Very nasty PC infection

[Chris Scott]

I was unfortunate enough two days ago to have my PC infected with undoubtedly the worst bit of malicious software I have seen.
It is called "Windows XP Recovery" and completely blocks access to your own system. It tell you all folders are empty and every few seconds you get critical error messages. A dialogue box appears and pretends to run a scan of your system and reports multiple errors and then takes you to a website to buy their software.
This malware is an absolute bastard to get rid of and it took me most of yesterday to get access back to my PC. It disables safe mode startup, and when you try to run an antivirus or anti malware program, as soon as it hits one of the files connected with the malware it restarts the PC.
The worst thing is that now that I have control of my system back virtually every setting on my PC has been screwed up and changed.
It will take me days if not weeks to get back to normal.
And the worst thing is that this f.....g program also disables and screws up System Restore.
If you are unlucky enough to get this infection PLEASE get rid of it as soon as you can.
My PC is well protected with firewall and antvirus but still it got through. I have no idea how I contracted it.
Chris S.

[Tracy Ianson]

Hi Chris

This is similar to the one Nathan got a few month back. I used Rkill on it and it worked really well. You can google Rkill and find out more info. As Nathan's laptop wasn't able to download it I downloaded it to my computer and used a usb key to download it into Nathan's computer. No problems since.

Tracy

[Mike Covell]

Hi Chris, I had it a few months back and had a friend come and help me. Like yourself I have firewalls and anti-virus but this one got through. It continued to tell my that it had scanned my computer for free and found thousands of virus's, but it would cost me $xxx to remove them and install this software.

Luckily my friend took my computer back to a safe point, removed the virus, and restored the system, cleaning it up in the process.

I would love to get my hands on the little scrotes that create these things.

[Magpie]

I had something similar a couple of weeks ago.

If you can get into task manager, look for a process called "oko.exe" and kill it (that stops the pop-ups.) You'll have to find and kill this process a lot while you're fixing the problem.

If you have Malwarebytes, you can rename the .exe file to a .com and run it without the malware knowing what you are doing. Malwarebytes generally cleans up those kinds of malware quite handily.

[Chris Scott]

Hi guys
Thanks for the comments
One of the other things it did was to disable Task Manager!
It was Malwarebytes that finally got me thru - each time I ran it it dealt with one of the files of the infection but then Windows closed down
I had to run various cleaners and anti malware programs about 20 times before I got back in
Chris

[Howard Brown]

Mike:

You ane I both. I could easily strangle one of those little azzholes without batting an eye.

Chris....Sorry to hear this bad news, old friend....

Little late in the game to be mentioning this...but Trend Titanium anti-virus is a very good system...and I've had a handful of different av systems. They have software for both Windows and Mac.

Looks like its been a tough years for a few of us with these computers...or websites.

[Paul Kearney A.K.A. NEMO]

Good advice is to always back up important files on a regular basis, whether to CD, DVD or pen-drive

Imagine nearing the end of your book on the PC only to lose it all to a bit of malware...

[admin tim]

I experienced the same infection as Chris today at work. Early this morning, I suddenly got a popup message that announced the end of the world as I knew it - massive malware infections and my only hope was to buy the software there and then to save it all.

I knew it was bogus right away, since these people had misspelled 'Unregistered', and I called our IT people.

Malwarebytes did the trick, but it took them about 6 hours and numerous settings were altered. The malware had actually removed the .exe from any associations, so nothing could be launched. And it didn't get it all the first two times. I had to reboot 4 times today. What a pain.

For future reference:

http://www.geekradio.com/2006/06/26/jay-lees-patented-spyware-removal-system

[Howard Brown]

Tim:

You mean you got the infection without even clicking on a link...or opening an email ?

I'm having one fizzzzzzzzzzzuck of a time with this IE9. My stupid Honko-Polack ass decided to give it a go...and I was ready to pull out the 10 gauge because I had to reboot 6 fizzucking times to get PB to work. What a pain in the tentacles.

I'm done for the day...I am too pissed off. I think I'll go kick Nina.

[admin tim]

It got infected somehow, but I am careful what sites I visit (this was at work) and all incoming email is scanned anyway. I must have picked it up from one of these sites, but these are news sites and political blogs of good repute, so I am at a loss to explain.

Dump IE9 and get Firefox or Avant. I use Firefox at home, and the wife uses avant, and I've never had any problems as overwhelm IE. That's a fool's game, and it'll break you.

[Howard Brown]

Tim:

Please, whenever you get a chance to drop your knife and fork...gimme the destructions on removing this IE9 and installing Firefox.

The reason I ask is that you might know shortcuts and I'm all about shortcuts.

[admin tim]

You can download Firefox from http://www.mozilla.com/en-US/firefox/new/

You don't have to uninstall IE9 - just select Firefox as your default browser and let IE9 rot where it sits.

You might also look at Avant, but Firefox works well for me and it is a LOT easier to use to deal with images.

[Howard Brown]

Tim;

Thanks. I installed it and it works fine.

[Magpie]

Tim:

You mean you got the infection without even clicking on a link...or opening an email ?

You know the worst sites for these particular rogue programs? Newspapers! I **** you not. Small, regional newspapers starved for advertising revenue are the worst offenders. They are far from the only ones, for sure, but it's amazing how many of them have this crap in their ad rotation.

Usually they are embedded in an iframe just like any other advertising--that's the problem with these bastards. They are walking the finest of lines between "aggresive business practices" and "illegal hacking".

[Howard Brown]

Mag:

Not sure if this is true or not...but I've heard that viruses can be transmitted through emails simply by reading the email...and not opening any attachments which accompany them.

Izzit so ?