FBI ALERT SCAM - Malware or Virus ?

[crabby3]

I guess malware is a virus or a virus is malware? 

I was recently attacked by this *FBI thing* and, after jumping through all of the hoops for 5 days, was able to get rid of it; or most of it.  (I think)

Avast didn't block it and couldn't find it. However... Malwarebytes Anti-Malware's Chameleon 'killed the process' and I haven't found any traces left behind.    I've had the free version of Malwarebytes for a while but desided to up-grade to PRO to use the Real-Time-Protection feature.    The Automatic Priority Up-Dates and Scheduled Scanning is pretty good too.  (Pro Version as well)

My computer is still a little slow but at least I have Internet Access again and can search for a free PC tune-up. 

Anyone have any freebies ?  Not just the scan... the whole thing ? 

[tomos]

search for a free PC tune-up

dont! (seriously, most of those are scams too...).
Although, I guess that's what CCleaner does - clear out a lot of stuff which might speed things up a bit.

I have just finished (with a lot of help) cleaning a pc of a trojan that sounds like it could be something similar (was it demanding money?). Note that CCleaner (which was part of the cleanup process) broke the browser install (Opera). Worth it, will probably be ok if I uninstall & reinstall, but point being that cleaning can be a little risky too :-)

Did you get help removing the virus?
There's forums out there that concentrate on helping clear that kind of thing (the only one I know though is in German http://www.trojaner-board.de).

Re speeding up your pc, there's a few things you could do -
   check the programmes that start with windows is a big one (but can require a bit of research).
   Defragment maybe.
   Which OS are you running? Changing to classic theme can help a lot.

Other's more expert than I will hopefully make more concrete recommendations

[crabby3]

My computer is still a little slow but at least I have Internet Access again and can search for a free PC tune-up.   

Anyone have any freebies ?  Not just the scan... the whole thing ? 

I emphasize FREE because sometimes the paid-for versions don't always help or may screw things up more.  Like this one from Windows Help & Support.

It scanned, found, and *fixed* a lot of errors/problems/issues but after it was through I was missing things that shouldn't have been *fixed* (deleted).  Like all of the pre-installed Vista games and also my version of Paint Shop Pro 9... just to name two.  Fortunately I was able to use System Restore and get both back in the same usable condition before this 'BEST' (POS) scan.

I know you can't believe everything you see or read on the web ... but I thought Windows Help & Support could be trusted.    Not so! 

[crabby3]

search for a free PC tune-up

dont! (seriously, most of those are scams too...).
Although, I guess that's what CCleaner does - clear out a lot of stuff which might speed things up a bit.

I have just finished (with a lot of help) cleaning a pc of a trojan that sounds like it could be something similar (was it demanding money?). Note that CCleaner (which was part of the cleanup process) broke the browser install (Opera). Worth it, will probably be ok if I uninstall & reinstall, but point being that cleaning can be a little risky too :-)

Did you get help removing the virus?
There's forums out there that concentrate on helping clear that kind of thing (the only one I know though is in German http://www.trojaner-board.de).

Re speeding up your pc, there's a few things you could do -
    check the programmes that start with windows is a big one (but can require a bit of research).
    Defragment maybe.
    Which OS are you running? Changing to classic theme can help a lot.

Other's more expert than I will hopefully make more concrete recommendations

Was it demanding money?  Yes. My version of this scam wanted $350 USD. 

Did I get help removing the virus?  If you mean tech-support... no.  I'm a computer novice, at-best, but was able to access a friends computer (novice also) and print 22 pages listing several ways to fix this issue.  My best solution or fix was on page 21... in the feedback section... from a great person named tom. 

As far as speeding up my PC... I'll check to see what starts with Windows.  This may be the answer.

And... my machine is set to auto de-frag weekly.

And... my OS is my current DC signature... you know... Windows Vista blah, blah, blah...  listed under all of my posts. 

