System Tool 2011 question

Firetastic

Hi Don't worry I've not been infected. What I was wondering is how people are getting this System Tool 2011 virus. Usually you have to download it. But people keep saying they were working away and suddenly it starts downloading itself without warning. So how does it work?

Thank you very much.

aliEnRIK

Far as im aware, it was 'advert' based. So if you were visiting a webpage with an infected advert you got infected (If you didnt have protection of course)

Firetastic

I heard of people going on ebay and Facebook and being infected. I always thought ebay would be a safe website. I know you have to be careful on Facebook. However I don't use it.

It's starting to seem as though there is nowhere safe on the Internet.

crafty*kate

Eeeek! I am infected! Holy smokes, it's changed my desktop background and everything. And I've only been on here and Facebook....

aerostar

On the ones I have seen the injected advert code,(tech info, obfuscated) reduces the size of the browser to a small square in the middle at the same time it puts up a false windows looking box over the small square so you cannot see it, and that says "message from webpage" (or message from AVG or similar) and says your computer is infected, click to continue.

Usually that person will naturally click, it then loads an animation showing a scan in progress with a box that looks just like a proper av layout.

When the animation has finished, there will be click boxes Register, Fix etc, if you coose fix, it then wants to charge/you. At this point it injects more malicious code into the windows startup registry. However if you click the register button you can enter the registration code, which is what you would get if you paid them. If you use the one of the codes from my earlier posting it does remove it, however you must run the Malware bytes scan as well afterwards to ensure that your computer is clear.

See a video

http://www.youtube.com/watch?v=w7f48-Ky9ow

Link to original post

https://forums.moneysavingexpert.com/discussion/3093804

debitcardmayhem

crafty*kate wrote: »

Eeeek! I am infected! Holy smokes, it's changed my desktop background and everything. And I've only been on here and Facebook....

When did you get infected, and what are the symptoms?

aliEnRIK

Firetastic wrote: »

I heard of people going on ebay and Facebook and being infected. I always thought ebay would be a safe website. I know you have to be careful on Facebook. However I don't use it.

It's starting to seem as though there is nowhere safe on the Internet.

To be fair to ebay, theyve now (or at least they claim) they no longer use that advertising company due to the lapse in security

crafty*kate

debitcardmayhem wrote: »

When did you get infected, and what are the symptoms?

This evening...had a few windows open, one on here, one on FB, then all of a sudden I get a 'Windows' error message telling me I am infected and I need to run a scan with this program called System Tool 2011. Then it changed my desktop to some hideous blue screen with red warnings all over it. Oh, and I kept getting a message telling me that the virus Avast.exe had been detected - Avast being the protection I normally use.

I'm working on removing it but I'm having problems with Malwarebytes - will post a separate thread

birkee

Firetastic wrote: »

Hi Don't worry I've not been infected. What I was wondering is how people are getting this System Tool 2011 virus. Usually you have to download it. But people keep saying they were working away and suddenly it starts downloading itself without warning. So how does it work?

Thank you very much.

GOOD QUESTION!
That should help some people out!

Too many people just follow instructions on-screen, without the knowledge to judge whether they should or not.
That's just because they are not as computer literate as other people, not a condemnation.

Firetastic

Would using Sandboxie prevent the malware from infecting the computer?

birkee

Firetastic wrote: »

Would using Sandboxie prevent the malware from infecting the computer?

Isn't 'Sandbox' a Kasperski Internet Security item? Or, is it released as freeware somewhere with th 'ie' on the end?