adwentures in the virus zone

So viruses, those nasty critters. So a dear friend of mine got a virus.

Fake Anti Spyware.Secure PCCleaner

	Category Fake Anti Spyware Updated   2/11/2008 15:57:00 PM Threat Level Critical Description A Fake Anti Spyware is software that purports to scan and detect malware or other problems on the computer, but which attempts to dupe or badger users into purchasing the program by presenting the user with intrusive, deceptive warnings and/or false, misleading scan results. It typically uses aggressive, deceptive advertising and may be installed without adequate notice and consent, often though exploits. Summary the hosts file was updated with the following url-to-ip mappings : n/a the following http urls were started : midnightmpegs.com 64.28.188.218 mssystem.info generated smtp traffic : n/a there was a new connection established with a remote irc server : n/a the following hidden entries created : n/a the following internet connection was established: 202.47.29.30:80 207.46.216.55:80(c.live.com) manual install filterprogram ,install securepccleaner ,ieupdr2.exe random exe installed
	Fake Anti Spyware.Secure PCCleaner Removal

Yes a nasty little thing, part of the well known Zlob virus

from wiki:

The Zlob Trojan, also known as Trojan.Zlob, is a trojan horse which masquerades as a needed video codec in the form of ActiveX to view pornographic movies.^[1] It was first detected in late 2005. However, it wasn’t until mid-2006 that it starting gaining attention.^[2] Once installed, it displays popup ads with appearance similar to real Microsoft Windows warning popups, informing the user that their computer is infected with spyware. Clicking these popups trigger the download of a fake anti-spyware program in which the trojan horse is hidden.^[2]

According to F-Secure, a computer security firm, they have discovered 32 variants of this trojan.^[3] Some variants of the Zlob family, like the so-called DNSChanger, adds rogue DNS name servers to the Registry of Windows-based computers^[4] and network settings of Macintosh computers ^[5] and therefore could potentially re-route traffic from legitimate web sites to other suspicious web sites.

PHSDL – Project Honeypot Spam Domains List^[6] tracks and catalogues Zlob spam Domains. Most of the domains on the list are redirects to porn sites that show a number of inline videos. Clicking on the video to play activates a request to download an ActiveX codec which is malware. It prevents the user from closing the browser in the usual manner. Other variants of Zlob Trojan installation are in the form of computer scan that comes as a Java cab.^[7].

The Zlob Team of computer crackers automatically submit forum comments with the use of automated script program like Xrumer creating forum spam If the links are clicked, the Zlob trojan will force itself into installation. These are usually in the form of medicine and pornography promoting but recently have included URLs to flower shops and glasses stores.

The Zlob trojan is believed to be of Russian origin.

……………….

A nasty little bastiche. A trojan virus, for those that don’t know even after reading the above, has nothing to do with contraceptives. A trojan virus named after the Greek Trojan horse, is a nasty thing that disguises itself as something else. Beware of Geeks bearing gifts!So the zlob virus, a nasty porn codec virus. A codec is a type of software that allows you to watch certain types of video files.

What did this nasty do? It took over the computer, multiplying the usual “buy our software to get rid of the nasty.” Essentially fork over cash, to the very people that infected you. It did far worse of course, it took over the desktop’s wall paper and even played porno sounds and other wonderful things. So I spent 12 hours ( I kid ye not) helping to get rif of the bastiche. The first thing I thought was to just download a specific nasty spyware removal tool. So thats what I did. Why? Macaffe failed, lavasoft’s Adaware failed, spybot’s search and destroy failed!…I even tried House call by Trend micro, sadly the nasty took over the computer, so that Housecall couldnt even open. Now I have used Adaware Away before for such nasties. Sadly their latest version is no longer free. So after several downloads of garbage (spyware removal software) I was ready to give up. I must add NEVER DOWNLOAD SPYHUNTER. Spyhunter is just another virus…blecch why do these people do these kinds of things?

After 10 hours of remote access using “Logme in” I was ready to give up. Personally I’m scared of “Hijack this.” It sounds like a recipe for disaster, gaining access to the registry and “poking it.” But in the end, I downloaded a powerful registry Dos shell software (Smitfraud Fix). Of course foolishly I “tested” it on my computer, fatal error. So while munching chinese food (tofuy sezchuan style) finally it gets fixed. 12 hours later….Sadly Mcaffe had to be reinstalled, but last I heard, the computer works.

My mistake of course, was horrible. I ended up damaging my registry. A nice virus implanted itself and started created thousands of tiny zipped files in a folder. Every time I rebooted I gained a few thousand more. Of course my registry decided that my firewall and my virus software were no good. My internet connection decided to die every 5 mi9nutes or so after a reboot. All in all an unmitigated nightmare. So what did I do? I Spent a further 40 hours (or so) trying to fix things. I tried to fix the registry…many many many times and system restore several times. But to no avail. I knew it was inevitable, with no virus software or firewall, and a net connection that died after 5 minutes, I was screwed. So then, it was deleting, backing up, moving around, approx. 500GB of data. So as you can imagine that wasn’t quick. So I tried a Windows repair instillation. Nope, no good. So around 3am, I knew that was it. It was time to wipe things.So I went for a new Windows XP installation..but decided to place Windows on a 100Gb partion on my Slave (secondary) drive, instead of on my main C drive. Why? well I had locked Windows off to its own place this way. It seemed a much nicer neater way. As it happens it was. At around 6am I managed to activate my new Windows instillation. I of course have a lot of software to re-install. I do however have the basics, sound, graphics, Microsoft office 2007 ultimate (bought cheap cause I am a student, thank you Bill Gates, you actually aren’t the Anti Christ) security software and firefox. Praise those that be….. I might sleep tonight, you never know.

So the moral of our story? Next time you want to choke the chicken, buy a freaking magazine……