Malware on W7 has me upset

[texpat]

This is just venting some serious <snip> here, so just bear with me - if you're up to it...

Ubuntu runs on three machines I use and it works wonderfully. It just works. I mean, I couldn't love it more. Its like being married for decades: we both know what goes on, a gesture, a glance and the other just does what has to be done.

Recently, though, I took on a job that requires me to use Windows-only software (Google Sketchup, plus a series of related stuff, like Layout and special PDF gear, if you have to know - no, it doesn't perform well under WINE, very much to my distress).

So I get this computer with Windows 7 and I immediately stick an anti-virus (AVG) and anti-spyware (Spybot S&D) system on it. No need to say that this alone, what, with its resident agents and on-demand scanning stuff, bogs down the otherwise super-efficient four-core, 64-bit hardware to just-about-workable. I also run registry cleaning software every so often and backup all the bloody time - just in case.

You know whats next, don't you? Yep, bloody virus infection. Its called cycbot or somesuch, and it pretty much disables any anti-malware gear on the machine and goes on doing whatever it is that viruses do: subdue your computer into zombie-dom...

So your humble servant - me - checks out what goes and you know what? Its all over the <snip> Internet. This isn't some exotic zero day exploit that some script kid came up with. No, this is major league botnet malware that roams the interwebs.

Its also not easy to get rid of. I'd normally opt for wiping my drive and start from scratch, but my brand-spanking-new Dell Inspiron didn't come with installation media...!? So I spend like ages reading forums, downloading special cleaning software, running said software, getting mediocre results, as in it'll kill suspicious processes and registry entries but a day later I'm back where I was (or better: the virus is back where it was).

Take this as you like, but if I ever have the choice, I'll go for boring, stable, reliable and TRANSPARENT Linux any day.

[haqking]

This is just venting some serious <snip> here, so just bear with me - if you're up to it...

Ubuntu runs on three machines I use and it works wonderfully. It just works. I mean, I couldn't love it more. Its like being married for decades: we both know what goes on, a gesture, a glance and the other just does what has to be done.

Recently, though, I took on a job that requires me to use Windows-only software (Google Sketchup, plus a series of related stuff, like Layout and special PDF gear, if you have to know - no, it doesn't perform well under WINE, very much to my distress).

So I get this computer with Windows 7 and I immediately stick an anti-virus (AVG) and anti-spyware (Spybot S&D) system on it. No need to say that this alone, what, with its resident agents and on-demand scanning stuff, bogs down the otherwise super-efficient four-core, 64-bit hardware to just-about-workable. I also run registry cleaning software every so often and backup all the bloody time - just in case.

You know whats next, don't you? Yep, bloody virus infection. Its called cycbot or somesuch, and it pretty much disables any anti-malware gear on the machine and goes on doing whatever it is that viruses do: subdue your computer into zombie-dom...

So your humble servant - me - checks out what goes and you know what? Its all over the <snip> Internet. This isn't some exotic zero day exploit that some script kid came up with. No, this is major league botnet malware that roams the interwebs.

Its also not easy to get rid of. I'd normally opt for wiping my drive and start from scratch, but my brand-spanking-new Dell Inspiron didn't come with installation media...!? So I spend like ages reading forums, downloading special cleaning software, running said software, getting mediocre results, as in it'll kill suspicious processes and registry entries but a day later I'm back where I was (or better: the virus is back where it was).

Take this as you like, but if I ever have the choice, I'll go for boring, stable, reliable and TRANSPARENT Linux any day.

just to be pedantic, cycbot is a trojan/backdoor and not a virus, but does come under the malware definition.

It has been around for a while.

make sure you use upto date definitions in your anti malware solutions.

And always have backups and/or restore points and/or clones of your system which is the first thing you should do upon install or receipt of built system and definately before connecting to the internet then this type of thing is never a problem.

Cheers

[CharlesA]

The system admin at your job should have locked the machine down.

I am betting the machine was running on an admin account too.

[haqking]

The system admin at your job should have locked the machine down.

I am betting the machine was running on an admin account too.

+1

indeed, if it is a work machine the IT dept should have a backup for easy restore and tied down to try and prevent such things.