[tomos]

Did I get help removing the virus?  If you mean tech-support... no.  I'm a computer novice, at-best, but was able to access a friends computer (novice also) and print 22 pages listing several ways to fix this issue.

mine required about 15 different steps using 7 different apps - we didnt find anything more after step #8 or so, and most of the steps at the end were precautions to help avoid recurrence (e.g. disabling java).

Changing to Classic theme will speed Vista up - you can make the classic theme look a lot better than it's default if you make the grey background very light and mess around with titlebar colours.

RE checking what starts with windows, there's a few apps out there that show you what does:
    Autoruns (free)
    WinPatrol (the Plus version will give you info about apps - I'm not sure about the free version)
    Codestuff Starter (free)

I hate doing that on laptops cause they always have so much 'stuff' starting up and you've got to look up a lot of them to see if they're important (be careful here too! I mean dont just stop everything or your pc might not work any more...). Maybe it's just as bad on PC's with pre-installed OS, I dont know any more (thankfully).

[crabby3]

Did I get help removing the virus?  If you mean tech-support... no.  I'm a computer novice, at-best, but was able to access a friends computer (novice also) and print 22 pages listing several ways to fix this issue.

mine required about 15 different steps using 7 different apps - we didnt find anything more after step #8 or so, and most of the steps at the end were precautions to help avoid recurrence (e.g. disabling java).

Changing to Classic theme will speed Vista up - you can make the classic theme look a lot better than it's default if you make the grey background very light and mess around with titlebar colours.

RE checking what starts with windows, there's a few apps out there that show you what does:
    Autoruns (free)
    WinPatrol (the Plus version will give you info about apps - I'm not sure about the free version)
    Codestuff Starter (free)

I hate doing that on laptops cause they always have so much 'stuff' starting up and you've got to look up a lot of them to see if they're important (be careful here too! I mean dont just stop everything or your pc might not work any more...). Maybe it's just as bad on PC's with pre-installed OS, I dont know any more (thankfully).

I didn't count the steps over those 5 miserable days but it was probably way more than 15.  I don't just click stuff because it's there to click; which is probably why it took so long.  But... if nothing else, Tomos, we've supplied other possible victims of this scam ways to fix this.  Instead of just giving up and buying another machine... which crossed my mind a few times. 

Malwarebytes offers a download called StartupLite that "provides a safe, easy, and efficient way to eliminate unnecessary applications that start when you turn on your computer."  They used 2 of my favorite words... safe and easy.    So I'll try this first.

My machine is a laptop, BTW, so StartupLite may help.  If it doesn't I may just try to be more patient during startup because the slowness goes away after about 15 minutes.  And... I probably won't switch to Classic Theme... IMO it's too boxy looking and plain.  I don't need pretty but plain is too plain. 

---------------------------------

Why is Java so easy to exploit?  Almost all of my AV scans, that find a virus, have something to do with Java.  I have a Java Update, sitting in my tray right now, waiting to be installed.  I put it off because I figured... what's the hurry.  This update may patch a few holes... but what about the other five million. 

[mwb1100]

However... Malwarebytes Anti-Malware's Chameleon 'killed the process' and I haven't found any traces left behind.

I'm glad to hear that MBAM worked to clean this up for you.  I have MBAM so this gives me hope that it may actually help save my bacon someday and that the small amount I paid for the Pro version wasn't a waste.

[crabby3]

However... Malwarebytes Anti-Malware's Chameleon 'killed the process' and I haven't found any traces left behind.

I'm glad to hear that MBAM worked to clean this up for you.  I have MBAM so this gives me hope that it may actually help save my bacon someday and that the small amount I paid for the Pro version wasn't a waste.

I agree, mwb1100, it's hard to believe how well it works to block or kill this stuff for a one-time-charge of less than $30 USD.   

[app103]

Why is Java so easy to exploit?  Almost all of my AV scans, that find a virus, have something to do with Java.  I have a Java Update, sitting in my tray right now, waiting to be installed.  I put it off because I figured... what's the hurry.  This update may patch a few holes... but what about the other five million.  

