Our headstrong teen and....limewire...

leosayer39

Hi all,

Maybe you should read the following threads before reading this one,

http://forums.moneysavingexpert.com/showthread.html?t=1382717 and

http://forums.moneysavingexpert.com/showthread.html?t=1374523

Anyway, Bingo :beer:

Its been all of one day since the installation of the above mentioned program, and the inevitable has happened and actually I think that our headstrong teen has learned a valuable lessson.

He was at his mates house and only made two downloads using limewire before he got a warning from somewhere, he cant remember where (it has got to be Avira, because there is nothing else on the nice new shiny lappy) that he was downloading or installing a virus ridden file. It happened on both the downloads (or so he says)
Personally I don't care what warned him, or even what he was downloading.

Job done!.....because he has just asked me to 'delete' limewire from his nice new shiny lappy.

I have uninstalled limewire using the add/remove programmes system.
Tomorrow I will run a full virus scan, and I will also run ccleaner and spybot. Is there anything else that I need to do?

Bear in mind that the nice new shiny lappy, at this stage, doesnt appear to be playing up, although I will have a good look at it over the weekend.

A very happy New Year, to you all, from a happy Leo

thomas01155

Try malwarebytes as well. Limewire is full of loads of fake mp3s telling you to download a codec Avira would of stopped it in its track.

Please download Malwarebytes Anti-Malware and save it to your desktop.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.
• MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from hereand just double-click on mbam-rules.exe to install.
• On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.
• Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAMencounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAMfrom removing all the malware. MBAMmay make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.

mulldoonuk

I hope a system restore point has been created...

just to be on the safe side.

DatabaseError

LOL

it should be ok if the AV caught it

leosayer39

thomas01155 wrote: »

Try malwarebytes as well. Limewire is full of loads of fake mp3s telling you to download a codec Avira would of stopped it in its track.

Please download Malwarebytes Anti-Malware and save it to your desktop.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.
• MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from hereand just double-click on mbam-rules.exe to install.
• On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.
• Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAMencounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAMfrom removing all the malware. MBAMmay make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.

Already on a usb stick ready to be put onto the lappy.

I am not going to do anything just now...8pm New Years eve and about to get very busy with family.

If I feel like it I will have a go tomorrow

Cheers :beer:

Leo

bookduck

If he has downloaded any mp3 or films, you could get the details, then copy them into one of those you have downloaded illegal software and we will sue letters, changing all the detail relevant to yourselves.

Print it out, blame him and act furious and rant and with a bit of luck that should stop the illegal downloads for some time too (until he learns how to mask his ip):D

leosayer39

bookduck wrote: »

If he has downloaded any mp3 or films, you could get the details, then copy them into one of those you have downloaded illegal software and we will sue letters, changing all the detail relevant to yourselves.

Print it out, blame him and act furious and rant and with a bit of luck that should stop the illegal downloads for some time too (until he learns how to mask his ip):D

2 mp3 files, and he said he didn't download any more when he saw the virus warnings. I believe him.

Now that is a bloody good idea!

Unfortunately, or fortunately, depending on which way you look at it, this download was done at his mates house, so not done using my isp.

Like I said above, a very good idea for the future, thanks for the idea

Leo

CANTKILLME-Conor3

Sadly sometimes the only way they can learn is to get their fingers burned. There\'s plenty of invaluable advice on how to sort this out on the forum and Thomas01155 has started you off at the right point. Regarding system restore points, it might be actually an idea to turn off system restore until the computer is clean as a lot of malware hides there to re-infect the machine.

leosayer39

CANTKILLME-Conor3 wrote: »

Sadly sometimes the only way they can learn is to get their fingers burned. There\'s plenty of invaluable advice on how to sort this out on the forum and Thomas01155 has started you off at the right point. Regarding system restore points, it might be actually an idea to turn off system restore until the computer is clean as a lot of malware hides there to re-infect the machine.

Agreed! Thanks

Cheers Conor3....are they trying to get rid of you Conor??
What have you done?

Leo

bookduck

leosayer39 wrote: »

2 mp3 files, and he said he didn't download any more when he saw the virus warnings. I believe him.

Sorry, I do not believe him. While some media files can be programmed to carry malicious code (like fash), the majority just carry information and a player processes the information accordingly to set of rigid standards pertaining to the 'container' of media. Anything executable or command that says 'kill everything' is just not part of a players instruction and is seen as corrupt/redundant data and not used.

Also you can't really program a video or mp3 file - but the manufacturers can make their devices toi read that if a file does not have a certain watermark then not to play it, or to the point where they can destroy their own player.. It is possible to hide things in file, but you will have to rename them first to someting executable to get them to work/spread. If this was so you would hear it much more on the news etc. Thin he was downloading a binary/exe/cd (not music or vid).

Your son may be placating you to get you off his back and calm the waters- he may have learned some sneaky tricks from dad .

A whole internet of music and your son can only can find 2 songs that they like - I would have guessed it would be a bit more like a kid in a sweetshop.:D

aliEnRIK

Well.................
No need to say 'I TOLD YOU SO' methinks

FULL scan with Malwarebytes as Tom suggested.
I think id also be inclined to put on PCTOOLS FIREWALL with the included THREATFIRE program
http://www.download.com/PC-Tools-Firewall-Plus-Free-Edition/3000-10435_4-10625321.html
PC TOOLS will automatically know a lot of 'known' programs and allow them through. Any it doesnt it will ASK if it can access the net (Therefore HIS alarm bells should be ringing should he do anymore dodgy downloading)
THREATFIRE will also scan on the fly (Make his computer a little slower maybe, but id much rather that than a complete mess of his hardrive)

Also, 'pron' springs to mind here (ive never EVER yet known a young teen lad who HASNT used his computer to surf for pron!)
So download FIREFOX
http://www.mozilla-europe.org/en/firefox/
and the NOSCRIPT plugin
https://addons.mozilla.org/en-US/firefox/addon/722
NOSCRIPT will auto block nasties coming through the web (the 2nd easiest way to get infected, ESPECIALLY when browsing for 'naughty' things)
So for webpages to work hell need to UNLOCK them (Bottom right icon)
If he unlocks ANY pron ones, he does do at his own risk.....
Heres a list of addons (FLASH etc)
https://addons.mozilla.org/en-US/firefox/browse/type:7

Make sure you IMMUNISE with SPYBOT (It will read ZERO unprotected when its done right). This stops a lot of nasties at the source

Also. Im not entirely convinced I believe him. Look for any NEW programs that appear (Almost certainly be a new icon on the desktop) over time