System Tool Virus

Browntoa

this thread from the weekend about Ebay

https://forums.moneysavingexpert.com/discussion/3080422

aliEnRIK

Ive always blocked 'doubleclick' with NOSCRIPT. Probably just as well after reading that

Browntoa

found it

http://www.theregister.co.uk/2011/02/28/tainted_ads_blight_uk_sites/

Several highly trafficked UK sites – including the website of the London Stock Exchange – served malware-tainted ads as the result of a breach of security by a third-party firm they shared in common.
Surfers visiting auto-trading site Autotrader.co.uk and the cinema site Myvue.com were also exposed to the attack, which stemmed from a breach at their common ad provider, Unanimis, rather than at any of the three sites themselves. Unconfirmed reports suggest eBay.co.uk was also affected.


The malicious ads made several concealed redirects before dropping surfers on a portal pimping rogue anti-virus (AKA scareware).

Google's malicious website detection tool was among the first security tools to flag up the breach

laurel7172

Removed it from my daughter's netbook with superantispyware, though I had to run it a couple of times in each user account.

I also rewrote the hosts file, as advised here: http://www.fakealerts.com/rogue-antispyware-fake-alerts/remove-system-tool-malware-357.html

(though I couldn't get OTM to work and ended up using the help files on the microsoft website to do it manually)

aliEnRIK

spg_SCOTT wrote: »

From what I have been told, it can be easy to remove with OTL...just a few lines of fix.

Just about every case on here has required the manual removal of certain files using combofix

resetting the hosts file wouldnt help with that

I suspect many people that 'think' theyve completely removed it will find they havnt

That said, I havnt done enough to really say for certain thats the case. It could be multiple infections that have nothing to do with system tools

Browntoa

I think we have seen the peak of this particular attack , but may possibly be a new trend

spg_SCOTT

I get my information from essexboy, a malware removal teacher at Geeks to go, so I doubt he 'thinks he removed it, when infact he hasn't'
His experience is that it is removable...

OTL does more than just reset the hosts file...and AFAIK more useful than HJT...

aliEnRIK

spg_SCOTT wrote: »

I get my information from essexboy, a malware removal teacher at Geeks to go, so I doubt he 'thinks he removed it, when infact he hasn't'
His experience is that it is removable...

OTL does more than just reset the hosts file...and AFAIK more useful than HJT...

Thats fair enough. I was only stating that combofix has shown many different files that required moving (again, maybe nothing to do with system tools though)

MrsE_2

aliEnRIK wrote: »

How big is this thing? Ive never seen so many posters on the same forum with the same issue?

I get the feeling this is going to get so much bigger..........

I'm a dumb a$$ when it comes to tech stuff, but I've never known something to hit so many people at once.

becky170

I got this virus at the weekend. At the time I had a couple of pages open including thetraineline and the bandbdirectory. I did a system restore to a couple of days before I was infected. Following several websites advice I checked my registry files and couldn't find any system tools registry keys there. I downloaded Malwarebytes, and although it found a trojan it didn't appear to be the system tools virus. I'm hoping that I haven't got the virus still lurking around somewhere....my computer seems to be running ok though.