My recommendation is that if you do not need Java installed for one of your desktop applications, uninstall it. And if you do need it, make sure you disable Java from running in any of your browsers. Any website that needs Java to work properly, you probably can live without. And I know you can live without the malware that will seek to exploit Java to get on your system. Malware is a heavy price to pay for viewing an occasional website that might depend on Java to work.

[IainB]

...My recommendation is that if you do not need Java installed for one of your desktop applications, uninstall it. And if you do need it, make sure you disable Java from running in any of your browsers. Any website that needs Java to work properly, you probably can live without. And I know you can live without the malware that will seek to exploit Java to get on your system. Malware is a heavy price to pay for viewing an occasional website that might depend on Java to work.

Yes, I reckon that's good advice.
This is the Firefox warning (Java disabled):

[attach]

[crabby3]

Why is Java so easy to exploit?  Almost all of my AV scans, that find a virus, have something to do with Java.  I have a Java Update, sitting in my tray right now, waiting to be installed.  I put it off because I figured... what's the hurry.  This update may patch a few holes... but what about the other five million.   

My recommendation is that if you do not need Java installed for one of your desktop applications, uninstall it. And if you do need it, make sure you disable Java from running in any of your browsers. Any website that needs Java to work properly, you probably can live without. And I know you can live without the malware that will seek to exploit Java to get on your system. Malware is a heavy price to pay for viewing an occasional website that might depend on Java to work.

Thank you, app103, for your recommendations.  I have uninstalled Java from my machine.  Mainly because it was less complicated than disabling it in IE9.  Don't know what desktop apps I have that need it to function but... you're right... I can probably live without 'em.

Thanks again. 

----------------------------

Sooooo... I guess nobody really knows why Java is so easy to exploit.... including Sun Microsystems/Oracle Corp. 

----------------------------

Before I deleted Java... I was getting Java Update pop-ups here at DC each time I clicked a blue link.  They looked like the same version I already had and made me suspicious so I *Canceled* each one... and then the links I clicked would open.  They stopped after the uninstall.  I guess these were fake updates?  Malware? 

[Giampy]

Before I deleted Java... I was getting Java Update pop-ups here at DC each time I clicked a blue link.  They looked like the same version I already had and made me suspicious so I *Canceled* each one... and then the links I clicked would open.  They stopped after the uninstall.  I guess these were fake updates?  Malware? 

Thanks to your caution I believe you have avoided some malware:
http://dottech.org/93867/beware-of-fake-java-update-patch-it-contains-malware

[app103]

Now that you have uninstalled Java, you won't have to worry about updating it any more, and any popups offering a Java update should be mistrusted from this point on.

[Giampy]

Before I deleted Java... I was getting Java Update pop-ups here at DC each time I clicked a blue link

It's not clear: did those pop-ups appear even after you used the antimalware programs? (Malwarebytes Anti-Malware and SpeedMaxPc)

[crabby3]

Before I deleted Java... I was getting Java Update pop-ups here at DC each time I clicked a blue link

It's not clear: did those pop-ups appear even after you used the antimalware programs? (Malwarebytes Anti-Malware and SpeedMaxPc)

The pop-ups appeared today, Monday - January 21, 2013 (on my part of the Earth), after I had used Windows System Restore to dump SpeedMaxPc and recover the files it had deleted.  And after I had upgraded to Malwarebytes Anti-Malware Pro.  But before... I had uninstalled Java.

NOTE:  I didn't run/install any of them... I clicked the Cancel button on all of them... so I didn't give any of my anti-malware programs a chance to see them.  Including Malwarebytes Anti-Malware Pro.

Also... I don't think SpeedMaxPc is an anti-malware program.  I think it's more of a post-repair PC Tune-up.

The pop-ups looked a little screwy too.  The little update dialog box was surrounded by a greyed-out area that filled the rest of the screen but I could see the DC page I had clicked on behind it... like looking through sunglasses.  And... I think there was an X in the upper right-hand corner of the grey area.  I tried to screen capture it but something wouldn't let me.
I've seen this greyed-out screen before... when some site is running a survey and wants my opinion.  But not for program updates of any kind. 

