FACEBOOK VIRUS WARNING

esta · Post by **esta** » Fri Nov 07, 2008 8:33 pm

Well some of use it I know as I am friends with you BUT today I had an email from my brother telling me to look at this video of him at a party! Being the party animal he is, I thought nothing of it and opened it! Lo and behold, the virus got me, downloaded 316 viruses, numerous trojans and trojan downloaders! My friend has spent the last 2 horus fixing my laptop-well, its not actually fixed, he deleted Internet Explorer and completely uninstalled it and I am now using FireFox as it is apprently a virus that works on IE. Every now and again it still comes up with a message that says "You need anti virus software click here" and no matter where i click loads of messages keep appearing, so i have to do an END TASK via TASK MANAGER.

Just a warning guys, as no doubt the moment my account was hacked then all my buddies got an email from me!!!

Brasco · Post by **Brasco** » Fri Nov 07, 2008 8:38 pm

Nasty.
Why do people do this...

esta · Post by **esta** » Fri Nov 07, 2008 8:42 pm

Brasco wrote:Nasty.
Why do people do this...

Beats me! I dont understand either, how can they get a kick out of stuff like this? All I know is that my computer would be only bin worthy if it wasnt for my friend as I no nothing of viruses (nice to no my AVG FULL VERSION worked!!

) And no doubt I have many people very angry at me now!!

Ral · Post by **Ral** » Fri Nov 07, 2008 10:20 pm

What version of Windows are you running? To get rid of the last bits of popups etc., run regedit (start, run, type in regedit, click ok) and make the entries in the bottom look more or less like this:

Ctfmon.exe monitors the active windows and provides text input service support for speech recognition, handwriting recognition, keyboard, translation, and other alternative user input technologies. (straight quote from Microsoft that) . Pretty much everything besides that entry you can do without, regardless of what it says it is.

This one has the potential to be a bit more different as some of the entries will be specific to your hardware. So from the top:
AVG 8 antivirus
HP printer monitor
Logitech Mouse stuff
nVidia video card driver stuff
nVidia video card driver stuff
nVidia video card driver stuff
onboard audio driver stuff

If you're unsure, do a search online before deleting, but basically all these are programs/utilities/processes that start up when you turn on the computer. As such, even if it is not virus-related, it generally won't stop things working if you delete it and if it does, reinstalling the driver for whatever stopped working will fix it. Before deleting any entry, do a search on your computer for the executable and if you are deleting it in the registry and it looks dodgy, delete it from your computer as well. Generally, you'll know when it looks dodgy either by the filename or by the location. If the filename looks legit and the location is either C:\Windows or C:\windows\system32, but an online search does not identify it as an MS executable, get rid of it. Let me know if you need any help, or pass the instructions on to your friend of course

Used to be viruses were designed to see if a certain something could be done. These days teens with internet access and a bone to pick with da man, download a pre-made trojan, adjust some values here and there and let loose. Sorry to hear you were hit

Dan the 480 Man · Post by **Dan the 480 Man** » Sat Nov 08, 2008 9:04 am

I got the email from Esta yesterday....but i was too late. I had a message from a 'mate', and i clicked it thinking it was a Vid with me in from school or something. Fortunately, my computer wasn't affected, but it just goes to show no matter how vigilant you are, it's easy to fall for something. It was only when i clicked the link i got a message from Facebook telling me it was stopping me follow the link as it thought the site i was about to visit was malicious...

Bastards! Get a life! Cheers for the shout though Esta...

Big Brother · Post by **Big Brother** » Sat Nov 08, 2008 10:43 am

Eek. I've just got that message off you, good job I read this first

esta · Post by **esta** » Sat Nov 08, 2008 11:48 am

I am so pleased you got my messages, I was so worried about people getting mad at me for emailing them a virus!! Least everyones OK so far! I hve no idea why my AVG didnt pick it up?!?!

@ Ral I will give that a go now...

esta · Post by **esta** » Sat Nov 08, 2008 12:11 pm

@Ral...

I ran regedit and nothing came up, so I typed in "trojan" and got...well, see above!! As you are probably well aware I am a regular on sexparty.com and 100hotbabes.it

Anyway, do I just completely delete all of these then? Thanks for your help

O and actually, thats one of the bubbles tat keeps harassing me below right!

Ral · Post by **Ral** » Sat Nov 08, 2008 1:44 pm

Ah, I knew I'd seen you somewhere before

Yah, see, that key looks like this on my pc:

But at least the one that was highlighted in your screenshot shouldn't be a problem. The value is 4, which means it's in the blocked websites list and the entries may very well have been created by AVG when you installed it. The ones to worry about are the ones with a value of 2, which means they're in the trusted sites list. Regardless of the values in the registry though, it's safer and easier to check these in IE. Tools, internet options, security tab and then check the trusted and blocked sites lists.

That balloon is part of the spyware that's infected your pc. It just wants you to buy, download and install more crap. Click on the balloon to find out what "antivirus" program is "warning" you and then do a search for it on your computer and delete. Or download and install Spybot search and destroy and Lavasoft's AdAware. The two of them together tend to get rid of most crap. Hope you can get rid of the rest of it

esta · Post by **esta** » Sat Nov 08, 2008 2:12 pm

I did a search for ONLINE SPYWARE, as it was (supposedly?) Windows onlien spyware and spylab 2009! Anyhoo, found two IE shortcuts, have deleted and removed from recycle bin, and now there is no yellow triangle with explanation mark and annoying balloon! Nice on Ral!!

Very happy now!

Just to check tho, all those folders in DOMAIN are OK to stay there then?

Ral · Post by **Ral** » Sat Nov 08, 2008 2:19 pm

Yeah, should be if they are all in the blocked site list. Just check that in the IE settings. Excellence, all is well that ends well

esta · Post by **esta** » Sat Nov 08, 2008 2:23 pm

spoke too soon, its literally just got back!! I have completely removed IE, is it the same way of checking thro FireFox?

Ral · Post by **Ral** » Sat Nov 08, 2008 2:28 pm

Check the task manager. Under the processes tab, is there anything that looks like online spyware and/or spylab?

esta · Post by **esta** » Sat Nov 08, 2008 2:44 pm

cant see anything...

Ral · Post by **Ral** » Sat Nov 08, 2008 2:53 pm

I can try connecting to your comp if you like and have a look around?

esta · Post by **esta** » Sat Nov 08, 2008 3:00 pm

yeh if u want, what info do u need?

JohnTurbo · Post by **JohnTurbo** » Sat Nov 08, 2008 5:12 pm

I got the messages....i didn't open them, since it said something about me looking hot in the video of the link.

- Obviously i knew it was bollocks. I never look hot.

bkf_uk · Post by **bkf_uk** » Sat Nov 08, 2008 6:22 pm

i had a very similar virus to this a couple of months ago. i suggest downloading the following freeware to resolve the problem

1, download AVAST home edition antivirus (it's free and kept very uptodate!)

2, Download and run "spybot - Seach and destroy" this removes all spyware and general nasties you dont want.

hope this helps!

esta · Post by **esta** » Sat Nov 08, 2008 6:37 pm

JohnTurbo wrote:I got the messages....i didn't open them, since it said something about me looking hot in the video of the link.

- Obviously i knew it was bollocks. I never look hot.

O, that was a real video JT...

@ bkf_uk-think its all sorted now

THANK U SO MUCH RAL FOR SPENDING GOD KNOWS HOW LONG FIXING MY LAPTOP

Ral · Post by **Ral** » Sat Nov 08, 2008 6:58 pm

'sok. It's easier that way than trying to explain what to do, especially via something as indirect as a message-board

Hope it stays ok