Good to bad in one day

[altivo]

Well, of course. It was Wednesday again.

The good happened in the morning, before work. I got that limited palette exercise finished and actually it looks pretty decent for what it is, a color sketch on a 9 x 6 sheet of watercolor paper. For details and a link to the picture over on DA, check argos' journal.

Work went downhill though. Around 5:30, when everyone left but the director and myself, we discovered that someone had let a disgusting trojan into one of the circulation desk PCs. This thing masquerades as an antivirus program called "Antivirus XP" (and of course I know perfectly well we have nothing of the sort installed) and claims that your machine is loaded with viruses and spyware and is being "attacked" from various network ports "RIGHT NOW" to try to get you to agree to a "free scan." The supposedly free scan either does nothing or else it installs more crap that will need to be removed. It disables any genuine antivirus software and turns off the Windows Firewall. Fortunately we have a good external hardware firewall, so I knew the claims about being attacked through various ports that are blocked by that device were phony. That in turn proved that the entire thing was a scam. Apparently it builds up to convince you to pay for a "full professional" version of their software, which doesn't really exist. Removing it is no doubt a nasty job too.

I shut the thing down and marked it "out of order." Some one is going to get their ears burned tomorrow, though. Probably it will take my entire work shift to clean this mess up. I suspect I'm going to have to hide Internet Explorer on those machines, and make them use Firefox with popups blocked and AdBlock Plus active, since they just can't learn not to click on these stupid spyware things. I'd filter them down to a list of approved sites if I could get away with it, but I don't think the director will go along with that. Actually, I'd take Windows away and give them Linux, but so far I haven't been able to sell that either, despite the fact that other public service machines that the same staff have been using for three years now have only Linux on them. Most of them are blissfully unaware of the difference.

Weather was nice, sky was really clear. When I got home, Gary had left a note asking me to close the barn doors that he'd left open due to the nice weather. I went out to do it and saw the best star-studded sky I've seen in probably a couple of years. The moon is just a young sliver, so no light pollution from it, and the air was so clear that even the filthy commercial and subdivision lights from towns to the east of us was minimized. Orion and Canis major were blazing high in the sky like I haven't seen them in what seems like forever. If only so many neighbors weren't afraid of the dark, we'd probably even have our view of the Milky Way back tonight, it's that clear.

Comments

[calydor.livejournal.com]

Don't bother trying to clean up after Antivirus XP. Unless you for some reason have no installation disks for the stuff on it, or it has a bunch of settings that will be impossible to recreate, it's faster, simpler and more effective to simply nuke and pave the machine.

Antivirus XP is a textbook example of malware done right - it is resilient to being removed, will recreate itself Brainiac-style from even the tiniest of remains, and fights with a vengeance against any kind of cleaning tool.

Take off and nuke it from orbit, it's the only way to be sure.

(Yes, this was me - feel free to delete the anonymous post)

[altivo]

OK, I "took off and nuked" the anonymous comment. ;p (Go to www.dreamwidth.org/openid and login. On the next screen, check the "Remember me" box and click SAVE. That will keep you logged in here as long as you're logged in at LJ.)

You guys are giving me ammunition for putting Linux out there. Unfortunately we do have a couple of staff who are gullible enough to fall for those screaming pop-up things and I'm afraid that's what it was. Now, what they were doing on a web site that would have displayed one of those is the real question.

This also supports my age old argument that antivirus/anti-spyware software is virtually worthless because it never keeps up fast enough. The machine had all the latest stuff on it. Symantec eats half the CPU with all its paranoia processes, yet this got in anyway.

[calydor.livejournal.com]

You can't really blame them for where they were anymore. There have been numerous reports of sites like nytimes.com being duped into having a malicious ad banner running which would install, you guessed it, Antivirus XP.

The trick is simple: Send in a normal-looking set of ads, let them run quite normally for a couple of weeks, then Friday night you patch in the evilness.

