HELP - Do I have a virus? - DPChallenge Forums

Olympus 8mm f/1.8 M.Zuiko Digital ED Fisheye PRO Lens

09/27/2010 05:28:52 PM · #26

Originally posted by SteveJ:

Originally posted by GinaRothfels:

Originally posted by SteveJ:
Crash your pc, then open in safe mode. Run AVG in safe mode, it gets rid of that virus which you will find is a Trojan horse. Already done this three times with daughter's laptop as she keeps going on these unsafe sites:)

I don't even know if there is a virus. And I haven't a clue how to crash my pc or how to open it in safe mode.

Hold the power button for about five seconds while it is on as normal. That will crash it and reboot it, it should give the option to open in safe mode, if not, keep crashing it until it does. This does not hurt your PC.

Good to know. Not sure if it's actually necessary though.

Olympus 8mm f/1.8 M.Zuiko Digital ED Fisheye PRO Lens

09/27/2010 05:29:47 PM · #27

So far Microsoft Security Essentials has run a quick scan and found nothing. I'm running a full scan now just to be safe.

09/27/2010 05:40:49 PM · #28

Originally posted by GinaRothfels:

Originally posted by SteveJ:

Originally posted by GinaRothfels:

Originally posted by SteveJ:
Crash your pc, then open in safe mode. Run AVG in safe mode, it gets rid of that virus which you will find is a Trojan horse. Already done this three times with daughter's laptop as she keeps going on these unsafe sites:)

I don't even know if there is a virus. And I haven't a clue how to crash my pc or how to open it in safe mode.

Hold the power button for about five seconds while it is on as normal. That will crash it and reboot it, it should give the option to open in safe mode, if not, keep crashing it until it does. This does not hurt your PC.

Good to know. Not sure if it's actually necessary though.

You can start in safe mode by holding down F8 key while booting...

R.

Olympus 8mm f/1.8 M.Zuiko Digital ED Fisheye PRO Lens

09/27/2010 07:57:23 PM · #29

Microsoft Security Essentials found 1 potential threat:

This has now been quarantined. Also something sent to Microsoft which it says may not yet have been classified for risks. I really don't understand what this thing is or what it could do to my computer. I thought anti-virus programs were supposed to warn one before one got infected. Why did AVG miss this?

I must say this whole thing is making me very nervous.

Apple iPhone 5

Nikon AF-S DX Zoom-Nikkor 18-55mm f/3.5-5.6 ED

09/27/2010 08:22:57 PM · #30

If you click 'show details' does it give you the name of the file? - Obfuscator is a generic term for programs which are hiding their purpose. It could be malware, but it could equally be your existing anti-virus program file that's giving a false positive.

ETA: Also, when you run a malware scan it's highly likely it'll pick up 'malware' in the form of cookies. These are normally fairly harmless text files. The malware you've got to look out for is the executable type, or the type that sits in memory waiting to do something.

Message edited by author 2010-09-27 20:24:37.

Olympus 8mm f/1.8 M.Zuiko Digital ED Fisheye PRO Lens

09/27/2010 08:47:44 PM · #31

I did look at the details earlier but they didn't mean terribly much to me. I don't seem to be able to get back to that page now. But I don't like that the alert level is given as severe. Especially seeing that my computer hasn't been doing anything out of the ordinary to make me suspicious, nor has AVG ever picked up the slightest hint of a problem. I've always thought I was adequately protected.

09/28/2010 01:14:20 AM · #32

Here's another thing one can do to protect their computer. I just ran into this tip on Lifehacker. Sometimes legitimate sites or the ads they display to support the providing of free content may have been compromised. In this way you can get malware without even knowing it or even going away from your trusted sites.

There is a list of known malicious domains that was originated for use by DNS servers, but you can subscribe to the list with the Adblock plus extension for Firefox. This is regularly updated and can block many of these. Here's more info.

Olympus 8mm f/1.8 M.Zuiko Digital ED Fisheye PRO Lens

09/28/2010 06:35:41 AM · #33

Originally posted by Yo_Spiff:

Thanks. I'll read it later. Are these security features only available for Firefox?

