Ad ware virus from HT?

AngieM2 · #21 05/26/10, 09:04 PM

Please go read the threads in Admin.
Chuck has explained it. It's a certain ad/s that give a false positive.
Kung has explained that HT runs antivirus s/w.

There is more information from them in the Admin forum, if you'll check it out.

Kmac15 · #22 05/26/10, 09:19 PM

Quote:

Originally Posted by AngieM2

Please go read the threads in Admin.
Chuck has explained it. It's a certain ad/s that give a false positive.
Kung has explained that HT runs antivirus s/w.

There is more information from them in the Admin forum, if you'll check it out.

Angie, as I understand it the false positive is when our software claims that an ad is a virus. This is not what is happening to us. We are getting an ad ware virus that is claiming to be a virus program that has detected a virus and we need to click on it to buy the correct program to get rid of it. When you don't click it gets more aggressive until you can't do anything else on your system.

If it is getting through so many of our personal virus programs I wonder if it is getting through HT's as well.

I posted in Admin first, decided I would get faster response here and was right.

hippygirl · #23 05/26/10, 09:45 PM

Quote:

Originally Posted by calliemoonbeam

I'm sorry to say it, but it has to be coming from HT. My computer blocked it just a little while ago, and this is the absolutely only place I've been since logging on tonight, and I never ever go to Facebook. Luckily my Trend Micro DID block it. Sorry it didn't work for you Jill. I don't know if it's because I have the Pro version or if my settings are just higher than yours.

I got it a few weeks back from HT on my other computer...had to wipe the HD to get rid of it.

**highlands** · #24 05/26/10, 10:03 PM

Quote:

Originally Posted by arabian knight

Except for us that have Mac's

Hear, hear! Mac's the way.

Suggestion: turn off Flash, plugins, Java, javascript in that order. Live as lightly as you can on your network connection. Flash sucks CRU (Computer Resource Units = memory, bandwidth, processor cycles, etc). Without these running the web runs faster and you are far, far, far, far, far, far,...far less likely to get malware.

Cheers

-Walter
Sugar Mountain Farm
Pastured Pigs, Sheep & Kids
in the mountains of Vermont
Read about our on-farm butcher shop project:
http://SugarMtnFarm.com/butchershop
http://SugarMtnFarm.com/csa

AngieM2 · #25 05/26/10, 10:10 PM

Quote:

Originally Posted by Kmac15

Angie, as I understand it the false positive is when our software claims that an ad is a virus. This is not what is happening to us. We are getting an ad ware virus that is claiming to be a virus program that has detected a virus and we need to click on it to buy the correct program to get rid of it. When you don't click it gets more aggressive until you can't do anything else on your system.

If it is getting through so many of our personal virus programs I wonder if it is getting through HT's as well.

I posted in Admin first, decided I would get faster response here and was right.

Yep, you might be right about faster, but I'm the only Mod that's noticed it here, and no Admins to check it out.
I'll let them know to check Admin and this thread. Please get the information as a cut and paste into a thread in Computer forum and attn: to Kung so he can work on figuring it.

Angie

PrettyPaisley · #26 05/26/10, 10:20 PM

I had Avast but after my mess I went with Avira. Like Avast, the home version is free. It does seem to detect something when I'm on different forums on this site but I just click the "delete" button and keep on with what I was doing.

oldmania · #27 05/26/10, 10:28 PM

I am using Avira also. When I am on HT, it gives a virus warning, with "ad" in the identifier. The box that comes up has the "deny access" box checked. I leave that checked and close the box, and have had no further problems.

Jim-mi · #28 05/26/10, 10:42 PM

Back in early April my computer shop guy said that in the last year he had at the shop well over a hundred systems that he cleaned up-- almost all were virus from 'face book' . . . . . . .

While I was there at the shop, another customer came in with a very badly infected tower . . . . . .customer said his 13 year old daughter was always on facebook.

**Shrek** · #29 05/27/10, 12:54 AM

Quote:

Originally Posted by mnn2501

malwarebytes (free program) will remove it

www.malwarebytes.org

No computer should be on the net without already having malwarebytes on it.

