Security Suite malware

[Drew99GT]

My pops just got this insidious garbage on his machine and it took it over - wouldn't allow a system restore or a new disk image (Windows 7), turned off the browser, wouldn't allow any new security software to install, and walked passed Avira Antivir like it wasn't even there.

Here's the fix in case anyone gets this thing - in most cases, it installs through a fake Flash update on legitimate web pages (where the flash code as been compromised).

http://www.softsailor.com/how-to/37848-h...al-guide-2.html

Running combofix from the command line can get rid of a lot of stuff!

 

[Nyquist]

This is where not giving yourself admin privileges on an every day user account helps.

As a general rule of thumb, I only update Flash using the otherwise annoying Adobe Updater program that gets installed along with Flash.

 

[Cutehumor]

drew, you wasn't using sandboxie?

 

[Drew99GT]

Originally Posted By: Cutehumor
drew, you wasn't using sandboxie?


I do always. Never compute without it. In fact, I went to the site that infected my Dad's computer, got the virus to see how it would work. Actually, Sandboxie would not let the malware even install or run! But Superantispyware kept popping up with the detection. Deleted the Sandbox and it was gone.

Unfortunately my Dad will not learn how to use Sandboxie and he hates it.

 

[Cutehumor]

Originally Posted By: Drew99GT
Originally Posted By: Cutehumor
drew, you wasn't using sandboxie?


Unfortunately my Dad will not learn how to use Sandboxie and he hates it.


sounds just like my wife! she will not use it. maybe because she is too impatient for the five seconds to be up to launch it.

 

[DragRace]

You get a chance Drew,send me a pm with the website,I wanna play with this malware.

I usually run Sandboxie,but atm,I'm running Geswall,which is a browser sandbox as well...

 

[Drew99GT]

Unfortunately, the site is no longer infected. It was from a flash presentation on, of all things, a french horn website!

If you search wilders security forum, they lead you to some Russian and Chinese URLs that will unleash the fury of [censored] on your machine!

 

[DragRace]

No biggie,

I usually goto MalwareDomain for my links,but got bored awhile back,so now when someone finds something,it's game on.