uptick in fake antiviruses

[bluefalcon]

Originally Posted by MisterMalware

What I'd like to know is the exact configuration(s) these PCs had before they got infected.

Both of the ones I fixed didn't have service pack 1 installed. Basically the customer turned off the automatic updates (They told me they did because it was slowing down their internet connection).

[MisterMalware]

Thanks for the reply bluefalcon.

[callthatgirl]

Yep, saw more calls in December for sure. In November we had 20 virus calls and Dec was 31. Last week we had 11 alone.

[bytebuster]

Originally Posted by Bobscomputerservice

well i guess its not just me....it sucks for EUs but really helped a slow week. i crushed my goal for December because of these. So far they totally disable anything in the machine to fix it. Makes it great for us techs. These are real nasty ones. every customer had up to date antivirus software. Well i guess if you make $100.00 milllion and the US goverment only makes you pay 8 million in damages i would set up shop again too. We are all in the wrong business i guess, lol!

I personally am not advertising right now because the yellow pages isn't due until March and I really don't want to swim in cheese with the pizza techs on CL. If anybody has a better idea, let me know. Anyway, it seems that the only way to defeat these is by booting into a VM and doing manual removal, right? I know that before I went on hiatus I was seeing fake AV's that would stop any scan of any antivirus software, even from a VM, and "eat" whatever real AV was on the target PC. I suppose we'll eventually have fake AV's that eat the hard drive. I know that the Russians tried a virus that literally encrypted everything, and they didn't give out a key to unencrypt it if you paid, they just ran up your card. Judging from the rage on forums like these they realized they crossed the line, if you totally destroy data and leave no method of retrieval, you will get a bunch of enraged Yankees.

[tekgeek]

Originally Posted by bytebuster

I personally am not advertising right now because the yellow pages isn't due until March and I really don't want to swim in cheese with the pizza techs on CL. If anybody has a better idea, let me know. Anyway, it seems that the only way to defeat these is by booting into a VM and doing manual removal, right? I know that before I went on hiatus I was seeing fake AV's that would stop any scan of any antivirus software, even from a VM, and "eat" whatever real AV was on the target PC. I suppose we'll eventually have fake AV's that eat the hard drive. I know that the Russians tried a virus that literally encrypted everything, and they didn't give out a key to unencrypt it if you paid, they just ran up your card. Judging from the rage on forums like these they realized they crossed the line, if you totally destroy data and leave no method of retrieval, you will get a bunch of enraged Yankees.

on systems in which I can not get around the rogue virus I usually pop in a SARDU cd and run Bitdefender which cleans out the major culprit and then I run all the usual stuff in windows to do a thorough cleaning and to check everything out

[Gary Orner]

I did 21 of these in the month of JAN. but have not seen one in the last 4 days. It was really weird just out of the blue it was like everyone had it.

['putertutor]

I had one come in a couple of days ago (see this thread: http://www.technibble.com/forums/sho...d=1#post268889) and then 3 more calls just today! I haven't checked my voicemail yet, but I am hoping there are more on there as well. Sounds kind of creepy to be happy about problems like this, but I guess even a doctor needs sick people to pay his bills.

@mistermalware
My most recent was on a laptop, vista sp2, running up to date mse. Like I mentioned in the thread linked above, the malware laughed at rskill, tdsskill, and mbam, forcing me to manually delete - which I am not as strong at as I wish I was.