System Tool Virus

aliEnRIK

How big is this thing? Ive never seen so many posters on the same forum with the same issue?

I get the feeling this is going to get so much bigger..........

mttylad

I just removed it for someone.

Rkill and malwarebytes did the trick.

aliEnRIK

mttylad wrote: »

I just removed it for someone.

Rkill and malwarebytes did the trick.

In my experience on here, malwarebytes isnt enough to completely remove it (or some versions of it)

GunJack

aliEnRIK wrote: »

How big is this thing? Ive never seen so many posters on the same forum with the same issue?

I get the feeling this is going to get so much bigger..........

Have to agree....seems like every other thread is linked to this.

Would also be interesting in terms of tracking down possible sources if further postings could note what they were doing online just before the infection. Have heard facebook and ebay mentioned in a couple of threads, but that's hardly definitive - so any good gen would be good

aliEnRIK

Im wondering if they should post this on the weekly email and get everyone to run a precuationary malwarebytes scan

GunJack

aliEnRIK wrote: »

Im wondering if they should post this on the weekly email and get everyone to run a precuationary malwarebytes scan

not a bad idea mate, and maybe with a link to one of the completed threads on here almost as a "walk-through"

Browntoa

this was the one that was targetting adverts on Ebay and many web sites, looked like a timed attack to hit the weekend

too late for this weeks MSE email

almost got caught with it just now , was looking for a Laptop manual , link on google showed it as on scribed ....as soon as i clicked the link it changed the page to look like wndows Explorer and started a "scan" (I assume some sort of flash mock up) which I killed staright away. If I click on the properties of the link on google I followed it is obviously NOT a page on scribed !!

duly doing a full scan with malwarebytes to be safe

assume the less techie would have been caught out

aliEnRIK

Browntoa wrote: »

this was the one that was targetting adverts on Ebay and many web sites, looked like a timed attack to hit the weekend

too late for this weeks MSE email

So to get it people must have clicked on a banner/advertisement?

Browntoa

no , seemed to be a script , i had a page pop trying to direct me to a web page ending .co.cc

possibly a new IE exploit ) although that would have hit the press by now

aliEnRIK

Cheers Browntoa

Please post back here if you manage to get any more info please. Im trying to get to the bottom of exactly whats causing it

spg_SCOTT

aliEnRIK wrote: »

In my experience on here, malwarebytes isnt enough to completely remove it (or some versions of it)

From what I have been told, it can be easy to remove with OTL...just a few lines of fix.

So to get it people must have clicked on a banner/advertisement?

AFAIK, not necessarily. The code can be injected to the adverts...
A little old, but the info is relevant:

The malware usually spreads through web infection placed on innocent, badly secured websites. The ad infiltration method is growing in popularity alongside with the website infections. Now we are facing probably the biggest ad poisoning ever made – all important ad services are affected. It means that users might get infected just by reading their favorite newspaper or by doing search on famous web indexers. User interaction is not needed in this attack – infection begins just after poisoned ad is loaded by the browser – it is not a type of social engineering.

http://blog.avast.com/2010/02/18/ads-poisoning-%E2%80%93-jsprontexi/