Crimeware and Malware

Remember this post?

Sherlock's Computer Nearly Taken Hostage

This is yet another good reason to have a second account on your computer. Don't use it for anything except to use it when your computer is badly infected, installing the malware checkers after setup if they're not there already. The advantage is that when the original account is infected, the second account should not be affected.

We're familiar with Windows Security Suite and its related ilk and copycats. Now meet Reveton and its creator software.

Reveton Malware Freezes PCs, Demands Payment

Not exactly new, but Reveton builds upon previous crimeware and rasomware by adding in a twist of acting like the FBI's taken over your computer. The FBI will never do this. They will serve you a warrant/subpoena, arrest you, and/or take the computer.

In this case of infection, malware checkers should be able to clean this infection, but in some cases, a complete format and reinstall is better.

Here's an updated list of what to use. All are free:

Microsoft Security Essentials - http://windows.microsoft.com/en-US/windows/products/security-essentials
CCleaner - http://www.piriform.com/
Glary Utilities - http://www.glarysoft.com/
Malwarebytes Antimalware - http://www.malwarebytes.com/
Superantispyware - http://www.superantispyware.com/
Spybot - http://www.safer-networking.org/
AVG - http://free.grisoft.com/

Microsoft Security Essentials can easily work on its own, though you may want to use the others to help out.

Sherlock's Computer Nearly Taken Hostage

Not too long ago, I had a frantic request for help from Sherlock Steve. As it turned out, his computer was taken over by something called Security Suite Antivirus. Unfortunately, it's not a normal so-called anti-virus suite of programs. What this thing does is it just badly takes over the computer. It claims that everything you try using and running are infected. In fact, the programs that are "infected" are not. It's the Security Suite Antivirus saying these things.

Here's more on Security Suite Antivirus and how it's a scam;

Remove Windows Security Suite. Description and removal instructions
Windows Security Suite

Security Suite is ransomware. Meaning, it holds your computer hostage, allowing nothing to work, claiming it's "finding malware." It says you must pay the fee in order to get your computer back. This is similar to scareware, which runs and claims you're badly infected but doesn't quite take over the computer like Security Suite does.

Internet Explorer didn't even begin to work properly, not even allowing a new browsing tab. It kept going to Security Suite's webpage. Task Manager wouldn't work, neither would a CTRL-ALT-DEL, etc.

Next was to go into Safe Mode via F8. He had Admin mode, another account. That was one plus that helped make things easier. We followed the instructions on this page;

How To Uninstall / Remove Security Suite Virus ( Removal Guide )

Malwarebytes Antimalware found quite a few as did SuperantiSpyware, Spybot, and AVG. All four are free.

Sherlock got his computer back up and working the same day.