I have caught a virus-advertisement. Below I am trying to explain its details.
I caught this disgusting virus approximately 1 week ago. The text is in Russian language and says that all advertised products could be found and purchased on sexshopextra.ru . The advertised products set changes at the consecution virus activations. I have never visited that site. I am not interested in porno. But I use Russian sites, because I know the language and I find interesting information there.
The advertisement virus is started even when all other software application were stopped (no application was started after computer turning power on). The advertisement virus appears approximately every 2-5 minutes after its closure. On the down right corner the advertisement has a button “Close”. If you press this button and keep your nerves quiet for one minute, the advertisement closes itself and stays inactivated for 2-5 minutes. After pressing the button “Close” a warning message begins to blink in blue/red colors and says “Do you want to eliminate this advertisement?” If you are nervous (obviously you are) and click on this warning the counting down of this one-minute time threshold for advertisement closing restarts the counting down and in this way the advertisement stays on your screen unlimited time.
When the computer is too busy, for example with downloading or installing GFI EventsManager, the virus advertisement could not appear for longer time (approximately for 10 minutes your computer is working without the advertisement).
My operating system is Windows XP Home edition, Version 2002, Service pack 3. My computer is laptop is TOSHIBA Satellite A50-106. At the moment of infection my anti-virus software was AVG. As it could not deal with the infection I installed Panda Antivirus Pro 2010, Version 9.00.00. It could not find and cure this virus. After that I downloaded SUPERAntiSpyware Free Edition Ver. 188.8.131.522. It could not cure the virus. Today I downloaded twice GFI EventsManager (build 20090302). The results of its execution (screen-shots log) were the same and they are shown in the attached files. The software GFI EventsManager (build 20090302) can not start, because immediately after starting the processing of the events on local computer the software was stopped (see the yellow message on the screens log).
Attached files description and Final Observations
I attach the following 3 files:
CFI_run_interrupted_1.doc created 05.10.2009 at 09:17
CFI_run_interrupted_2.doc created 05.10.2009 at 14:13
CFI_run_interrupted_3.doc created 05.10.2009 at 18:48
The 3 files contain screen-shoots log of the process of starting the GFI EventsManager.
On 05.10.2009 I made 2 downloads and installations of GFI EventsManager(build 20090302).
The first download and installation was made at 08:00 approximately. Before sending technical support letter to CFI I decided to read the information from your manuals. I found that I have made mistake because I have made the installation when I was logged as usual user (not admin) and I have given you wrong account information. For that reason I downloaded and installed GFI EventsManager(build 20090302) again at 18:28. Of course before that I made "Uninstall" procedure using "Control panel >> Add or Remove Programs".
Today I found out that before starting the GFI EventsManager (first screen in the 3 screen-shot log files) that:
CFI Event Manager Service is not running
Syslog Sever is not running
SNMP Traps is not running
were marked in red before starting the execution of GFI EventsManager. Yesterday I accepted this fact as normal. Today I pay attention that also on the first screen-shot there is yellow attention mark with warning "Activity Overview". This makes me think that possible I made some downloading and installation mistake. I would like to apologize myself if I made a mistake at the downloading and installation process, but with this virus, appearing every 2-5 minutes I can not read installation manuals and other documentation.
Please, help me!
e-mail: removed to protect from spambots. ~ OB
Edited by Orange Blossom, 06 November 2009 - 08:15 PM.