[TheForge] OT - A new virus attack - False Alert scam

Wed Apr 7 17:15:10 EDT 2010

I got this a few weeks back it would not let me do anything ...I ended up using the RESTOE option in Mcafee to restore the drive to an eariler date(2 week window) I then used mrcrosoft malware removal tool (free) it took over six hours to scan everyhing it removed it.

Jim Davis

Be who you are and say what you feel...Because those that matter, don't mind, and those that mind, don't matter! 

> Date: Wed, 7 Apr 2010 11:59:20 -0700
> From: artgawk at thegrid.net
> To: theforge at mailman.qth.net
> Subject: Re: [TheForge] OT - A new virus attack - False Alert scam
> 
> Thank you John:
> That's scary!
> 
> John Allen wrote:
> > Really, I don't know. I wish I could answer that. I know what's a
> > virus calling and what is not. My parents had one of these viruses and
> > I had to pay for an online virus check and they got rid of it. Cost me
> > 25$ but it taught them a good lesson.
> > 
> > I tried every truck I knew by doing a safe mode delete, No good. Doing
> > a virus scan, no good. I even found out what file was the second file
> > and deleted both of them and still no good.
> > 
> > I think the people who make the anti virus is making a guideline for
> > how to write viruses. They do things a specific way and the viruses
> > know it.
> > 
> > Just remember if it looks suspicious, GOOGLE it... A google search
> > will tell you from other people if it a scam, virus, or good. Also do
> > not go by one or two reviews because it could be the virus company who
> > made them so it backs them up. If you see 10 bad ones and two good
> > ones, then it is probably a virus and to read how to delete it before
> > doing anything.
> > 
> > I hope this helps everyone here because like me, you all have
> > important information on your computers.
> > 
> > On 4/7/10, Peter Fels & Phoebe Palmer <artgawk at thegrid.net> wrote:
> >> Thanks John; That's what i'd guessed.
> >> How does one delete such a virus without it generating a
> >> new copy?
> >> And will the AV be able to recognize the new clone?
> >>
> >> John Allen wrote:
> >>> If the second file can't find the main file then it will reproduce a
> >>> new main file. So renaming it won't worg either
> >>>
> >>> On 4/7/10, Peter Fels & Phoebe Palmer <artgawk at thegrid.net> wrote:
> >>>> Groan;
> >>>> John: my AV, Zone Alarm copes with a virus it can't
> >>>> delete or quarantine by attempting to rename it.
> >>>> Is that an effective solution??..the virus remains intact
> >>>> on the HD.
> >>>>
> >>>> John Allen wrote:
> >>>>> The problem with new viruses, I know this because I stay up to date
> >>>>> with things, you can always delete the virus by starting windows in
> >>>>> safe mode and deleting it manually. The problem is when you do this,
> >>>>> the virus creates a separate file and when the virus is deleted this
> >>>>> second file will reproduce the virus file. This second file is much
> >>>>> harder to detect because they name it and hide it in normal computer
> >>>>> files.
> >>>>>
> >>>>> On 4/7/10, Lynn Emrich <theatre_weapons at yahoo.com> wrote:
> >>>>>> I got caught with this one. Had to do a basic boot to run my virus
> >>>>>> program.
> >>>>>> Lynn
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>> ----- Original Message ----
> >>>>>> From: Bruce Freeman <freemab222 at gmail.com>
> >>>>>> To: Blacksmithing List Sponsored by ABANA <theforge at mailman.qth.net>
> >>>>>> Sent: Tue, April 6, 2010 3:17:34 PM
> >>>>>> Subject: [TheForge] OT - A new virus attack - False Alert scam
> >>>>>>
> >>>>>> I just had to pay McAfee $90 to rid my computer of a virus. Nasty
> >>>>>> thing. I must have picked it up over the internet, but I am not sure
> >>>>>> how. My McAfee "Total Protection" didn't! They're gonna hear from me
> >>>>>> about that - especially since they have info about this virus on their
> >>>>>> own website. This virus can really shut you down. It disables McAfee
> >>>>>> tools, both local and on-line. It disables the taskmgr.exe (which you
> >>>>>> access with CTRL-ALT-DEL, and which enables you to shut down
> >>>>>> programs). etc. I will complement McAfee that their $90 clean-up was
> >>>>>> pretty easy from my end. (866-622-3911 if you need it. Expect to
> >>>>>> listen to an Indian accent.)
> >>>>>>
> >>>>>> Anyway, if you see ANYTHING pop up on your computer warning you of a
> >>>>>> virus attack - SHUT DOWN IMMEDIATELY - THAT'S THE VIRUS TALKING! If
> >>>>>> you click on it, you get bit. The website it (ultimately) takes you
> >>>>>> to is "antivirus <hyphen> rampart <dot> com, which I provide for info
> >>>>>> only. DON'T go there. If you google it you'll find more about "fake
> >>>>>> alert" viruses like this one.
> >>>>>>
> >>>>>> My computer savvy isn't enough to advise better than this.
> >>>>>>
> >>>>>> --
> >>>>>> Bruce
> >>>>>> NJ
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>> ______________________________________________________________
> >>>>>> TheForge mailing list
> >>>>>> Home: http://mailman.qth.net/mailman/listinfo/theforge
> >>>>>> Help: http://mailman.qth.net/mmfaq.htm
> >>>>>> Post: mailto:TheForge at mailman.qth.net
> >>>>>>
> >>>>>> TheForge mail list group photo site is
> >>>>>> http://www.photoaccess.com
> >>>>>> Login: blacksmithblacksmith at hotmail.com
> >>>>>> Password: anvil
> >>>>>>
> >>>>>> This list hosted by: http://www.qsl.net
> >>>>>> Please help support this email list: http://www.qsl.net/donate.html
> >>>>>>
> >>>> ______________________________________________________________
> >>>> TheForge mailing list
> >>>> Home: http://mailman.qth.net/mailman/listinfo/theforge
> >>>> Help: http://mailman.qth.net/mmfaq.htm
> >>>> Post: mailto:TheForge at mailman.qth.net
> >>>>
> >>>> TheForge mail list group photo site is
> >>>> http://www.photoaccess.com
> >>>> Login: blacksmithblacksmith at hotmail.com
> >>>> Password: anvil
> >>>>
> >>>> This list hosted by: http://www.qsl.net
> >>>> Please help support this email list: http://www.qsl.net/donate.html
> >>>>
> >> ______________________________________________________________
> >> TheForge mailing list
> >> Home: http://mailman.qth.net/mailman/listinfo/theforge
> >> Help: http://mailman.qth.net/mmfaq.htm
> >> Post: mailto:TheForge at mailman.qth.net
> >>
> >> TheForge mail list group photo site is
> >> http://www.photoaccess.com
> >> Login: blacksmithblacksmith at hotmail.com
> >> Password: anvil
> >>
> >> This list hosted by: http://www.qsl.net
> >> Please help support this email list: http://www.qsl.net/donate.html
> >>
> > 
> ______________________________________________________________
> TheForge mailing list
> Home: http://mailman.qth.net/mailman/listinfo/theforge
> Help: http://mailman.qth.net/mmfaq.htm
> Post: mailto:TheForge at mailman.qth.net
> 
> TheForge mail list group photo site is
> http://www.photoaccess.com
> Login: blacksmithblacksmith at hotmail.com
> Password: anvil
> 
> This list hosted by: http://www.qsl.net
> Please help support this email list: http://www.qsl.net/donate.html