'Hilarity' ensues.

[altivo]

Thing is, I can blame them for clicking on one of those banners, which I believe they'd have to do to actually let this into the machine.

They are now switched to Firefox, with IE hidden from the desktop. I will install AdBlocker Plus on those machines this morning.

[avon-deer.livejournal.com]

I was going to suggest some sort of USB port blocker, but it seems this came on through the web rather than an infected USB stick. The writers of these programs really annoy me. They are getting seemingly more ruthless as time goes on as well.

[altivo]

Yeah, it wasn't USB or any external media in that machine. Too inconvenient to plug them in there. They got it off the web somewhere, almost certainly by responding to one of those malware popups that claims they've "detected a virus on your computer, click here for a free scan." Of course no one will remember doing that...

This really makes me angry. They've been told time and time again not to install anything on those machines, not to download stuff from the web, etc. They know better. I swear I'm going to put Linux on all three of them and be done with it.

[farthing]

Yep, Calydor got it, if it's the same variant I struggled with, it's sneaky. And it downloads more stuff if it is let to stay on the internet. And it seems to notice a removal attempt, and then it gets even worse.

Oh, and it spreads over local area network too, somehow. :-P

[altivo]

Thanks for the warning. I'll try a couple of things with the network disconnected before I give in and wipe the machine. It'll serve them right though if they have to do without it for a couple of days.

[moonhare]

One hour after receiving a note from Technical Services about that particular worm I got a call from the Children's Librarian that her machine might be infected. This is our second 'at work' instance, and the fifth I've had to deal with. Yesterday I just ghosted it all away.

I was able to stall it the first time it hit here. Taskbar showed the process and I eliminated the file. Spybot removed a lot of it, but there was one element it missed, a .dll called iehelper_old.dll, and it came back with a vengence. It wouldn't let me delete itself, so I renamed the bugger and everything ran okay again.

I flattened it a day later, as everyone above tells you to do, because once it gets in it leaves little bits of itself all over the registry. Think of that "Earwig" episode of Night Gallery with Vincent Price.

Oh, and if the staff person was doing their job then they really aren't to blame. This thing comes in in PDF and IE holes. If they were playing on the web outside of their duties, then sure, they violated your policies.

[altivo]

I couldn't find anything that would tell me what process to kill. Of course the web is full of "advice" but most of it comes from untrustworthy sources that could just as well be deliberately telling you how to destroy the data on the machine or infect it with more crap.

Some claim that it prevents spybot or antivirus programs from loading. However, I ran a live update of Symantec and then a scan, which of course found nothing. Symantec is worthless and has been for years now.

I can ghost the hard disk if I have space on the network server for the disk image, but that's unlikely. Windows has grown to such a huge waste of storage and resources that I can't afford the spare disk space any more.

[moonhare]

Okay, just ignore my last comment, since deleted. I forgot that this is a browser hijacker. :o(

However, Symantec is worthless for this. Spybot was blocked in one instance, and I loaded it via flash drive in another. My son's machine wouldn't start in safe mode, and staff did, but, well, blah blah blah... you know what you're doing. Good luck!

[altivo]

This one will start in safe mode, but will no longer run Internet Explorer. It allowed me to update Symantec/Norton and run a scan (which found nothing, no surprise.) I have zero confidence in Symantec at this point. They move far too slowly and never are prepared to block these things until after the wave has crested.

I am going to try Spybot at least before wiping it, even though I got the go ahead to replace Windows with Linux on the machine if I can't recover without wiping the drive. Meanwhile, the machine is yanked and replaced with a much slower machine. I hid Internet explorer on the front desk machines and installed Firefox as the default browser. Updated Adobe Reader to the very latest version (it was behind on all of them.) Updated Symantec to the latest (it was already on yesterday's definitions but who knows...) And put signs on the temporary replacement machine telling them half a dozen things NOT to do. Watch, they'll do them all anyway.