Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Early signs of a virus?


  • Please log in to reply
9 replies to this topic

#1 skorge729

skorge729

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:03:33 AM

Posted 25 April 2011 - 12:39 AM

Having experienced virus problems a LONG time ago on a different machine, I'm very cautious now. Earlier about 3 hours ago I was searching on Google for images for my PowerPoint presentation I have to give in class tomorrow. Google has that thing now where the photo shows up in the middle of the screen and the webpage loads in the background (hate it). I clicked on one picture and my Symantec scanner suddenly said on the bottom of my screen that it blocked a "fake app attack" on a webpage? Or something. I didn't understand it and couldn't find anywhere to get more information about what had just happened.

Now about ten minutes ago I get this popup...

Posted Image

I clicked the X, the webpage popped up anyway, it was a fake scan with a long list of viruses that were supposedly on my computer. I closed Firefox, which deletes all my cookies, history and everything, every single time...haven't seen anything since so I'm hoping thats a good sign.

Downloaded Malware Bytes, RKILL, and ran scans in both as well as with Symantec.

Should I be worried? Did not see any detection of something on my computer. I'm a graphic designer so the files on my computer are super important...yes I've got them backed up. :) But my external was plugged in while this whole thing happened...I don't want the virus to cross over! >_<

Edited by skorge729, 25 April 2011 - 12:40 AM.


BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,126 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:33 AM

Posted 25 April 2011 - 07:31 AM

I clicked the X, the webpage popped up anyway, it was a fake scan with a long list of viruses that were supposedly on my computer.

Use Task Manager to close pop-up messages to safely exit malware attacks
Don't Close That Pop-Up Window!

Please post the complete results of your MBAM scan for review.

To retrieve the Malwarebytes Anti-Malware scan log information, launch MBAM.
  • Click the Logs Tab at the top.
  • The log will be named by the date of scan in the following format: mbam-log-date(time).txt
    -- If you have previously used MBAM, there may be several logs showing in the list.
  • Click on the log name to highlight it.
  • Go to the bottom and click on Open.
  • The log should automatically open in notepad as a text file.
  • Go to Edit and choose Select all.
  • Go back to Edit and choose Copy or right-click on the highlighted text and choose Copy from there.
  • Come back to this thread, click Add Reply, then right-click and choose Paste.
  • Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
Logs are saved to the following locations:
-- XP: C:\Documents and Settings\<Username>\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-yyyy-mm-dd
-- Vista, Windows 7, 2008: C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-yyyy-mm-dd



Please download SUPERAntiSpyware Free and follow these instructions for performing a scan.

  • Double-click SUPERAntiSypware.exe and use the default settings for installation.
  • Be sure to update the definitions before scanning by selecting "Check for Updates".
    If you encounter any problems while downloading the updates, manually download them from here.
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
  • Click Close to exit the program.
  • Please copy and paste the Scan Log results in your next reply.
-- Some types of malware will disable security tools. If SUPERAntiSpyware will not install, please refer to these instructions for using the SUPERAntiSpyware Installer. If SUPERAntiSpyware is already installed but will not run, then follow the instructions for using RUNSAS.EXE to launch the program.

-- Alternatively, you can download and use the SUPERAntiSpyware Portable Scanner or perform a SUPERAntiSpyware Online Safe Scan (both listed under Popular Links) instead. If you cannot download from the infected computer, save the randomly named file (i.e. SAS_1710895.COM) to a usb drive or CD and transfer it. Then double-click on the file to launch the portable version and scan. The file is randomly named to help keep malware from blocking the scanner.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 skorge729

skorge729
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:03:33 AM

Posted 26 April 2011 - 12:21 AM

Thank you for your reply! Very helpful. Here are my logs.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6436

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19048

4/25/2011 1:30:51 AM
mbam-log-2011-04-25 (01-30-51).txt

Scan type: Quick scan
Objects scanned: 159127
Time elapsed: 7 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


-------------------

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 04/26/2011 at 01:09 AM

Application Version : 4.51.1000

Core Rules Database Version : 6923
Trace Rules Database Version: 4735

Scan type : Quick Scan
Total Scan Time : 00:25:12

Memory items scanned : 884
Memory threats detected : 0
Registry items scanned : 2629
Registry threats detected : 0
File items scanned : 12927
File threats detected : 31