System security is always down to the user/admin for the most part

Cheers

[QIII]

Let's not be so sure of our secure redoubt that we miss the the PFY (pimply faced youth) who is even now ready to release into the wild an siege engine that, sapper like, will reduce our ramparts to rubble in a great explosion and leave our flank open to those who besiege us.

[haqking]

Let's not be so sure of our secure redoubt that we miss the the PFY (pimply faced youth) who is even now ready to release into the wild an siege engine that, sapper like, will reduce our ramparts to rubble in a great explosion and leave our flank open to those who besiege us.

no such thing as a secure redoubt in a connected world only as secure as can be within the constraints of functionality and ease of use for its intended system or target user ;-)

[QIII]

no such thing as a secure redoubt in a connected world only as secure as can be within the constraints of functionality and ease of use for its intended system or target user ;-)

Yeap. Due diligence and a wary eye are required, but not always entirely effective.

Leaving the back gate open, however, is folly.

[texpat]

just to be pedantic, cycbot is a trojan/backdoor and not a virus, but does come under the malware definition.

It has been around for a while.

make sure you use upto date definitions in your anti malware solutions.

And always have backups and/or restore points and/or clones of your system which is the first thing you should do upon install or receipt of built system and definately before connecting to the internet then this type of thing is never a problem.

I'm OK with pedanticism (not sure that's even a word). That just means I downloaded the <snip> thing onto my machine all by myself... GREAT ;-)

Its been around for a while: well, yeah. Its just a damn shame my daily-updated anti-stuff didn't get the message, apparently.

And I have the backups/restorepoints allright, its just that I'm not used to this crap...

[CharlesA]

It happens to everyone. I had a developer at work get a nasty bug on his work laptop. Took a week or so to get the damn thing cleaned up.

[goofey24]

Its been around for a while: well, yeah. Its just a damn shame my daily-updated anti-stuff didn't get the message, apparently.

My sister has a machine with Vista and she has the 'redirect' drama going on :p.
Every time you do a google search and the page with all the links comes up, but every time you click a link, it redirects to some page with this 'StarFixMe' or some other crap. I have run all kinds of cleaner programs and nothing found.
She has the paid version of McAfee.

END RANT

[szymon_g]

So I get this computer with Windows 7 and I immediately stick an anti-virus (AVG) and anti-spyware (Spybot S&D) system on it. No need to say that this alone, what, with its resident agents and on-demand scanning stuff, bogs down the otherwise super-efficient four-core, 64-bit hardware to just-about-workable. I also run registry cleaning software every so often and backup all the bloody time - just in case.

yeah, right. you can have real-time AV protection with performance lost close to none (and no- it doesn't have to make your cop 'just-about-workable). and why the hell are you doing registry-cleaning? Are you one of those people for who reinstallation is the only way to fix windows?
lemmie guess: running system on admin account? no memory protection turned on (DEP & similar)?



Take this as you like, but if I ever have the choice, I'll go for boring, stable, reliable and TRANSPARENT Linux any day.

:lolflag:
so use your stable, reliable and "transparent" system. ah, i forgot- most software you need doesn't run on it.

[Dangertux]

While I do appreciate sarcasm, the last post was slightly misinformed DEP is nice but won't help in this particular case. Due to how the particular malware threat works. Good point on the admin account but still didn't the OP say windows 7 so UAC still should have prompted. Really it doesn't matter though since UAC is terribly easy to bypass.

I would recommend using Microsoft Security Essentials, it's actually fairly decent for the price of free anti malware bytes also has amazing heuristics detection and sandbox execution.

Hope this helps.

[lisati]

Your best defence starts with being smart. I once opened a file I knew to be infected on an XP machine, just out of curiosity, while evaluating a different AV product to the one I'd normally use. Several hours and much muttering later...... The language filter here would have been given a good workout.

[texpat]

The system admin at your job should have locked the machine down.

That'd be me... self employed design drone here.


I am betting the machine was running on an admin account too.

Not sure that's possible on W7. But then again, I'm awfully trigger happy when it comes to dialogues warning me of possible dangers..

[texpat]

While I do appreciate sarcasm, the last post was <snip>
...slightly out of order. But that's OK. We're in the Cafe so anything goes. I've only got myself to blame, really, ranting as I was.


