[TheForge] OT - A new virus attack - False Alert scam

Wed Apr 7 14:59:20 EDT 2010

Thank you John:
That's scary!

John Allen wrote:
> Really, I don't know. I wish I could answer that. I know what's a
> virus calling and what is not. My parents had one of these viruses and
> I had to pay for an online virus check and they got rid of it. Cost me
> 25$ but it taught them a good lesson.
> 
> I tried every truck I knew by doing a safe mode delete, No good. Doing
> a virus scan, no good. I even found out what file was the second file
> and deleted both of them and still no good.
> 
> I think the people who make the anti virus is making a guideline for
> how to write viruses. They do things a specific way and the viruses
> know it.
> 
> Just remember if it looks suspicious, GOOGLE it... A google search
> will tell you from other people if it a scam, virus, or good. Also do
> not go by one or two reviews because it could be the virus company who
> made them so it backs them up. If you see 10 bad ones and two good
> ones, then it is probably a virus and to read how to delete it before
> doing anything.
> 
> I hope this helps everyone here because like me, you all have
> important information on your computers.
> 
> On 4/7/10, Peter Fels & Phoebe Palmer <artgawk at thegrid.net> wrote:
>> Thanks John; That's what i'd guessed.
>> How does one delete such a virus without it generating a
>> new copy?
>> And will the AV be able to recognize the new clone?
>>
>> John Allen wrote:
>>> If the second file can't find the main file then it will reproduce a
>>> new main file. So renaming it won't worg either
>>>
>>> On 4/7/10, Peter Fels & Phoebe Palmer <artgawk at thegrid.net> wrote:
>>>> Groan;
>>>> John: my AV, Zone Alarm copes with a virus it can't
>>>> delete or quarantine by attempting to rename it.
>>>> Is that an effective solution??..the virus remains intact
>>>> on the HD.
>>>>
>>>> John Allen wrote:
>>>>> The problem with new viruses, I know this because I stay up to date
>>>>> with things, you can always delete the virus by starting windows in
>>>>> safe mode and deleting it manually. The problem is when you do this,
>>>>> the virus creates a separate file and when the virus is deleted this
>>>>> second file will reproduce the virus file. This second file is much
>>>>> harder to detect because they name it and hide it in normal computer
>>>>> files.
>>>>>
>>>>> On 4/7/10, Lynn Emrich <theatre_weapons at yahoo.com> wrote:
>>>>>> I got caught with this one. Had to do a basic boot to run my virus
>>>>>> program.
>>>>>> Lynn
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>> ----- Original Message ----
>>>>>> From: Bruce Freeman <freemab222 at gmail.com>
>>>>>> To: Blacksmithing List Sponsored by ABANA <theforge at mailman.qth.net>
>>>>>> Sent: Tue, April 6, 2010 3:17:34 PM
>>>>>> Subject: [TheForge] OT - A new virus attack - False Alert scam
>>>>>>
>>>>>> I just had to pay McAfee $90 to rid my computer of a virus.  Nasty
>>>>>> thing.  I must have picked it up over the internet, but I am not sure
>>>>>> how.  My McAfee "Total Protection" didn't!  They're gonna hear from me
>>>>>> about that - especially since they have info about this virus on their
>>>>>> own website.  This virus can really shut you down.  It disables McAfee
>>>>>> tools, both local and on-line.  It disables the taskmgr.exe (which you
>>>>>> access with CTRL-ALT-DEL,  and which enables you to shut down
>>>>>> programs).  etc.  I will complement McAfee that their $90 clean-up was
>>>>>> pretty easy from my end.  (866-622-3911 if you need it.  Expect to
>>>>>> listen to an Indian accent.)
>>>>>>
>>>>>> Anyway, if you see ANYTHING pop up on your computer warning you of a
>>>>>> virus attack - SHUT DOWN IMMEDIATELY - THAT'S THE VIRUS TALKING!   If
>>>>>> you click on it, you get bit.  The website it (ultimately) takes you
>>>>>> to is "antivirus <hyphen> rampart <dot> com, which I provide for info
>>>>>> only.  DON'T go there.  If you google it you'll find more about "fake
>>>>>> alert" viruses like this one.
>>>>>>
>>>>>> My computer savvy isn't enough to advise better than this.
>>>>>>
>>>>>> --
>>>>>> Bruce
>>>>>> NJ
>>>>>>
>>>>>>
>>>>>>
>>>>>> ______________________________________________________________
>>>>>> TheForge mailing list
>>>>>> Home: http://mailman.qth.net/mailman/listinfo/theforge
>>>>>> Help: http://mailman.qth.net/mmfaq.htm
>>>>>> Post: mailto:TheForge at mailman.qth.net
>>>>>>
>>>>>> TheForge mail list group photo site is
>>>>>> http://www.photoaccess.com
>>>>>> Login: blacksmithblacksmith at hotmail.com
>>>>>> Password: anvil
>>>>>>
>>>>>> This list hosted by: http://www.qsl.net
>>>>>> Please help support this email list: http://www.qsl.net/donate.html
>>>>>>
>>>> ______________________________________________________________
>>>> TheForge mailing list
>>>> Home: http://mailman.qth.net/mailman/listinfo/theforge
>>>> Help: http://mailman.qth.net/mmfaq.htm
>>>> Post: mailto:TheForge at mailman.qth.net
>>>>
>>>> TheForge mail list group photo site is
>>>> http://www.photoaccess.com
>>>> Login: blacksmithblacksmith at hotmail.com
>>>> Password: anvil
>>>>
>>>> This list hosted by: http://www.qsl.net
>>>> Please help support this email list: http://www.qsl.net/donate.html
>>>>
>> ______________________________________________________________
>> TheForge mailing list
>> Home: http://mailman.qth.net/mailman/listinfo/theforge
>> Help: http://mailman.qth.net/mmfaq.htm
>> Post: mailto:TheForge at mailman.qth.net
>>
>> TheForge mail list group photo site is
>> http://www.photoaccess.com
>> Login: blacksmithblacksmith at hotmail.com
>> Password: anvil
>>
>> This list hosted by: http://www.qsl.net
>> Please help support this email list: http://www.qsl.net/donate.html
>>
> 