Virus warning

[giraffe]

I've just received two emails headed something like "Thank you for buying an itunes gift certificate" My computer had flagged them up as being viruses and as I don't have an earpod I wouldn't have opened them anyway. Just thought I'd warn the rest of you in case you have ear pods.

[MBH]

While trying to buy some items from Thoosa sportswear online I was worried when I saw a Visa Verification screen overlay the checkout screen asking for card information INCLUDING the ATM Pin Number

Backed out very quickly - of course - and foolishly forgot to take a screen dump of it at the time.

I reported it to the company and their IT team have checked the systems to confirm it is nothing at their end of the line - they did report a virus that is around at the moment. They pointed me towards this forum which I thought I'd share with everyone. [LOVE the forum name ]

http://www.bleepingcomputer.com/forums/topic445441.html

Interesting that it's attacking Firefox. Looks like someone is being clever as well as sneaky and I can imagine more trusting computer users (i.e. less experienced) possibly falling for this as the screen did look like a verification screen I've seen before.


Looking at the rest of that screen (the suggested fixes and products to install), I'd be interested to hear from the other technical guys what you make of it and if there is any maintenance we SHOULD be doing in addition to simply having an AVG style virus checker in place? At a quick read through I understand very little of it and can't get my head round 'studying' it.

[SparkOut]

The site to which they directed you is "useful" but not really "useful" unless you can be sure of following the sort of instructions given and report back to a person who can interpret the results. Or be comfortable that you can interpret the results and decide that your machine is cleaned, if it had been compromised.
The information on that particular thread is perfectly good, and reasonably straightforward to follow given the handholding of a helpful member there, who is interpreting and identifying what should or shouldn't happen next. If you were to do all the things suggested in the order and manner described by boopme on that forum, then it shouldn't hurt, and should fix the sort of malware issues described.

It is worth noting that incorrect use of some tools can break the computer, requiring more comprehensive fixing beyond the scope of the tasks in the forum mentioned. Or depending on what "infection" has incurred, automatic "fixing" like this may be a cure as bad or worse than the disease.

So in answer to your question, I would say that the products and tools mentioned on that site are useful to combat an infection that has already been incurred. They are not going to help the average user who has no normal need to fix, they are "diagnosis" or "curative" tools, not "preventive".

Ensuring your Antivirus program is up to date, not using torrents, staying away from smiley sites and being vigilant about what pages/software/things say "is it alright to install/run ..." is more useful to normal users. One thing is likely - the sportswear company's site is probably NOT infected and not the source of the security issue. The machine you were using likely already had some compromise, which was waiting for someone to make an online payment and popped up as you described, where it could have happened on any shopping site you visited.

I haven't tried AVG for some time now (hmmm... at least 2.5 years) so I don't know what their performance is relative to the other players, but I was always happy that they were one of the two I'd recommend as being effective and free without being overly resource hungry. My personal choice at the moment is Avast! which I know the free version includes a "connection block" on compromised sites and sources (as well as the usual "file scan"). If AVG has a similar real-time web/streaming protection for free then I think you were just unlucky.

Having BEEN unlucky, I think you should not just scan your computer with your regular antivirus, but you should also go at least some way through the steps described by boopme. If you use Firefox to visit another shopping site and "pretend" to buy something and you get another suspicious popup, then you should definitely take more in depth action. When you are SURE that the system is clean, please take his advice and make a new System Restore point to which you can roll back in case of need, and delete all the old ones.

[MBH]

Cheers for that

As it turns out, this occurred on the 'borrowed' eee-pc mini-notepad-stupid_keyboard-so_called_computer that I'm using as my living room Internet access. It has somethng called 'OfficeScan' on it and I have NO idea how (or if) it updates itself. What it does have is a "DeepFreeze" type set-up which means all I should need to do is reset the unit to bring it back to it's clean state.

My raising of this was to highlight the plausible looking virus and then I got interested in the technical stuff I was directed too. I'm possibly overly-suspicious of these freely downloadable 'tools' that people are encouraged to try