Adware.Tracking Cookie
acvs.mediaonenetwork.net [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
cdn.insights.gravity.com [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
cdn.uc.atwola.com [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
cdn4.specificclick.net [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
content.oddcast.com [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
convoad.technoratimedia.com [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
convoad.technoratimedia.net [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
core.insightexpressai.com [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
crackle.com [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
googleads.g.doubleclick.net [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
i.adultswim.com [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
ia.media-imdb.com [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
m1.2mdn.net [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
macromedia.com [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
media-dev.pictela.net [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
media-macys1.pictela.net [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
media.ign.com [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
media.kyte.tv [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
media.mtvnservices.com [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
media.scanscout.com [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
media.tattomedia.com [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
media1.break.com [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
mediaforgews.com [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
msnbcmedia.msn.com [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
multimedia.msn.com [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
objects.tremormedia.com [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
s0.2mdn.net [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
secure-us.imrworldwide.com [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
sftrack.searchforce.net [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
spe.atdmt.com [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]
udn.specificclick.net [ C:\Users\NAME\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\T73NDCKX ]

Edited by skorge729, 26 April 2011 - 12:22 AM.


#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,126 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:33 AM

Posted 26 April 2011 - 06:54 AM

So far so good.


Try doing an online scan to see if it finds anything else that the other scans may have missed.

Please perform a scan with Eset Online Anti-virus Scanner.
  • If using Mozilla Firefox, you will be prompted to download and use the ESET Smart Installer. Just double-click on esetsmartinstaller_enu.exe to install.
  • Vista/Windows 7 users need to run Internet Explorer/Firefox as Administrator. To do this, right-click on the IE icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run As Administrator from the context menu.[/color][/i]
  • Click the green Posted Image button.
  • Read the End User License Agreement and check the box:
  • Check Posted Image.
  • Click the Posted Image button.
  • Accept any security warnings from your browser and allow the download/installation of any require files.
  • Under scan settings, check Posted Image and check Remove found threats
  • Click Advanced settings and select the following:
    • Scan potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
  • Click the Start button.
  • ESET will install itself, download virus signature database updates, and begin scanning your computer.
  • The scan will take a while so be patient and do NOT use the computer while the scan is running. Keep all other programs and windows closed.
    If given the option (when threats are found), choose "Quarantine" instead of delete.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop as ESETScan.txt.
  • Push the Posted Image button, then Finish.
  • Copy and paste the contents of ESETScan.txt in your next reply.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 skorge729

skorge729
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:03:33 AM

Posted 27 April 2011 - 11:21 PM

Oh my gosh...

So, I haven't done this scan yet because I've needed my computer constantly for the last few days and for this scan I have to shut down all programs. I was planning on doing it tonight while I was sleeping.

Now, like 2 minutes ago, I just got that SAME pop up again and then again with the "virus scanner" webpage pop up! >_< I was searching on google again when it happened. Nothing in particular...in fact I was looking up art so its not like it was harmful searching.

Going to run SuperAntiSpyware again, Rkill, and MWB. Will do the other scan tonight.

Edit: Actually no...it was not exactly the same. I remember seeing something like this at the top of the bar of that one pop up but with the same content message: "The page at hxxp://antivirus (????) mcafee.com (or something) says" This time I know it said McAfee. Sad I didn't get a screenshot I just figured it was the same but it wasn't!

Edited by quietman7, 28 April 2011 - 06:19 AM.


#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,126 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:33 AM

Posted 28 April 2011 - 06:19 AM

I understand.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 skorge729

skorge729
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:03:33 AM

Posted 05 May 2011 - 07:28 PM

Hey. :) Sorry for the long wait. Eset did not find any threats on my computer so it didn't give me an option to save a log, or maybe I didn't see it. o.O

Before I did the scan though, like an hour before, I got this popup! I have no idea what it means if it means anything. I CTRL-ALT-DEL'ed out of it.

Posted Image

#8 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,126 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:33 AM

Posted 05 May 2011 - 07:52 PM

There are various types and causes of certificate error messages and certificate security alerts.

Why do certificate errors occur?
Certificate errors occur when there is a problem with a certificate or the server's use of the certificate. Internet Explorer can help keep your information more secure by warning you about certificate errors...

What do the different certificate errors mean?
This website’s security certificate has been revoked.
This website’s address does not match the address in the security certificate.
This website’s security certificate is out of date.
This website’s security certificate is not from a trusted source.
Internet Explorer has found a problem with this website’s security certificate.

