Topic: **VIRUS ALERT** Cornficker to activate April 1st

[UncleBob]

What's this porn you all speak of?

Give me some links so I can figure out what you're talking about.

[EasyCure]

[

What's this porn you all speak of?

Give me some links so I can figure out what you're talking about.

www.unclebobsmannipples.com

[ThePerm]

so i got another virus, this time i was checking out tmz.com checking out the death of Billy Mays and "Protection System" decides it wants to install itself without asking. This is the most rediculous **** ever, i need to do a format, but i can't because i got too much work on my portfolio, i'm going to have to clear out an extra hd, move my stuff. Format the existing hd and then re-install windows. Luckily ubuntu has my back, and i can use it when crap aint working. I would just use ubuntu, but gimp is not quite as nice as photoshop, and ubuntu wont seem to install itself on my computer, every time i run it, it always decides its in installation mode. ugh. if i could get aholf of the person who created this virus, i would torture them for days. I get over a virus, re-install windows, everything is fine for like a month, then i have to do it again, ok system works i think im in the clear, nope. this time this thing is worse and i can't fix it. This thing has root access and unless i format this thing will always be there.

[BranDonk Kong]

Do you have any antivirus software? Get Windows Live OneCare, it's free for 90 days, and you can get the full version on eBay for $15 or so, and install it on 3 computers for a year. Also, don't go to tmz.com.

[ThePerm]

the virus wont let me download from any anti virus sites, if i go to any one of them it punishes me by putting links to pornotube, and like other porno sites with porn icons on my desktop. Yeah im thinking about going to the store and buying something.

[BlackNMild2k1]

Man you gotta do something. You don't have a friend that can download the program and put it on a disc for you, then you boot up in safe mode and install it?

[NinGurl69 *huggles]

it might block that installation too.

[Stratos]

it might block that installation too.

Try installing in SafeMode. You might get lucky and trick the virus.

Also, sometimes you can just brute force your way through the installation process depending on how it is stopping you. You say it 'punishes' you. Is that all it does, add links and pop ups? Or do you actually get error messages that stop the install process?

[BranDonk Kong]

Do this - take out your HDD, get an external enclosure (you can take it back when you're done), but it in the enclosure, and let someone else with some antivirus software clean it for you. You can also create a new FAT32 partition in Ubuntu (I assume, or just a RAW partition), then install a fresh copy of Windows there, download the AV software, and clean all of your partitions. Reinstalling Windows is a last resort.

[Stratos]

If the Win32 kernel is infected you may just be screwed.

[EasyCure]

the virus wont let me download from any anti virus sites, if i go to any one of them it punishes me by putting links to pornotube, and like other porno sites with porn icons on my desktop. Yeah im thinking about going to the store and buying something.

Damn even i don't get stuff that annoying.

If the Win32 kernel is infected you may just be screwed.

The what? I believe i've had this affected for awhile.. but i might be confusing win32 for something else..?

[ThePerm]

i would fix everything from ubuntu, but i can't. Ubuntu just doesnt recoginize my drive. Its as if its not there at all, It reads my hd on the pATA cord, but not the SATA cord. I think the newer version of Ubuntu might. I have Ubuntu 8, but not 9..i need to make a new bootdisk.

[Stratos]

If the Win32 kernel is infected you may just be screwed.

The what? I believe i've had this affected for awhile.. but i might be confusing win32 for something else..?

The Windows API, informally WinAPI, is Microsoft's core set of application programming interfaces (APIs) available in the Microsoft Windows operating systems.

Base Services-
Provide access to the fundamental resources available to a Windows system. Included are things like file systems, devices, processes and threads, and error handling. These functions reside in kernel.exe, krnl286.exe or krnl386.exe files on 16-bit Windows, and kernel32.dll on 32-bit Windows.

[ThePerm]

yeah when i reinstall windows and i look at the computer management,  Theres an error warning that says an unknown accesses the root before i've finished installing the new version of windows. If this were on my pATA drive, i could just fix it from linux by deleting all windows directories, like documents and settings, program files, and windows. What i worry about is where else is this thing stored. I stuck a sd card in my dads computer and the thing had a file name Belkinblahblah.exe for the virus, luckily that computer is solidly protected and AVG caught it before it was a problem. I would have had my AVG on, but i have to turn it off to run certain programs. Anyhow so i caught the virus. I'm wondiering if its possible for the virus to install itself on my wireless G belkin thumb adapter. Its not a storage drive, but im wondering if the virus can install itself on the firmware with a redirect for AVG. Like i said I have thought about ways to torture the virus programmer.

