the amount that they are considered somewhat of a standard it makes them more appealing to hackers than products with a more marginal marketing share.

Offline MrRiplEy[H]

  • Persona Non Grata
  • Plutonium Member
  • *******
  • Posts: 11633
Re: FBI scam Trojan/virus
« Reply #16 on: November 15, 2012, 07:28:13 AM »
Adobe products are OK per se, but since they are widespread to the amount that they are considered somewhat of a standard it makes them more appealing to hackers than products with a more marginal marketing share.

Actually Adobe products contain some of the worst security holes currently. The "top" performers in 10 worst security risks consist of Adobe products and Sun Java at the moment. No reason to keep either one enabled on the computer.
Definiteness of purpose is the starting point of all achievement. –W. Clement Stone

Offline Bizman

  • Plutonium Member
  • *******
  • Posts: 9690
Re: FBI scam Trojan/virus
« Reply #17 on: November 15, 2012, 12:06:20 PM »
That's another way of saying it. I've learned that the so called "safe" products have security holes as well, but since they aren't as widespread as Adobe's, no one cares. Not the users nor the hackers... If the same amount of hacking hours were spent trying to find flaws in the "safe" products I bet they wouldn't be safe any more.

I'm not against using these safer alternatives. Some of them actually work better than their mainstream equivalents, like Foxit vs. Adobe Reader. My point is that "safety" doesn't necessarily mean "flawless", only "less scrutinized".

Take MrRipleys's advice.

Offline Denniss

  • Nickel Member
  • ***
  • Posts: 607
Re: FBI scam Trojan/virus
« Reply #18 on: November 17, 2012, 06:29:49 PM »
The new readers 10/11 are indeed better with their sandbox but still open for attacks. Plus Adobe is rather reluctant to release out-of-shedule updates to fix known holes (Oracle is even worse in this, that's why Java got such a bad reputation). Plus the ever growing size of what was originally just a PDF Reader.
If you need Java for programs, disabling the Browser plugins is the first measure to increase system security (assuming you manually keep an eye on updated versions).

Foxit Reader is smaller but grows in size and fuctions as well but they offer faster reaction times to bugs (but lack at supporting updated language packs).

Offline DREDIOCK

  • Plutonium Member
  • *******
  • Posts: 17775
Re: FBI scam Trojan/virus
« Reply #19 on: November 18, 2012, 11:10:59 AM »
Thanks guys.  Might at well post the solution here.  This works for 99% of those "Your Infected, you need to buy this software to Remove).  You need two things to remove. RKill and Malwarebytes. You can get RKill.exe from Bleeping Computer here. http://www.bleepingcomputer.com/download/rkill/ Most of these malwares will not allow you access to the internet or if they do they will not allow you to download.  Use a USB Stick or another form to place both softwares on your desktop.  If you do not have MalwareBytes installed this is what you need to do.

Restart PC in Safemode with networking
Start RKill
Run or Install MalwareBytes (try to update the database) DO NOT restart your PC if Malwarebytes asks you to.
Run MalwareBytes with an IN DEPT scan.

Again these programs attack the iExplorer.exe and RKill ends all non essential processes and keeps them stopped.

Hope this helps you guys

TD


This.

Also good to note that occasionally you may need to run Rkill more then once. Not a big deal as it usually only takes a minute or two.

Rarely but occasionally I find that Rkill doesnt entirely work. In which case I sometimes resort to Combo fix which I find tends to work on some of the tougher stuff. Takes a bit longer but it works
http://www.bleepingcomputer.com/download/combofix/
Death is no easy answer
For those who wish to know
Ask those who have been before you
What fate the future holds
It ain't pretty

Offline MrRiplEy[H]

  • Persona Non Grata
  • Plutonium Member
  • *******
  • Posts: 11633
Re: FBI scam Trojan/virus
« Reply #20 on: November 19, 2012, 12:10:10 AM »
Whenever one of my computers gets infected with something, I always suspect the worse and reformat the c: drive. Despite running malware this and that, if the infection dropped a rootkit on your computer chances are no tool will find it and you end up compromised regardless of any cleaning operations. Also you should keep in mind that even on regular viruses, the most advanced AV:s can only do 98% detection of _known_ viruses. That's literally thousands of well known viruses that slip past detection without even mentioning new and unknown versions.

If/when you take the habit of splitting your c: drive and d: data drive as a first thing during installation and then installing all your vital data to d: it makes it very simple to nuke the c: drive and start from scratch.
Definiteness of purpose is the starting point of all achievement. –W. Clement Stone

Offline Bizman

  • Plutonium Member
  • *******
  • Posts: 9690
Re: FBI scam Trojan/virus
« Reply #21 on: November 19, 2012, 08:55:38 AM »
Nod32, Microsoft Security essentials didn't catch it (moms comp) avg,Norton, Microsoft essential (friends ). I was able to clean friends by booting in safe mode and running malawayer bytes Malwarebytes' AntiMalware. Tried same thing on moms but it has changed.  Wouldn't let me launch explorer (yes I know about explorer ) so launched in safe with command prompt and launched that way. Ran malaware and found 3 bugs.
One thing to bear in mind is that many malware programs try to look like legitimate ones. I'm not trying to be a grammar nazi, but incorrect spelling can lead into more troubles. Also making you'll surf to the right website to find the real thing: anti-malware-bytes.com.fyxm.net for example is rated very unsafe.

Scammers like typos: Years ago I needed the address to a site advertising pens. Their brochures had the title "Pen House". The most search results suggested I had dropped a "t" from between...
« Last Edit: November 19, 2012, 09:01:35 AM by Bizman »

Offline MrRiplEy[H]

  • Persona Non Grata
  • Plutonium Member
  • *******
  • Posts: 11633
Re: FBI scam Trojan/virus
« Reply #22 on: November 19, 2012, 11:42:29 AM »
One thing to bear in mind is that many malware programs try to look like legitimate ones. I'm not trying to be a grammar nazi, but incorrect spelling can lead into more troubles. Also making you'll surf to the right website to find the real thing: anti-malware-bytes.com.fyxm.net for example is rated very unsafe.

Scammers like typos: Years ago I needed the address to a site advertising pens. Their brochures had the title "Pen House". The most search results suggested I had dropped a "t" from between...

Oh, for a second I thought you were looking for a pen extender  :ahand
Definiteness of purpose is the starting point of all achievement. –W. Clement Stone