[TheForge] OT - A new virus attack - False Alert scam

[Peter Fels & Phoebe Palmer]

Thanks John; That's what i'd guessed.
How does one delete such a virus without it generating a 
new copy?
And will the AV be able to recognize the new clone?

John Allen wrote:
> If the second file can't find the main file then it will reproduce a
> new main file. So renaming it won't worg either
> 
> On 4/7/10, Peter Fels & Phoebe Palmer <artgawk at thegrid.net> wrote:
>> Groan;
>> John: my AV, Zone Alarm copes with a virus it can't
>> delete or quarantine by attempting to rename it.
>> Is that an effective solution??..the virus remains intact
>> on the HD.
>>
>> John Allen wrote:
>>> The problem with new viruses, I know this because I stay up to date
>>> with things, you can always delete the virus by starting windows in
>>> safe mode and deleting it manually. The problem is when you do this,
>>> the virus creates a separate file and when the virus is deleted this
>>> second file will reproduce the virus file. This second file is much
>>> harder to detect because they name it and hide it in normal computer
>>> files.
>>>
>>> On 4/7/10, Lynn Emrich <theatre_weapons at yahoo.com> wrote:
>>>> I got caught with this one. Had to do a basic boot to run my virus
>>>> program.
>>>> Lynn
>>>>
>>>>
>>>>
>>>>
>>>> ----- Original Message ----
>>>> From: Bruce Freeman <freemab222 at gmail.com>
>>>> To: Blacksmithing List Sponsored by ABANA <theforge at mailman.qth.net>
>>>> Sent: Tue, April 6, 2010 3:17:34 PM
>>>> Subject: [TheForge] OT - A new virus attack - False Alert scam
>>>>
>>>> I just had to pay McAfee $90 to rid my computer of a virus.  Nasty
>>>> thing.  I must have picked it up over the internet, but I am not sure
>>>> how.  My McAfee "Total Protection" didn't!  They're gonna hear from me
>>>> about that - especially since they have info about this virus on their
>>>> own website.  This virus can really shut you down.  It disables McAfee
>>>> tools, both local and on-line.  It disables the taskmgr.exe (which you
>>>> access with CTRL-ALT-DEL,  and which enables you to shut down
>>>> programs).  etc.  I will complement McAfee that their $90 clean-up was
>>>> pretty easy from my end.  (866-622-3911 if you need it.  Expect to
>>>> listen to an Indian accent.)
>>>>
>>>> Anyway, if you see ANYTHING pop up on your computer warning you of a
>>>> virus attack - SHUT DOWN IMMEDIATELY - THAT'S THE VIRUS TALKING!   If
>>>> you click on it, you get bit.  The website it (ultimately) takes you
>>>> to is "antivirus <hyphen> rampart <dot> com, which I provide for info
>>>> only.  DON'T go there.  If you google it you'll find more about "fake
>>>> alert" viruses like this one.
>>>>
>>>> My computer savvy isn't enough to advise better than this.
>>>>
>>>> --
>>>> Bruce
>>>> NJ
>>>>
>>>>
>>>>
>>>> ______________________________________________________________
>>>> TheForge mailing list
>>>> Home: http://mailman.qth.net/mailman/listinfo/theforge
>>>> Help: http://mailman.qth.net/mmfaq.htm
>>>> Post: mailto:TheForge at mailman.qth.net
>>>>
>>>> TheForge mail list group photo site is
>>>> http://www.photoaccess.com
>>>> Login: blacksmithblacksmith at hotmail.com
>>>> Password: anvil
>>>>
>>>> This list hosted by: http://www.qsl.net
>>>> Please help support this email list: http://www.qsl.net/donate.html
>>>>
>> ______________________________________________________________
>> TheForge mailing list
>> Home: http://mailman.qth.net/mailman/listinfo/theforge
>> Help: http://mailman.qth.net/mmfaq.htm
>> Post: mailto:TheForge at mailman.qth.net
>>
>> TheForge mail list group photo site is
>> http://www.photoaccess.com
>> Login: blacksmithblacksmith at hotmail.com
>> Password: anvil
>>
>> This list hosted by: http://www.qsl.net
>> Please help support this email list: http://www.qsl.net/donate.html
>>
>