[EasyCure]

If the Win32 kernel is infected you may just be screwed.

The what? I believe i've had this affected for awhile.. but i might be confusing win32 for something else..?

The Windows API, informally WinAPI, is Microsoft's core set of application programming interfaces (APIs) available in the Microsoft Windows operating systems.

Base Services-
Provide access to the fundamental resources available to a Windows system. Included are things like file systems, devices, processes and threads, and error handling. These functions reside in kernel.exe, krnl286.exe or krnl386.exe files on 16-bit Windows, and kernel32.dll on 32-bit Windows.

*sits in corners with knees to chest, rocking back and forth*

[Stratos]

Backup what you can and reformat is what I would say. And make sure the way you back it up is secure so any viruses do not spread.

[EasyCure]

And make sure the way you back it up is secure so any viruses do not spread.

How do i install a gun on my pc?

[NWR_insanolord]

And make sure the way you back it up is secure so any viruses do not spread.

How do i install a gun on my pc?

Use duct tape.

[Shift Key]

I have Ubuntu 8, but not 9..i need to make a new bootdisk.

Back it all up and start over. Don't worry about cleaning it up because it sounds like you've got an entrenched bit of malware.

*sits in corners with knees to chest, rocking back and forth*

These days you don't even need root access to do some nasty stuff. The really scary stuff is coming in through the web browser - as what happened to Perm, he was the victim of a drive-by-download attack. Didn't need any user interaction, didn't trigger any admin warnings or prompts. It just used an exploit in IE7 (it may not be, but my money's on that) to install something to a protected directory and BAM, compromised machine.

Pro Tip: Firefox + AdBlock + NoScript. Seriously, protect yourself out there.

Visiting random sites is also a quick and easy way to get infected with something random.

And make sure the way you back it up is secure so any viruses do not spread.

Put it onto a secondary drive. Nuke it. Reinstall and setup antivirus and install those system updates and patches. THEN (and only then) do you even consider bringing over your files.

If this were on my pATA drive, i could just fix it from linux by deleting all windows directories, like documents and settings, program files, and windows. What i worry about is where else is this thing stored. I stuck a sd card in my dads computer and the thing had a file name Belkinblahblah.exe for the virus, luckily that computer is solidly protected and AVG caught it before it was a problem. I would have had my AVG on, but i have to turn it off to run certain programs. Anyhow so i caught the virus. I'm wondiering if its possible for the virus to install itself on my wireless G belkin thumb adapter. Its not a storage drive, but im wondering if the virus can install itself on the firmware with a redirect for AVG.

1. 90% of the time, once malware has root access, it'll bury itself in a combination of places - the most common that I've dealt with is "C:\Windows\System32" and "C:\Program Files\*some application name*".

2. Ugh. Not that I have the full story, but antivirus isn't a _sometimes_ thing. You never appreciate it until you realise you weren't using it.

3. To perform a firmware update (lets say he wanted to prevent USB wireless dongles from being used to surf to AV sites), the malware guy would need to have a modified-but-still-working firmware available for each possible chipset/manufacturer/device combination. He may target only your device chipset, but the cost-benefit ratio is heavily weighted in the cost category. If I were a bad guy it'd be easier to monitor network activity at the kernel level and block your AV attempts there (and I don't have to worry about targeting the underlying hardware). Much less effort for much more benefit.

[ThePerm]

no it wasn't internet explorer it was firefox...so watch out. Firefox might be too popular nowadays making it a target, might want to switch to opera, although that could turn into a Jim's Drugs sort of situation

[NinGurl69 *huggles]

Did you use No Script or not?

[Seamonkey supports FF's plugins, so i'm good]

[BlackNMild2k1]

No new VIRUS ALERT or anything, but a new article about the Cornficker virus was posted today and though some of you might want some reading material to help pass the time at work.

http://www.theatlantic.com/magazine/print/2010/06/the-enemy-within/8098/