Computer Viruses: html framer & exploit; false positives?

The night before last something odd happened - we both got "Resident Shield" warnings on our computers, at about the same time.  Patti Anne got a warning about a virus called "HTML Framer", and I got a warning about a virus called "exploit". 

I'm extremely cautious when things like this pop up, based on my previous experience with rouge ware.  Resident Shield is a valid part of the AVG package, but it can also be mimicked, and if this was rogue ware, nothing good would happen if you clicked quarantine or fix or anything similar.  Although, if it was rogue ware, the very fact that it showed up probably meant that it was too late.

Patti Anne started a Malware-bytes quick scan, then an AVG scan, without replying to the prompt.  Malware came back clean, but AVG found two instances of html framer, both lurking in the temporary files somewhere.  It removed them.

I also started an Malware-bytes quick scan, just for s&g, and that is when Resident Shield popped up saying I had the "exploit" virus.  Exploit creates havoc in excel spreadsheets apparently.  I use excel a fair amount, tracking our eBay income & expenses, so that would not be good.  

By this time I was fairly certain that this was a valid warning.  I also had decided to run a full AVG scan so I clicked the ignore button.  The Malware scan came back clean, but the AVG scan found one instance of "exploit", again in a temporary file.  It removed it.

The next day Patti Anne got the resident shield warning for html framer again, but this time clicked on the quarantine button.  Neither of us has had any problem since.

Turns out, according to an AVG forum, "html framer" was most likely a false positive - and they've already put out a fix.  Don't know about "exploit" but it seems to be gone too.

So there we go.  More fun in computer land.

Rogueware fixed (maybe) - Trojan Horse Cryptic.AM

Our very own Patti Anne managed to get things working yesterday evening.  We both have computer backgrounds, and we both know (yes, even me) that most problems can be solved.  This stuff doesn't happen out of thin air, it's not magic.  It came from somewhere, it exists somewhere, and it can be dealt with.  This can be a challenge however.  You have to have some skills, and frequently some good fortune.

So here's what happened:

- A pdf pops up out of nowhere
- Something called Windows XP Anti-Virus Pro starts running, warning me that I have all kinds of problems
- XP Anti-Virus Pro wants me to register their product (i.e. send them money)
***Don't ever send these people money. It will do no good. Personally, I'll remove my hard drive and smash it with a hammer before I send any money to someone who has hijacked my computer.
- My normal anti-virus software is disabled
- I am unable to download anything
- I am unable to do a system restore
- XP Anti-Virus Pro perfectly mimics Windows Security
- Everything it warns you about is bogus

If you search google, you can find out all sorts of info about this program, with instructions on how to remove it.  My problem is, they all involved downloads of anti-virus software at some point, and I could not download anything.  It effectively disables all your protections and makes it impossible to go online "safely".

Patti Anne took a different approach to the problem. On another computer she typed in "cannot run mbam.exe" (some additional anti-virus software we have), and "a virus has taken over my computer".  She got different information.

So here's what she did:

- she created an "Avira" rescue CD on an non-infected computer
- she put the rescue CD in the CD drive on the infected computer
- she booted up the infected computer in safe mode
*** I have to remember that "safe mode" is F8, not F-anything else.  Also, Patti Anne is not sure that the rescue CD actually did anything.  Just keep that in mind
- from safe mode, she was able to do a system restore to an earlier date
*** I know this worked, because my desktop wallpaper changed; also it's significant, because I could not do a system restore normally.
- at that point we could execute malwarebytes (full scan)
- also, my normal anti-virus software, which had been scheduled to run earlier but didn't, kicked off.

Malwarebytes came back clean - it didn't find anything.

My other software did find something - "Trojan Horse Cryptic.AM", and removed it.   I looked in the history and found that this software had kicked off as scheduled hours earlier, but ended abnormally, with an error message saying its log file was corrupted. Further searching showed that the software had actually found this trojan the first time it had started, in a different location, and had also removed it.  The scan still ended abnormally, and my computer was still infected.