Occasionally with that particular piece of malware it will prevent the download. in that case you will need to download the Malwarebytes installation file (called mbam.exe) on another computer, change the name (right click and choose rename call it anything.exe) then load on the infected machine and open the renamed mbam file

After running malwarebytes, a run of spybot S&D (also free) will snag a few left behind cooties and a crap cleaner run will allow windows firewall and defender to be reactivated.

Spywareblaster installed after the fake security removal will help prevent future infection.

**Kung** · #30 05/27/10, 01:46 AM

Ok...am in class right now. Can't post a long post but I did want to address several things.

First - HT does *NOT* repeat *NOT* have viruses. With all due respect to those involved, you don't have to take my opinion or advice...but virus/adware scans are done all the time on the server, by myself and/or Dean.

Now, it is POSSIBLE that some of the ads that are posted on HT via Google Adsense bring you to/past sites that have been compromised by viruses/adware, but that is not at all the same as HT 'having a virus.' We already know that some sites can trigger false positives; I won't deny that it's possible that some sites that ads are linking to might be compromised themselves by virii. Ads are on almost every single site out there nowadays; loads of them use the same ad engine that we use. However, that does NOT equate to HT 'having a virus.' At worst, it means that the service that HT uses for presenting ads might be redirecting us to sites that are compromised themselves.

In other words, the problem is not HT, and it's not even the ad engine used here; it's the sites that post the ads. Blaming HT for the ads is like blaming a newspaper publisher because they posted an ad for a vendor that ended up being shady when you went to visit their establishment; the newspaper publisher couldn't have known. They just host/post theads.

Additionally, keep in mind that our server does not even run the same operating system as most of the computers owned by most of the posters here - it runs on a flavor of Linux, whereas most here run Windows. Therefore, the server cannot become infected with the virii that Windows computers can.

Secondly (and this is somewhat targeted at Jill.Costello), I have troubleshot these viruses (SecurityTool, WinAntivirusPro 2010, etc.) countless times. Believe it or not, 99.9% of the time, a short procedure can and will remove this virus completely from your computer almost EVERY single time.

I don't say this because I think it works. I say it because I've done it many times in the last year or two; after discovering and implementing the procedure, EVERY SINGLE TIME, the computer has been back up and running inside of an hour or two.

Of course, this doesn't mean that it will *always* work; new virii come out all the time. But my point is this: myself and many others do this not only because we're 'geeks' but because we do this on a professional basis.

My further point is this:

Before spending $120 on a computer, PLEASE let us know about it here. I almost GUARANTEE that the procedure I will post later (I'm in an evening class right now) will work with very few to no modifications. I mentioned your name, Jill.Costello, because I am very familiar with the SecuritySoft virus. I've removed it within the last 2 weeks from no less than 4 laptops; and each time it took me less than 45 minutes. Hopefully we can save you money in the future.

michelleIL · #31 05/27/10, 06:55 AM

Quote:

Originally Posted by Kung

Ok...am in class right now. Can't post a long post but I did want to address several things.

First - HT does *NOT* repeat *NOT* have viruses. With all due respect to those involved, you don't have to take my opinion or advice...but virus/adware scans are done all the time on the server, by myself and/or Dean.

Now, it is POSSIBLE that some of the ads that are posted on HT via Google Adsense bring you to/past sites that have been compromised by viruses/adware, but that is not at all the same as HT 'having a virus.' We already know that some sites can trigger false positives; I won't deny that it's possible that some sites that ads are linking to might be compromised themselves by virii. Ads are on almost every single site out there nowadays; loads of them use the same ad engine that we use. However, that does NOT equate to HT 'having a virus.' At worst, it means that the service that HT uses for presenting ads might be redirecting us to sites that are compromised themselves.

In other words, the problem is not HT, and it's not even the ad engine used here; it's the sites that post the ads. Blaming HT for the ads is like blaming a newspaper publisher because they posted an ad for a vendor that ended up being shady when you went to visit their establishment; the newspaper publisher couldn't have known. They just host/post theads.

Additionally, keep in mind that our server does not even run the same operating system as most of the computers owned by most of the posters here - it runs on a flavor of Linux, whereas most here run Windows. Therefore, the server cannot become infected with the virii that Windows computers can.

