Topic: Scary - Have I got some sort of virus on my computer (Read 3735 times)

The Ferry Man · « **on:** March 03, 2011, 01:54:55 »

Hi

OK, today I got a notifcation from my Norton that "An intrusion Attempt by USER-PC was blocked"

It has a High severity rating... $:-\$

Now what I am worried about is the fact that the Attacking Computer IP and Source Address IP is the same $:-\$

Just checked, it doesn't seem to be my IP address, but it has me slightly concerned... $:-\$

I also have had blocked a file which appears to be originated on my computer in the Google Chrome folder, called f_000b4a (downloader)

:/

Any ideas guys...? Should I be concerned?

freeciv · « **Reply #1 on:** March 03, 2011, 05:21:39 »

We just got rid of a virus on our living room computer. Not to worry you but the virus displayed itself as "anti-virus software" that said you had a virus. And I'm 100% sure if someone clicked "remove virus" it would have been bad.

But you said are a Norton costumer, correct? If you are I would do as it says to remove the virus. If you are not a Norton costumer I would be very worried!

Good Luck!

Matthew Brown · « **Reply #2 on:** March 03, 2011, 07:18:33 »

Actually I would be very worried if you WERE a Norton Customer in general

Lol jokes

I'm more of a Kaspersky user myself, and it's brilliant as soon as it detects any sort of virus it flashes in a red box on the screen saying detected and then it turns green and says blocked,quarantined,eliminated.!
Very advanced

I used to have Norton a long time ago and would help if I could but at the moment I cant remember much!
Although you can try if not already a brilliant free anti-malware scanner called Malware Bytes and does the job of eliminating perfectly.

Ralphy · « **Reply #3 on:** March 03, 2011, 08:50:45 »

TFM,

I would say Colin (the young man

) would be able to help you there, but i don't know if you know but he has gone down under for another 4 weeks. So not much help there $:-\$

Gareth has Norton so he migh have some experiance with it, my experiance is'nt very good with norton so i have now switched to free anti virus software

IRI5HJ4CK · « **Reply #4 on:** March 03, 2011, 09:06:56 »

Hi TFM,

If there is a virus of some sort, this is generally what I do if I'm suspicious that something isn't quite right.

Download Rkill: http://www.bleepingcomputer.com/forums/topic308364.html

Next, download Malwarebytes: http://www.malwarebytes.org/

Superantispyware: http://www.superantispyware.com/

Turn the computer off and keep pressing F8 on start up...eventually you'll get to a window, which has a list of different options...use your keys to go down to Safe Mode, hit enter, and that will start to load.

Once you've done that, run Rkill (Terminates any processes), then run Malwarebytes and Superantispyware. It also wouldn't do any harm to run Norton as well.

That should get rid of anything on the computer. But, with regards to that IP 'attack', I get those quite regularly, and Bullgaurd simply blocks the IP for 300 seconds for me...I would imagine Norton might have something similar.

Let me know how you get on

MokMok · « **Reply #5 on:** March 03, 2011, 09:39:10 »

You should use a clean rescue bootdisk for removing viruses from your PC!

For example Kaspersky Rescue Disk 10, to be found at http://support.kaspersky.com/faq/?qid=208282173 (http://support.kaspersky.com/faq/?qid=208282173)
Avira AntiVir Rescue System http://www.avira.com/en/support-download-avira-antivir-rescue-system (http://www.avira.com/en/support-download-avira-antivir-rescue-system)

A fresh and clean Ultimate Bootdisk for Windows www.ubcd4win.com (http://www.ubcd4win.com)

When you want to clean your PC in Safe Mode, your PC can still remain infected. Some viruses will be active even when booted into Safe Mode. And these viruses will disturb the cleaning process.

If any rescue bootdisk is unavailable you can use the Kaspersky Virus Removal Tool as a lender of last resort. It can be found at http://support.kaspersky.com/viruses/avptool2010?level=2 (http://support.kaspersky.com/viruses/avptool2010?level=2) Boot up your Windows into Save Mode before using this virus removal program!

The Ferry Man · « **Reply #6 on:** March 03, 2011, 10:48:54 »

Hi Guys thanks for the advice

It said that "No further action was needed"

I was just worried by the fact that the IP Address was the same, and it said USER-PC, which I believe this PC is called - I never named it...