09/28/2010 08:42:32 AM · #34

Originally posted by GinaRothfels:

Thanks. I'll read it later. Are these security features only available for Firefox?

You can often find something similar for Chrome, as development is heavy for that browser as well. I'm sure there are similar ad blocking extensions for the other browsers, but whether those extensions can subscribe to that database, I don't know offhand.

What browser are you using? If you answer IE6, then you MUST upgrade. IE6 is swiss cheese.

The mention I made earlier in this thread of installing a custom hosts file will work with any browser, as it is something inherent to the networking function of the computer that runs underneath the browser.

Message edited by author 2010-09-28 08:43:59.

Olympus 8mm f/1.8 M.Zuiko Digital ED Fisheye PRO Lens

09/28/2010 09:44:19 AM · #35

I'm using Internet Explorer 8. It seems I will have to consider changing to Firefox. You're not the first person to recommend it. Just lazy to learn a new program.

09/28/2010 09:48:14 AM · #36

IE8 is pretty good, and holds up well. I think you will find that most techies are using Firefox or Chrome these days.

Kinda like asking for editing tips here on DPC. Most people on DPC will assume you are using some version of Photoshop. When you ask for tech help, especially relating to internet security, you will get a lot advice oriented to Firefox and Chrome.

Message edited by author 2010-09-28 09:51:11.

09/28/2010 09:49:15 AM · #37

Originally posted by GinaRothfels:

I'm using Internet Explorer 8. It seems I will have to consider changing to Firefox. You're not the first person to recommend it. Just lazy to learn a new program.

I've just switched from Firefox to Chrome, myself. Chrome seems to be faster and more stable. I'm loving it thus far.

R.

Olympus 8mm f/1.8 M.Zuiko Digital ED Fisheye PRO Lens

09/28/2010 10:09:34 AM · #38

I've never even heard of Chrome. This is getting quite confusing.

I'm still wondering whether I need to run AVG (or something else) in safe mode, or whether Microsoft Security Essentials has got rid of whatever threat was left on this machine after using Spybot. I'm really fed up that AVG missed everything.

Apple iPhone 5

Nikon AF-S DX Zoom-Nikkor 18-55mm f/3.5-5.6 ED

09/28/2010 10:17:48 AM · #39

Whatever happened to Netscape Navigator?

Well... it died... and then it's source became the base for Firefox; Almost biblical. ;)

Don't forget Opera, which now matches IE9, Firefox, and Chrome in terms of speed.

And lastly, Chromium - which is the open source version of Chrome, minus certain 'user metrics' features. Harder to find a download link, as it's developed by techies. But here's one.

ETA: Rather then confuse the thread with browser options. I'll say this; I think you've spent enough time and energy on flushing out the malware. From the looks of things, it's clean. If you were infected I'd expect to see a number of files and also specific names for the infection.

And as for browser, Firefox is a nice one.

Message edited by author 2010-09-28 10:18:58.

CJinCA

Canon EOS-7D

Canon EF 28-135mm f/3.5-5.6 IS USM

09/28/2010 10:24:23 AM · #40

Gina, I had a similar problem, only a bit worse as I couldn't run in normal mode at all with all those popups about being infected. After running Avg in safe mode, a bunch of bad files were eliminated but thought there were more so downloaded Malwarebytes and ran the quick scan. It found an additional bad file so I ran the full scan and found another one. The different virus programs can sometimes find different things so even though I felt pretty sure that all the bad files were eliminated, just to be on the safe side, I downloaded the free version of Avast! and ran that. Didn't find anything but now felt confident all the malware programs were deleted. Both programs came highly recommended by CNET, are free, and seem to be compatible with each other.

Good luck! BTW, I use Firefox.

Nikon AF-S DX Zoom-Nikkor 18-55mm f/3.5-5.6 ED

09/28/2010 10:24:38 AM · #41

Originally posted by GinaRothfels:

I still have yet to flush anything out of MY system that could account for the hijacking of my Yahoo mail, which occurred twice in a week. I ran AVG out of safe mode last night, and it took an hour and change to do its stuff; nothing located. Everything seems fine here.