Secondly (and this is somewhat targeted at Jill.Costello), I have troubleshot these viruses (SecurityTool, WinAntivirusPro 2010, etc.) countless times. Believe it or not, 99.9% of the time, a short procedure can and will remove this virus completely from your computer almost EVERY single time.

I don't say this because I think it works. I say it because I've done it many times in the last year or two; after discovering and implementing the procedure, EVERY SINGLE TIME, the computer has been back up and running inside of an hour or two.

Of course, this doesn't mean that it will *always* work; new virii come out all the time. But my point is this: myself and many others do this not only because we're 'geeks' but because we do this on a professional basis.

My further point is this:

Before spending $120 on a computer, PLEASE let us know about it here. I almost GUARANTEE that the procedure I will post later (I'm in an evening class right now) will work with very few to no modifications. I mentioned your name, Jill.Costello, because I am very familiar with the SecuritySoft virus. I've removed it within the last 2 weeks from no less than 4 laptops; and each time it took me less than 45 minutes. Hopefully we can save you money in the future.

THat was just darn well put!

dixienc · #32 05/27/10, 09:05 AM

I jsut got rid of mine and my hubbies. My mom in MI is sending her laptop to us again to have the same thing removed. I used hijackthis and Spybot programs to remove it. Becareful with hijackthis as it alters the registry and if you don't know what your doing you will crash the system. Spybot takes a long time to complete the scan but if does a great job. Good luck!

Patt · #33 05/27/10, 09:51 AM

Quote:

Originally Posted by tamjap

I have found that Avast antivirus coupled with Ad-Aware spyware removal can be a very effective combination. Both programs are free, and have worked very well for me.

And, yes, Facebook is very bad for viruses and other nasties.

Me too. My whole family has had Avast for years and never had a single problem. There are good free programs.

http://www.avast.com/index

danielsumner · #34 05/27/10, 10:12 AM

I get this nasty little demon everyonce in a while. What I do is run Malwarebytes and it takes care of it. Your going to have to run your pc in "safe mode". Everyonce in a while Malwarebytes will not run with the malware on the pc. I just go to safe mode and do a system restore to a date about a week before. Your stuff on your hard drive is not corrupted. Don't do anything like reformat and lose all your data. This nasty little piece of malware causes a lot of pain for people. Just think of all the people that pay the $29.99 to get rid of it. This malware is not residing on HT. Its coming though on some page or ad that you clicked on. Sometimes it's not right away, so you won't know which site or ad caused the problem.

Daniel

dixienc · #35 05/27/10, 12:16 PM

Quote:

Originally Posted by danielsumner

I get this nasty little demon everyonce in a while. What I do is run Malwarebytes and it takes care of it. Your going to have to run your pc in "safe mode". Everyonce in a while Malwarebytes will not run with the malware on the pc. I just go to safe mode and do a system restore to a date about a week before. Your stuff on your hard drive is not corrupted. Don't do anything like reformat and lose all your data. This nasty little piece of malware causes a lot of pain for people. Just think of all the people that pay the $29.99 to get rid of it. This malware is not residing on HT. Its coming though on some page or ad that you clicked on. Sometimes it's not right away, so you won't know which site or ad caused the problem.

Daniel

My sons swears by Marwarebytes. He said the same thing, use it in safe mode, as the virus/adware will not let it do anything otherwise.

arabian knight · #36 05/27/10, 02:20 PM

Another thing to remember that there is only a few people very few people at that getting anything form this site.
And with over 3,500 active users a whole bunch of them should be getting bad stuff if this site was infected, but they are not. Only a hand full. I feel for those that have troubles I just can't see with over that many users that only so few get something from this site. And right now over 700 on here on this site, and still 2 or 3 or so are reporting anything trouble Hmmmmm

Heritagefarm · #37 05/27/10, 04:17 PM

I've heard that that thing hides on your computer until you do a certain thing, then attacks.

**Kung** · #38 05/27/10, 05:35 PM

Quote:

Originally Posted by dixienc

My sons swears by Marwarebytes. He said the same thing, use it in safe mode, as the virus/adware will not let it do anything otherwise.

I do as well - it is a VERY good spyware remover.

This being said, it's not the ONLY one I use; it's not the 'be all, end all' of spyware removers by itself. I use 2 or 3 different ones.