adware infection from banner ad

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

At forum site that has banner ads, I ended up getting infected with winfixer,
and a mirar toobar installed on IE. I ended up restoring a backup of the OS
partition to recover from this.

The explanation from one of the forum admins:

I think an adware/spyware company got into one of the major advertising
servers over the last week and has been serving up an ad the exploits a
security hole in windows that installs some of that stuff without asking.

My fix was to put that site on my list of "restrictect sites".

This problem occured last February. Has this securtiy exploit been fixed
since then? (I regularly install all updates).
 
From: "jeffareid" <[email protected]>

| At forum site that has banner ads, I ended up getting infected with winfixer,
| and a mirar toobar installed on IE. I ended up restoring a backup of the OS
| partition to recover from this.
|
| The explanation from one of the forum admins:
|
| I think an adware/spyware company got into one of the major advertising
| servers over the last week and has been serving up an ad the exploits a
| security hole in windows that installs some of that stuff without asking.
|
| My fix was to put that site on my list of "restrictect sites".
|
| This problem occured last February. Has this securtiy exploit been fixed
| since then? (I regularly install all updates).
|



Two phase answer...

Perform Part 1 then perform Part 2

If the first two parts don't work, perform the alternate utility.

It is suggested that you execute each tool in Normal Mode then in Safe Mode.


If you are using any version of Sun Java that is prior to JRE Version 5.0 update 6,
then you are strongly urged to remove any/all versions that are prior to JRE/JSE
Version 5.0 update 6. There are vulnerabilities in them and they are actively being
exploited. It is possible that is how you got infected with malware.

Therefore, it is highly suggested that if there are any prior versions of Sun Java
to Version 6 on the PC that they be removed ASAP.

The latest version is Sun Java JRE/JSE Version 5.0 Update 8

Simple check, look under...
C:\Program Files\Java

The only folder under that folder should be the latest version.

Such as...
C:\Program Files\Java\jre1.5.0_08


http://www.java.com/en/download/manual.jsp

or

http://java.sun.com/javase/downloads/index.jsp

FYI:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1




Part 1
------------
Download Adware-Virtumundo Removal Tool --
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Information on the Adware-Virtumundo Removal Tool:
http://forums.mcafeehelp.com/viewtopic.php?t=57049

Part 2
------------
Download WinFixerFix.exe from the URL --
http://www.ik-cs.com/programs/virtools/WinFixerFix.exe

Execute; WinFixerFix.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\Normal_ScanReport.HTML or
C:\mcafee\Safe_ScanReport.HTML will be generated. At the end of the scan, it will be
displayed in your browser (Opera, FireFox or Internet Explorer). However, if you are using
WinXP, Win2K or Win2003 your system will be left in a state where you will have to manually
shutdown/reboot the PC. On Win9x/ME platforms the report will not be shown in your bowser
but your PC will automatically be shutdown. It is suggested that you move the report out of
c:\mcafee before performing another scan.

It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.


ALTERNATE:
--------------

Download Atribune's VUNDOFIX.EXE
http://www.atribune.org/ccount/click.php?id=4

Save VUNDOFIX.EXE to "C:\" ( C:\VUNDOFIX.EXE ) and execute it from there.


Please Copy and Paste the contents of the HTML Log files;
C:\mcafee\Normal_ScanReport.HTML & C:\mcafee\Safe_ScanReport.HTML in your reply.

* * * Please report back your results * * *
 
Thanks, I added this to my "stuff.txt" file, which describe installtion,
setup, and general problem solving issues.

As mentioned, I fixed the problem by restoring a backup of the OS partition,
which seems to work the best. Hard drives are cheap, so adding a online and
offline (USB) drive for backup purposes seems the best way to deal with this
stuff, although it takes a bit of time. (Not yet willing to spend the bucks
on a set of 15,000 rpm Segate Cheetah drives to speed this up).

The virus programs seem to have difficulty in removing or detecting viruses.
I have friend that have some high end security programs installed, but still
manage to get infected (the last one cause a flashing hour glass symbol, was
a real pain for my friend to get rid of).
 
From: "jeffareid" <[email protected]>

| Thanks, I added this to my "stuff.txt" file, which describe installtion,
| setup, and general problem solving issues.
|
| As mentioned, I fixed the problem by restoring a backup of the OS partition,
| which seems to work the best. Hard drives are cheap, so adding a online and
| offline (USB) drive for backup purposes seems the best way to deal with this
| stuff, although it takes a bit of time. (Not yet willing to spend the bucks
| on a set of 15,000 rpm Segate Cheetah drives to speed this up).
|
| The virus programs seem to have difficulty in removing or detecting viruses.
| I have friend that have some high end security programs installed, but still
| manage to get infected (the last one cause a flashing hour glass symbol, was
| a real pain for my friend to get rid of).

The WinFixer is a Rogue anti malware utility and is listed as such on SpyWare Warrior
http://www.spywarewarrior.com/rogue_anti-spyware.htm

It is usually installed by messages via the Vundo Trojan which is a Browser Helper Object
(BHO) which gets installed by a vulnerability in Sun Java.

Did you read my information on the Sun Java issue and did you check your version if you have
it installed ?
 
Ok, it's a bit confusing, I had sun java standard edition platform 1.4.2. I
uninsalled this, and will install "Java Software" instead.

So grateful for the Sun / Microsoft lawsuit that got Microsoft Java removed
from IE.
 
From: "jeffareid" <[email protected]>

| Ok, it's a bit confusing, I had sun java standard edition platform 1.4.2. I
| uninsalled this, and will install "Java Software" instead.
|
| So grateful for the Sun / Microsoft lawsuit that got Microsoft Java removed
| from IE.

That's how you got infected with malware. It exploited Sun Java's vulnerbale version;
1.4.2. I
 
There are so many exploits by which BHO's can be installed (some not even
requiring exploits but merely inducing the user to click 'Yes' on a
plausible-looking popup, for example 'You need to update your copy of
Acrobat') that it's nigh-impossible to stop them.

Use Firefox. Opera or Seamonkey.

You still need to patch Java, or turn it off. (I don't even have Java
installed, it's very seldom used.)
 
Back
Top