Chrome is Google's browser. It's relatively new. I was having stability issues with Firefox whilst running java applications in games. No problems with chrome. Otherwise Firefox has been dandy for me. But chrome IS faster.

Neither Firefox nor Chrome is difficult to adapt to, if you already use IE8. And both will import your bookmarks if you ask them to.

R.

Apple iPhone 5

09/28/2010 10:26:39 AM · #42

Originally posted by Bear_Music:

But chrome IS faster.

To techies, that's as controversial as saying Canon is better than Nikon... ;-)

09/28/2010 10:47:23 AM · #43

Originally posted by JH:

Whatever happened to Netscape Navigator?

Well... it died... and then it's source became the base for Firefox; Almost biblical. ;)

Well, since it was rising from the ashes of Netscape Navigator, the original name of Firefox in 2002 was Phoenix. Then it was changed to FireBird because of a trademark conflict, then changed again because Firebird was also in conflict with another product.

Interestingly, at work I still review some user manuals where the original text specifies IE4 or Netscape Navigator as the supported browsers.

xanderale

09/28/2010 01:17:01 PM · #44

My wife ran this on my Mac while I was at work. She left it on the screen and I immediately recognized it as a virus when I came home since I am a professional software engineer. 77.78.239.168 has been quarantined by Google and FireFox so I couldn't figure out exactly what the virus did, but your detailed snapshots allowed me to trouble shoot the damage. Thank you. Fortunately for me the payload is a windows executable that couldn't run on my Mac so I am not infected.

You have been infected by the worst kind of virus: it records keystrokes, etc. to steal your passwords, online bank account info, etc. It also allows the attacker to remotely control your computer. This virus is brand new so your anti virus software may not have a cure yet.

Contact your anti virus software immediately and ask them if they have a fix / patch for "inst.exe". If you do a search on Google or on your anti virus software site, you can get more info on the inst.exe Trojan Horse.

Until your anti virus software company confirms that you have removed your virus, DO NOT ACCESS ANY ONLINE ACCOUNTS OR TYPE ANY KIND OF SENSITIVE FINANCIAL INFORMATION ONTO YOUR COMPUTER. It WILL get stolen.

Olympus 8mm f/1.8 M.Zuiko Digital ED Fisheye PRO Lens

09/28/2010 02:13:48 PM · #45

Well now I'm really scared.

David Ey

Nikon D80

Nikon AF Micro-Nikkor 60mm f2.8D

09/28/2010 02:46:36 PM · #46

These perpetrators should have their heads chopped off.

Olympus 8mm f/1.8 M.Zuiko Digital ED Fisheye PRO Lens

09/28/2010 03:34:32 PM · #47

So now I'm looking at websites that offer a scan to check for Inst.exe errors, but I'm scared to run them. I just don't know what to trust any more.

one2one

Olympus E-5

Olympus 7-14mm f/4.0 Zuiko Digital Zoom

09/28/2010 03:50:59 PM · #48

Originally posted by GinaRothfels:

So now I'm looking at websites that offer a scan to check for Inst.exe errors, but I'm scared to run them. I just don't know what to trust any more.

I wouldn't run anything from a web site. That's got to be the easiest way to infect a computer.

09/28/2010 04:01:48 PM · #49

Originally posted by Jac:

Originally posted by GinaRothfels:
So now I'm looking at websites that offer a scan to check for Inst.exe errors, but I'm scared to run them. I just don't know what to trust any more.

I wouldn't run anything from a web site. That's got to be the easiest way to infect a computer.

Totally agree. I was looking at that too, for you, and I didn't like where any of it was leading. There are legitimate forms of inst.exe as far as I can see.

xanderale joined the site to publish that warning; what's he doing here? How did he know to come here? Possibly as simple as googling, cuz if you google 77.78.239.168 this thread shows up, but on the other hand he's the first one to print that number in here I think? I'm confused. I sent a ticket to SC about his post, as soon as he posted it, and it's still up, so apparently they think that's legitimate information, I donno...

R.