Dodgy site?

melbury

My OH was using computer this morning and suddenly got one of those things where it starts flashing that every bit of your computer is infected etc etc. He thinks he clicked on a thing that said enable protection, but said that nothing happened. He then came straight offline and ran a virus scan, but it didn't show anything.

In the history the site is called:

thedwnlavs.com

I have now downloaded Malwarebytes and am running a full scan.

Has anyone heard of this?

I know when it has happened to me, I nearly have a heart attack and panic, which is of course exactly what these scammers rely on.

Any info greatly appreciated.

Thanks.

fwor

Firefox automatically blocks that site now as a "reported attack site", so there's no real doubt that it is a malware threat.

This is one of the really good reasons to use NoScript and Firefox - it's a little inconvenient until you get used to it, but it's a whole lot more convenient than having to clean up malware on your PC...

melbury

BTW when I downloaded the Malwarebytes, it also wanted to download something called reimageplus, whatever that may be. Any ideas?

waddler_8

melbury wrote: »

BTW when I downloaded the Malwarebytes, it also wanted to download something called reimageplus, whatever that may be. Any ideas?

That's just an advert for some other software on the MBAM download page - dont download it (reimageplus).

Firetastic

When you get those fake antivirus websites the best thing you can do is press is ALT and F4 which will close the screen down straight away.

fwor

Firetastic wrote: »

When you get those fake antivirus websites the best thing you can do is press is ALT and F4 which will close the screen down straight away.

A modern PC's CPU can execute millions of instructions a second.

By the time your brain has even registered the appearance of the fake on the screen, the damage will already have been done.

Firetastic

fwor wrote: »

A modern PC's CPU can execute millions of instructions a second.

By the time your brain has even registered the appearance of the fake on the screen, the damage will already have been done.

I understand this because one time I came across this I switched off the computer but still got infected with Trojan.FakeAlert which spread through a couple of my folders. Thanfully I had backups so not catrastrophic.

I thought the longer you kept it up on the screen then the more likely chance of Trojans getting on your system.

waddler_8

The alt + f4 method can work to close out the fake scan screens & depending upon your browser/security settings, or if there are no holes to exploit either in the OS, browser or other software (particularly those with a browser plugin - Java, Adobe etc ), then that'll be the end of it - clear out your Temp Internet files & you're done.

It's when the security settings are too low, or there is vulnerable software ripe for exploitation that the problems start & the malware is able to download & install without any user intervention whatsoever.

Then of course there's the user falling for the social engineering aspect of it and therefore initiating the download & installation themselves.

melbury wrote: »

My OH was using computer this morning and suddenly got one of those things where it starts flashing that every bit of your computer is infected etc etc. He thinks he clicked on a thing that said enable protection, but said that nothing happened. He then came straight offline and ran a virus scan, but it didn't show anything.

melbury

waddler_8 wrote: »

That's just an advert for some other software on the MBAM download page - dont download it (reimageplus).

OMG I think I did download it but didn't install it. It all seemed to be part and parcel of the Malwarebytes link.

Does that mean it is lurking somewhere waiting for me inadvertently install it? If I could find it I would delete it.

Please, what happens to things that are downloaded but not installed?

waddler_8

Just do a file search for reimagerepair.exe - then right click and delete it.

I would imagine if you did download it then the installer will be in the same location you downloaded the mbam installer to.