Hope this explains it better. 

BTW  SpeedMaxPc's Tech-support page was 'Off-Line' yesterday and also today ... so maybe it's just another scam too.  Hopefully it's just because of the USA Holiday Weekend (MLK).

[tomos]

I missed your earlier post about SpeedMaxPc:

I've no idea who SpeedMaxPc are but I wouldnt trust them an inch!!
Even if they arent trying to scam you in any way (and they may well be trying to scam you), their methods can be dangerous for your computer.

BTW   SpeedMaxPc's Tech-support page was 'Off-Line' yesterday and also today ... so maybe it's just another scam too.  Hopefully it's just because of the USA Holiday Weekend (MLK).

maybe you were just checking but please dont try and get help from them...

I know you can't believe everything you see or read on the web ... but I thought Windows Help & Support could be trusted.     Not so!  

Note: that's got nothing to do with Microsoft !!


One last point - you've probably taken this into account but I say *in case*: you gotta be very careful using system restore after having had a virus - that you dont reintroduce anything. One of the things I did was to turn it off completely and then on again - in order to delete any restore points that might have been infected.

[tomos]

Do you have a good anti-virus - as well as having Malwarebytes? I read in the last week (sorry no link) that Malwarebytes real-time protection doesnt actually have the best reputation. It is supposed to work very well though with Microsoft Security Essentials and Avira Anti-Virus (and possibly other Anti-Virus programmes too).

Might be worth looking at your browser settings & add-ons as well. In settings you can usually block popups. Re add-ons, you can get many that are very helpful (adblock plus, flashblock, and ghostery - these are all easy to use and make a huge difference to security).

[Giampy]

The pop-ups appeared today... after I had used Windows System Restore

I wonder if there is a link between the two facts.
Has perhaps Windows System Restore recalled a system that was already infected?

[tomos]

The pop-ups appeared today... after I had used Windows System Restore

I wonder if there is a link between the two facts.
Has perhaps Windows System Restore recalled a system that was already infected?

my edit overlapped with your post:

One last point - you've probably taken this into account but I say *in case*: you gotta be very careful using system restore after having had a virus - that you dont reintroduce anything. One of the things I did was to turn it off completely and then on again - in order to delete any restore points that might have been infected.

[mwb1100]

I read in the last week (sorry no link) that Malwarebytes real-time protection doesnt actually have the best reputation.

My impression is that MBAM has a good reputation for dealing with trojans and spyware, but not viruses (it's not intended as an anti-virus). Now let me say that this is one of the problems I have with anti-malware software in general - I don't care whether malware is a trojan, a virus, spyware or something else; I don't even really know or want to know what the differences might be.

All I know is that there's stuff that I don't intend to install on my computer and that I don't want it to be able to 'force' or 'trick' itself onto my computer. What category that malware might fall under is of no concern to me. It's all just garbage that I don't want, and  I just want my antivirus/anti-malware/anti-spyware/whatever to prevent infection and clean up infections that happen.

And I want the anti-malware to do that without it making my system slow or unstable (and ideally to do this without bugging me with a lot of questions I can't answer anyway).

That may be a tall order, but that's what I want.

[Tinman57]

And I want the anti-malware to do that without it making my system slow or unstable (and ideally to do this without bugging me with a lot of questions I can't answer anyway).

That may be a tall order, but that's what I want.

  I think you'd be happy with the free version of Avast! Anti-Virus.  It don't slow my system at all unless I'm doing a complete manual system scan.  The pro-version has a bunch of bells and whistles that you may or may not use.  You can read all about it on their website.

  My free firewall, Comodo, also stops a lot of malware with it's system defense and sandbox.  Comodo also includes an anti-virus, but I can't claim how good it may or may not be since I don't use it.  I'm pretty much hooked on Avast!

