***WARNING*** Very nasty virus doing the rounds

Lucero_2

Hi all,

I am now on my 3rd iteration of client support for a virus sent via email.

The email portrays to be from Royal Mail with details of a parcel awaiting collection. The attachment lists the details of how to collec the parcel. The email is addressed to the correct person and even goes so far (in some cases) to know details about the addressee.

Upon clicking the attachment, the computer will have multiple pop ups appear on the desktop including what looks like a very genuine Microsoft message telling you that the hard disk platters have been destroyed.

So far MSE is the only current known AV to detect it, and although it offers a fix, it is unable to actually repair itself.

Clicking on start lists an empty directory and click on "all programs" comes up as blank. At this stage, all the data is still intact but you have to keyboard shortcut to "my computer" (Winkey +E) to see the programs and data.

If the virus detects a MalwareBytes process, the computer immediately disconnects from the internet and shuts down the computer. Upon restart, you will be presented with a "disk not found" or "disk corrupt" message.

You will need to use recovery to restore the PC.

neilwoods

would have to be pretty daft to open the attachment, seeing as royal would not send an email to say you have a parcel awaiting to be picked up.

GunJack

and also very surprised if MSE is the ONLY av that detects it.....

kwikbreaks

and very disappointing that it doesn't block it but only reports it after the event...

ChiefGrasscutter

neilwoods wrote: »

would have to be pretty daft to open the attachment, seeing as royal would not send an email to say you have a parcel awaiting to be picked up.

As the OP says they are on 'client support'.....then I'd imagine that their clients (ie persons/companies on whose behalf the OP manages some aspect of their computing) are indeed pretty daft. Or esle they work in a company environment so don't really care what they open/click on as "hey, someone else will fix it and it's not my computer"

Lucero_2

Don't worry, the 3 people have all been old. What tricked them was that the email contained personal information which really couldn't have been known.

The first, listed an address (from which the addressee had recently moved from) which made him think it was genuine.

The last, had MSE and Avast on it. Avast remained completely silent even when the virus was in full swing. MSE offered to repair, highlighting the explicit issue, but couldn't. Running MBytes made things worse.

I'll be picking up the 3rd one today to examine it more closely.

Andrew1472

Lucero wrote: »

Don't worry, the 3 people have all been old.

Thanks for the heads up, but is being old a requirement for getting tricked by this?
The implication is that, as my 60th birthday is only a few weeks away, I'm not capable of taking care of myself online. Of course the young don't click on things they shouldn't do they.
You need to think about that sentence and your attitude. It is offensive!

Esqui

I think that may have been a typo for "have all been told"

Andrew1472

Esqui wrote: »

I think that may have been a typo for "have all been told"

I hadn't thought of that.......must be my age:D
I'll wait for confirmation.

Lucero_2

Andrew1472 wrote: »

Thanks for the heads up, but is being old a requirement for getting tricked by this?
The implication is that, as my 60th birthday is only a few weeks away, I'm not capable of taking care of myself online. Of course the young don't click on things they shouldn't do they.
You need to think about that sentence and your attitude. It is offensive!

Opps, yes, indeed, should have been "told". No offence meant

Coincidence though, that the people involved are of the "older" persuasion and do get tricked in to these emails and phishing easily.

pelirocco

I open up this thread to find one of the posts has a highlighted word , and sure enough I have got mailware again ...........Why or how does MSE pick this up?

And no I havent opened up any mail from royal mail ( or any other suspect mail )