Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

'killing hazard' fake anti-virus hijacker


  • Please log in to reply
2 replies to this topic

#1 dataguySD

dataguySD

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:09:40 AM

Posted 28 September 2010 - 10:38 AM

I have been getting since 9/26 a new redirect-style virus/trojan. It masquerades as a "popup" antivirus. Any attempt to kill the popup (click on the right-corner exit, etc) starts the virus-scanning operation of the fake anti-virus. I have flagfox, which says that the page is chinese. I must kill Firefox to eliminate the page. I have run malwarebytes with a completely updated database, with no malware detected.

Full text for the popup window

text on

Warning!
On your computer detected the malicious code.
Should immediately make sure that your system is safe! Killing Hazard ® for Microsoft Windows XP immediately started to work

text off

Edited by hamluis, 28 September 2010 - 10:43 AM.
Moved from XP forum to Am I Infected ~ Hamluis.


BC AdBot (Login to Remove)

 


#2 rvan1

rvan1

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:07:40 AM

Posted 01 October 2010 - 03:39 PM

I and others are getting this due to not changing the default password on their router, so some process logs in and and changes the DNS to route through this server out in Russia (213.109.69.44).

#3 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,725 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:10:40 AM

Posted 01 October 2010 - 03:46 PM

The problem is actually based in your router and that in turn is infecting all the other computers on your network if there are more than one..
Here is the entire fix(from the beginning) that you will need to run on each PC.

Please download Malwarebytes' Anti-Malware from Here or Here

Next disconnect your system from the internet, and your router, then…

Double Click mbam-setup.exe to install the application.
  • Launch Malwarebytes' Anti-Malware, then click Finish.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.



Next you must reset the router to its default configuration. This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router. Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds). If you don’t know the router's default password, you can look it up HERE

However, if there are other Zlob-infected machines using the same router, they will need to be cleared with the above steps before resetting the router. Otherwise, the malware will simply go back and change the router's DNS settings. You also need to reconfigure any security settings you had in place prior to the reset. Check out this site here for video tutorials on how to properly configure your router's encryption and security settings. You may also need to consult with your Internet service provider to find out which DNS servers your network should be using.

Once you have ran Malwarebytes' Anti-Malware on the infected system, and reset the router to its default configuration you can reconnect to the internet, and router. Then return to this site to post your logs.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users