[crabby3]

I missed your earlier post about SpeedMaxPc:

I've no idea who SpeedMaxPc are but I wouldnt trust them an inch!!
Even if they arent trying to scam you in any way (and they may well be trying to scam you), their methods can be dangerous for your computer.

BTW   SpeedMaxPc's Tech-support page was 'Off-Line' yesterday and also today ... so maybe it's just another scam too.  Hopefully it's just because of the USA Holiday Weekend (MLK).

maybe you were just checking but please dont try and get help from them...

I know you can't believe everything you see or read on the web ... but I thought Windows Help & Support could be trusted.      Not so!   

Note: that's got nothing to do with Microsoft !!


One last point - you've probably taken this into account but I say *in case*: you gotta be very careful using system restore after having had a virus - that you dont reintroduce anything. One of the things I did was to turn it off completely and then on again - in order to delete any restore points that might have been infected.

TOP PART:
I wish we lived nextdoor to each other, tomos, so I could just trot over and bug you with endless questions...  unfortunately we don't.   
So I come here to DC seeking *after-the-fact* advice.   

FIRST QUOTE:
Yesterday and the day before I visited SpeedMaxPc's Tech-Support page to try to find a way to contact them directly via email or phone.  They offered a 30-day Money Back Guarantee on their product... and I wanted my money back.    After I had, downloaded, installed and ran a scam scan... I found out I had to buy the full version to *fix* the stuff it found. 

SECOND QUOTE:
Why doesn't it have anything to do with Microsoft?  I know SpeedMaxPc isn't a Microsoft product... but why would they allow SpeedMaxPc to use their Windows Help & Support header... if it wasn't at least endorsed by Microsoft? 

LAST PART:
I was in a bit-of-a-panic when SpeedMaxPc deleted stuff I wanted or needed... so I didn't sit and think about... I just picked the first System Restore Point before the SpeedMaxPc install.  (It was the only Windows System Restore Point listed, BTW, I guess because this *FBI ALERT SCAM* had deleted all the others?) 

[cmpm]

crabby3, There is no "SpeedUp" for windows program that works.
Even if it is endorsed by Microsoft.
Don't believe everything you read on the net.

The simple way would be to reinstall windows.
If you don't want to do that, try TFC.
A temporary file cleaner.

http://www.geekstogo.com/forum/files/file/187-tfc-temp-file-cleaner-by-oldtimer/

Read about what it will clean.
Search the net for info about it.
Ask on sites where you value their opinion.
Then, maybe, download and run it.

[crabby3]

Do you have a good anti-virus - as well as having Malwarebytes? I read in the last week (sorry no link) that Malwarebytes real-time protection doesnt actually have the best reputation. It is supposed to work very well though with Microsoft Security Essentials and Avira Anti-Virus (and possibly other Anti-Virus programmes too).

Might be worth looking at your browser settings & add-ons as well. In settings you can usually block popups. Re add-ons, you can get many that are very helpful (adblock plus, flashblock, and ghostery - these are all easy to use and make a huge difference to security).

I have Avast! Internet Security... the paid-for version... with all the bells and whistles.    Don't know if it's good or bad... but IMO it's better than Norton or McAfee.  I think paint dries faster than Norton's scans and... a couple years back I got a bad update from McAfee that locked-up my machine for 3 days... so they're history too.  Haven't tried any others yet.

In Internet Settings the popup box was already checked and the Blocking Level was set to Medium... should I increase to High? 

-------------------------

  I think I've found the reason for my machines sluggishness during start-up.    Avast, Malwarebytes, SuperAnti-Spyware, SpyBot S&D, PickPic and PNotes all load with Windows.    That's okay... I use or need most of these daily... so I'll just live with the slow starts.    For me, anyway, it's easier to click on a pre-loaded tray icon... than it is to track it down in the Start Menu.

[tomos]

I think paint dries faster than Norton's scans

thanks for the laugh of the day


(will reply to other comments shortly)