I can't begin to describe how uneasy I feel about all this.  I do not feel secure at all.  Neither of us are a 100% sure that this particular issue is solved. We don't know if this "Cryptic.AM" was the culprit or not, though it seems a likely suspect.   But we've got an online business going, so we need to keep on trudging along.  At the moment, everything appears normal.

This stuff is apparently quite well known, so neither of us understands how it gets past firewalls and our anti-virus software. (I use anti-virus to mean everything, trojans, spyware, adware, etc., just so you know)

Any comments or ideas about this will be very welcome.

Here we go again - more Rogueware & Ransomware

I don't know what it is about me and viruses.  Or perhaps it's trojans, worms, malware, whatever.  I don't know what it is.  Once again my computer is unusable.

I wasn't doing anything weird.  Well, I was for me - for some reason I decided to check out the Drudge Report.   I don't really like the Drudge Report, not for any reasons that are important, but for completely superficial reasons.  I don't like the font it uses.  It irritates me.  But, there it was on my favorites so I decided to check it out.

I don't think I even clicked a link on the site.  I was just staring at it wondering why I was there, when a PDF file began loading.  I remember thinking, "why is a pdf file loading?"  That was the wrong thing to do. The right thing to do would have been to pull the plug.  Not push the button, but pull the plug, immediately switch off the power, no matter how unadvised that normally is.

A few seconds later I recieved warnings that my firewall was turned off, and a scan from something called "Windows XP Anti-Virus Pro" begin running, finding of course, a million evil things, which for the most part, I'm sure don't exist.  It perfectly mimics windows security, except it wants me to register the product.  I didn't do that, because then it's going to ask for money, and there is no way I'll send money to whoever I'd be sending it to.

As seems to be common with these things, it disables the normal anti-virus type software I run, and I don't seem to be able to do anything about it.  It also doesn't allow downloads, system restores, etc etc etc etc etc. This makes it very dangerous to spend any amount of time online.

This little post is coming to you via my laptop, the one which the system thinks has counterfit software on it.  It doesn't.  When I switched security software awhile back, that message popped up, and I cannot find the key used when the software was orginally loaded.  So screw it.

Anyway this little PC seems to come in very handy as a back up. 

So I guess I'll have to run down to Ron the Computer Guy down on Main Street, 'cause I can't figure out how to fix it on my own.  This is the 2nd time in the last 2 or 3 months, so this can't continue to happen. 

But I don't know what to do - it is extremely frustrating.  I don't know how to keep this from happening or how to fix it when it does.  The security software is apparently useless against this.

Rogueware and Ransomware

Well now I have a name to put to it, not that it matters.  I came across an article that talked about exactly what I had experienced. (See my post for Jan 14th).

Twice in the last year programs looking very legitimate, in fact imitating windows security systems, popped up on my screen and informed me I had some nasty viruses on my computer.  They gave me the option of getting rid of them by pressing the "ok" button, or ignoring it by pressing the "cancel" button. 

I handled this incorrectly both times, and both times I got to a place where they wanted me to send them money in order to fix the problem.  If you get that far, you've screwed up.  The first time I should have known better, the second time I was tired and just wasn't paying attention.  The software & message looked very similar to software I was familiar with, but it was anything but.

If a message pops up, look at it very carefully, make sure it's legitimate.  Do not respond "ok" or "cancel", until you're positive - those buttons can be programmed to do anything.  If you're not positive you're dealing with your normal anti-virus software, hit the red x in the upper right corner to close the program, or just manually turn off your computer and wait a few minutes.  When you're back run a complete scan - if you can. Hopefully that will deal with it.  If not, try to figure out how to remove it manually.

I reckon.

These programs look very authentic, they hijack your computer to or greater or lesser degree and won't give it back until you send them money (so they say).  Anyone who is criminal enough to highjack my computer is probably not to be trusted with my credit card information, and under no circumstances will they get it.  I will (and did) reformat my hard drive and re-install the operating system before I send them money.

Ok, so hopefully I'm ready for the next time.