--tractorman-- · « **Reply #7 on:** March 03, 2011, 11:09:40 »

I use norton

I tend to see where it found the virus, then I can know where I got it from. its crazy seeing the list of things the computer has blocked, but mine never pops up so it doesn't worry me

If it says no further action was needed, you should be safe

The Ferry Man · « **Reply #8 on:** March 03, 2011, 11:27:39 »

OK, Thanks

I just got the same two notifications again $:-\$

The Risk Name is "HTTP Malicious Toolkit Variant Activity 22"

And the File Insight is "f_000b4a (downloader)"

Again $:-\$

larsdehaan · « **Reply #9 on:** March 03, 2011, 14:20:36 »

get kapersky pal! i use it!

IRI5HJ4CK · « **Reply #10 on:** March 03, 2011, 17:08:40 »

Quote from: The Ferry Man on March 03, 2011, 10:48:54

It said that "No further action was needed"

Hi TFM,

I wouldn't necessarily take it for granted that your system is clean because Norton says so - I hear Norton is much better than it used to be, but I've found on several occasions that Superantispyware/Malwarebytes picks something up before Bullgaurd does, and sometimes, Bullgaurd won't pick it up at all, whereas they will.

You mightn't find anything, but it's better safe than sorry!

Jack.
p.s. Any viruses I have ever had have been solved by doing what I said earlier...I've cleaned a few friends computers of viruses thanks to that 'method'.

The Ferry Man · « **Reply #11 on:** March 03, 2011, 17:16:44 »

Ahh OK

Well I have downloaded the first two, and downloading the last one now, and I will give that a shot

Thanks

IRI5HJ4CK · « **Reply #12 on:** March 03, 2011, 17:22:08 »

No problem at all, let me know how you get on

I don't really know much about viruses, I'll be honest, but that method above always seems to get results. The other problem of the IP attacks mightn't be related, but the fact Norton 'had blocked a file' raises my suspicions.

The Ferry Man · « **Reply #13 on:** March 03, 2011, 20:48:33 »

OK All done...

602,000 files checked

The Malware one came through clean

The Spyware one had a few things, though not in any apparent relation to earlier problems

It had:

AdWare tracking Cookies (Are these the same as the low risk tracking cookies Norton always finds?)

Trojan.Agent/Gen-IEFake
Trojan.Agent/Gen-IExplorer[fake]
Trojan.Agent/Gen-PEC

These have all been "Quarantined"...

Any idea what they are, what to do now?

Thanks

Shipaddict · « **Reply #14 on:** March 03, 2011, 21:01:11 »

In my experience of Super Anti Spyware I have never come across that type of result except for when I had a trojan. The normal cookies it picks up are just something like 'user.doubleclick.com' or similar.

If they are in Quarantine they aren't a risk to you, and you could always get it to remove them.

The Ferry Man · « **Reply #15 on:** March 03, 2011, 21:04:06 »

Ahh OK thanks

Do you think its best to remove them?

Shipaddict · « **Reply #16 on:** March 03, 2011, 21:06:48 »

I'm no expert when it comes to this sort of thing, however if I have that kind of problem I tend to remove them if possible.

Always worth running Super Anti Spyware on a regular basis, it's a good little program and picks up cookies very well.

IRI5HJ4CK · « **Reply #17 on:** March 03, 2011, 21:08:28 »

Hi TFM,

The tracking cookies should be the same as what Norton finds. Superantispyware regularly flags up cookies for me, and to be quite honest, as I understand it, they aren't really anything to worry about.

You should be fine, now that they have been quarantined...but I would certainly advise you to do the whole process again. If you find they re-appear, turn off System Restore, then go through the process again. Some people might suggest not to switch it off, but the virus might get backed up, so the only real way to make sure is to switch it off, in the event that they re-appear.

I tend to do a quick search of the virus names if I ever pick anything up, just to try and find some information about it/them. Some viruses are more common than others, and sometimes it can be difficult to get hold of any real information as to what the virus does...someone else with some real knowledge on the subject might be able to help out here.

Either way, it's good they're gone now. Just keep an eye out, and let us know what happens!

The Ferry Man · « **Reply #18 on:** March 03, 2011, 21:13:34 »

OK thanks

IRI5HJ4CK · « **Reply #19 on:** March 03, 2011, 21:19:32 »

Hi TFM,

Some IE related viruses are nasty pieces of work, which re-direct you whilst trying to click on a search result in google, for example. However, you don't seem to have had this problem, so I'm unsure as to what that virus might have been doing. As I said, I have limited knowledge on viruses, but maybe it would be sensible to change some passwords for accounts of importance, just to make sure.

Either way, don't get too worried! I think you can sleep soundly Haha.

The Ferry Man · « **Reply #20 on:** March 03, 2011, 21:21:24 »

OK Thanks

I use Chrome, so not sure if this would have helped...

Author Topic: Scary - Have I got some sort of virus on my computer (Read 3735 times)

larsdehaan