I would recommend using Microsoft Security Essentials, it's actually fairly decent for the price of free anti malware bytes also has amazing heuristics detection and sandbox execution.

Hope this helps.

Haven't used Windows in years, so I'm grateful for your insights.

[texpat]

Your best defence starts with being smart.

I totally agree. I must've done something utterly stupid to download that malware onto my machine. But by the life of me, I just can't figure out what it was.

[Bandit]

The system admin at your job should have locked the machine down.

I am betting the machine was running on an admin account too.

This ^^

Win7 can be just as secure as linux if properly maintained and properly protected/locked down.

[Bandit]

.........
I would recommend using Microsoft Security Essentials, it's actually fairly decent for the price of free anti malware bytes also has amazing heuristics detection and sandbox execution.

Hope this helps.

I use MSE also, for being FREE is actually very very good. Technically NortonSE is more protective, but dear god its to over protective and a huge resource hog. I was a big Avast and AVG user for a few years and still use AVG on my WinXP netbook. But M$SE is better then those and seems to have a solid feel as well.

[Frogs Hair]

My sister has a machine with Vista and she has the 'redirect' drama going on .
Every time you do a google search and the page with all the links comes up, but every time you click a link, it redirects to some page with this 'StarFixMe' or some other crap. I have run all kinds of cleaner programs and nothing found.
She has the paid version of McAfee.

This can be the result of completely legal adware in the form of tool bars and browser plug-ins that are supposed to improve service . :p

[Skara Brae]

At work (federal government of my country) we have SLED 10 on PC's since 2008. We work with a UNIX program that runs in an "Xnest" window.

SLED will someday soon be replaced by MS Windows...

Thunderbird is already replaced by Microsoft Outlook Web Crap.

Later this year we will be given the opportunity to buy MS Office at a very low price...

When I emailed the IT department to ask if this was true, I got an email back that said that Microsoft was asked which was the best way to uniformize the various computer systems, and that Microsoft advised Windows w/ MS Office (oh really??? Gee, what a surprise...).

Now, why does the government of a country "support" a private corporation? COUGHbriberyCOUGH? They can't be serious in having asked Microsoft which was the best solution? :shock:

Why is there no organisation that actively supports GNU/Linux/open source? :confused:

[texpat]

At work (federal government of my country) we have SLED 10 on PC's since 2008. We work with a UNIX program that runs in an "Xnest" window.

SLED will someday soon be replaced by MS Windows...

Thunderbird is already replaced by Microsoft Outlook Web Crap.

Later this year we will be given the opportunity to buy MS Office at a very low price...

When I emailed the IT department to ask if this was true, I got an email back that said that Microsoft was asked which was the best way to uniformize the various computer systems, and that Microsoft advised Windows w/ MS Office (oh really??? Gee, what a surprise...).

Now, why does the government of a country "support" a private corporation? COUGHbriberyCOUGH? They can't be serious in having asked Microsoft which was the best solution? :shock:

Why is there no organisation that actively supports GNU/Linux/open source? :confused:

There are govenrment offices that adopt Linux. I've read that local authorities in France, Austria and Spain use Linux and Open/Libre-Office, which makes sense since the interchange of documents is guaranteed to work, seeing as there are no propietary formats involved that could suddenly become incompatible after an "upgrade". Also, there are plenty of companies offering commercial support for open source systems.

But then again, there's that metric of total cost of ownership, and while I personally think that TCO for open source systems should be lower than for propietary ones, it seems the closed systems industry insists that they are cheaper overall. I have no idea how they measure this and in any case it is suspicious since the only way they'd be cheaper would be with lower maintenance costs, which they can really only achieve with lower wages (per hour fees) and/or fewer maintenance incidences, which seems unrealistic, given that closed source systems, and especially Microsoft Windows products are much more prone to failure.

Dealing with government, you're dealing with politicians, who, unfortunately, tend to be a demographic that is especially vulnerable when it comes to conceding (or being conceded) "favours". So yes, you may very well be facing a corruption problem there. For my own mental sanity, however, this is when my personal version of Godwin's Law is applied. I must not talk about politics or politicians lest I go into a rant that will probably get me kicked off this forum ;-)