About certificate errors

Secure Connection Failed

Other than that, how is your computer running now? Are there any more signs of infection?...strange audio ads, unwanted pop-ups, security alerts, or browser redirects?
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#9 skorge729

skorge729
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:03:33 AM

Posted 11 May 2011 - 08:30 PM

I don't believe it is running negatively in any way and I have not gotten a pop up since that last time I posted here. That is interesting about the certificate errors. Is it safer to use Internet Explorer or Mozilla Firefox? I always have it delete all my cookies on close and things just incase.

Thank you SO much!!

#10 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,126 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:33 AM

Posted 12 May 2011 - 06:05 AM

Is it safer to use Internet Explorer or Mozilla Firefox?

There have been mixed reviews and differing opinions about which browser is better as the debate has been ongoing for years.

I always have it delete all my cookies on close and things just incase.

Cookies are text string messages given to a Web browser by a Web server. Whenever you visit a web page or navigate different pages with your browser, the web site generates a unique ID number which your browser stores in a text (cookie) file that is sent back to the server each time the browser requests a page from that server. Cookies allow third-party providers such as ad serving networks, spyware or adware providers to track personal information. The main purpose of cookies is to identify users and prepare customized Web pages for them.

  • Persistent cookies have expiration dates set by the Web server when it passes the cookie and are stored on a user's hard drive until they expire or are deleted. These types of cookies are used to store information between visits to a site and collect identifying information about the user such as surfing behavior or preferences for a specific web site.
  • Session (transient) cookies are not saved to the hard drive, do not collect any information and have no set expiration date. They are used to temporarily hold information in the form of a session identification stored in memory as you browse web pages. These types of cookies are cached only while a user is visiting the Web server issuing the session cookie and are deleted from the cache when the user closes the session.
Cookies can be categorized as:
  • Trusted cookies are from sites you trust, use often, and want to be able to identify and personalize content for you.
  • Nuisance cookies are from those sites you do not recognize or often use but somehow it's put a cookie on your machine.
  • Bad cookies (i.e. persistent cookies, long term and third party tracking cookies) are those that can be linked to an ad company or something that tracks your movements across the web.
The type of persistent cookie that is a cause for some concern are "tracking cookies" because they can be considered a privacy risk. These types of cookies are used to track your Web browsing habits (your movement from site to site). Ad companies use them to record your activity on all sites where they have placed ads. They can keep count of how many times you visited a web page, store your username and password so you don't have to log in and retain your custom settings. When you visit one of these sites, a cookie is placed on your computer. Each time you visit another site that hosts one of their ads, that same cookie is read, and soon they have assembled a list of which of their sites you have visited and which of their ads that you have clicked on. Cookies are used all over the Internet and advertisement companies often plant them whenever your browser loads one of their banners.

Cookies are NOT a "threat". As text files they cannot be executed to cause any damage. Cookies do not cause any pop ups or install malware and they cannot erase or read information from a computer.

Cookies cannot be used to run code (run programs) or to deliver viruses to your computer.

MS Article ID: 60971 - Description of Cookies

To learn more about Cookies, please refer to:Flash cookies (or Local Shared Objects) and Evercookies are a newer way of tracking user behavior and surfing habits but they too are not a threat, nor can they harm your computer.

An Evercookie is a Javascript API created and managed persistent cookie which can be used to identify a user even after they have removed standard and Flash cookies. This is accomplished by creating a new cookie and storing the data in as many storage locations (currently eight) as it can find on the local browser. Storage mechanisms range from Standard HTTP and Flash cookies to HTML5's new storage methods. When evercookie finds that other types of cookies have been removed, it recreates them so they can be reused over and over.Flash cookies are cookie-like data stored on a computer and used by all versions of Adobe Flash Player and similar applications. They can store much more information than traditional browser cookies and they are typically stored within each user’s Application Data directory with a ".SOL" extension, under the Macromedia\FlashPlayer\#SharedObjects folder. Unlike traditional cookies, Flash cookies cannot be managed through browser controls so they are more difficult to find and remove. However, they can be viewed, managed and deleted using the Website Storage Settings panel at Macromedia's Support Site. From this panel, you can change storage settings for a website, delete a specific website or delete all sites which erases any information that may have been stored on the computer. To prevent any Flash Cookies from being stored on your computer, go to the Global Storage Settings panel and uncheck the option “Allow third-party Flash content to store data on your computer”. For more information, please refer to:As long as you surf the Internet, you are going to get cookies and some of your security programs will flag them for removal. However, you can minimize the number of them which are stored on your computer by referring to:Third party utilities to Manage (view & delete) Cookies:
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users