Viruses and Facebook

I would like to say I am part of the cause for the new Facebook awareness of Viral banners, links and apps on their site.  But I am not that full of myself to think that my one voice actually got through in spite of my complaining for a year.  Last month I basically left Facebook. I got the third infection in less than 12 months.  It is time for me to move on and leave that site to the lowlifes on the internet.

The first was a stupid registry reviver one, easily spotted and cleaned.   The second was a basic speed up your computer one - eight months later.  Same idea, They want you to run out to their site, and BUY the product that is going off except of course it is not finding the 30 viruses and spyware it lists as finding on your machine, though it may be installing them.

 I noticed it because my drive started cranking , then Flash tried to start.  I was reading an article. No reason for flash unless it is a banner which I had blocked, yep it was payload drop time. 

The screens look like they could be official.  Perhaps it is a mutation. all I know is suddenly my files seemed to disappear. I started to panic then relaxed, it was only MY user directory affected. Fine, Easy solution - SYSTEM RESTORE.  Several hours later I had it found, removed it and then cleaned, recleaned and reupdated the machine.

This one was the last straw. It had attacked the FAT. The File Allocation Table could not FIND the files to tell me they were there.  I muttered steamed until I realized Trend was scanning them.They were there. Just not able to be found.

Trend Micro's Housecall took it out.  I then followed with Malwarebytes which traced the rest of the components and removed them.  Where exactly these came from, I am not certain to this day but most evidence points to Facebook and one of those crappy banners.  But hell for all I know Bleeping Computer, GamerDNA or even Major Geeks could have been the source.  All are sites I frequent.  So I cleaned it up  kept a component or two that were non functioning without the rest to test virus checkers with and moved on.

Last month I got hit again.  This time a bit more seriously.  Yes it was another crapware banner delivering a javascript to my machine.  As far as I can tell I had this..Vista Total Security 2011 the link is to a site describing it.  This one is a Royal pain.  Thank goodness no one codes for Opera.  It starts by setting off the Official looking Your computer is infected.  It looks like a Windows defender screen. Except.. Vista is no longer really supported, and they would not charge for the fix.

If you try to open defender it is blocked, if you try to go to a website it is blocked. Here is how it works,  it downloads a little .js that sits in your roaming directory. Every time you try to open a browser page, it calls the .js to put up the page that says that the site you are trying to go to is infected.  Solution - turn off  javascript right?  Well not exactly.  I do not know if it was Firefox 4.0 or the virus but  I would turn off the .js and it would still run.  When I reopend the tools in Firefox it was checked to allow .js again and again and again.  Firefox has a 4.01, perhaps it a was a glitch in their browser or perhaps it was the virus finding a way past that.

So I did what any geek would do. I opened Opera, opened a new tab, got the error and then opened Dragonfly.  I saw what it was being called and from where. So I typed in https://trendmicro.com in Firefox  and guess what it worked.  I got housecall to run  (I do NOT keep the component in a default directory)  and got it to start cleaning off the virus, except - it did not get the java script.  So I tried Panda.  Got a message that Activescan does not work with my version of Firefox or of course with Opera. Mutter. I downloaded the 30 day trial.  I will give my evaluation of that soon.

However to be fair it found the java script and zapped it, Can anyone tell me why Microsoft keeps people from accessing and clearing the java cache?   Last week my daughter came to me, guess what - it was going off on HER machine, Facebook is about the only place in common we go anymore.  She cleaned it, we think she got it all she tried the trend 30 day free download except it seems it does not like Malwarebytes.  Too bad it works!   I updated Firefox to 4.01 and Opera to 10.11.  Activescan still does not work with those according to their site.


So I log into Facebook last week  to leave a client a message. I see they have the HTTPS in full swing - except it does not work on any applications which are the biggest offenders.  I see they have their protection on for links, except it blocked a legitimate site I was trying to go to on information about a virus spread through Facebook. And last I see the same ads on the right hand side.  And the machine goes nuts, Yep it is trying it again! NOT THIS TIME BUDDY!

Sure they check the ads - the first time, but what about each subsequent ad.  Are you sure they have not been compromised by a third party?  Why are they placed on the right on the games and groups where a mis-click can potentially end in an infected user's machine.  Why are there ads for products and techniques already known to be scams or at the very least suspicious in their claims? You know how many Acai berry diet plan ads i saw there when that was the big fad?  Hey HERE IS AN IDEA FACEBOOK - Only accept ads from REPUTABLE companies and Websites instead of lining your pockets and including in your TOS that if any user's machine is damaged by the site it is their problem nay even their fault for trusting you to perform due diligence.  So in the mean time - you all can find me on MySpace or Twitter or the gaming sites. That is unless they all decide to follow the Facebook Model and put profits over their users.

Then you will find me curled up with a good book and on the MUD.

February Blahs

February is a dreary month. So I like to forget it exists and drown myself in geek like activities. This year - so far it has been nothing but one disappointment after another.

Zone Alarm - I used to love this firewall. It was great. Now I question it. I have had no intrusion attempts since installing it. At least according to it. I used to have pages on my 98 machine. I have not chaged internet providers, I have not changed my browsing habits, much. So suddenly going to Vista and the new version made all those SQL Server worms leave my ISP alone? I MIGHT believe it IFF every time it asks for permission for a file to access the internet it did not come back with no info in the knowledgebase about these files. Many have been in the system since XP. I fear Zone Labs may be losing their edge, I hate to see that.

Firefox - Yes it is one of the most popular browsers. Yes I have it and use it. But since it is becoming more and more popular, it is losing it's edge imho. It now takes longer than Opera (with multiple tabs) to load. Its interface looks a lot like Opera. (althought I may have Opera to blame for that, too) But now sites that look best in Firefox no longer look good in Opera. Opera hasn't changed. Sigh. So Firefox has bought into the heavy overheads to make it more user friendly. Also, it seems it is very forgiving of HTML errors to the coder. The reason I have Firefox is a convention I wish to attend this year could only do online registration if we had Firefox. The forms did not even work in the virus breeder known as I.E. Bad show on the part of the developer, but still one wonders why they would not work in ANY other browser? Trying to become Microsoft, guys?

Opera - Yes, it is still my main browser. The reasons? First it is not very popular, that means the hackers have not found security holes in it or do not bother to exploit them. But the developers seem to have a severe case of Firefox envy. Go back to making a fast loading, efficient browser that is W3 compliant. That is all I ask guys.

Gaming companies - EVERYTHING is online, yet nothing seems to be compatable with anything else. And why can't someone make or include a basic translator built into the gaming interface online. I would love to have more friends in Europe, but my French is borderline, My Italian is awful and forget my German. It would be nice to coordinate. More on that here.

ISPs - All seem to assume that we have access to high speed lines. I do not. Well I may, but it seems AT&T themselves are not certain. At&T decided to charge more for dial up than for DSL. You can read about it here. Good thing I use Earthlink.

Panda Security - Another company I loved. Great scanner, online capability. BUT their site still links to a scanner that does not support Vista. Guys, the OS has been out for over a year. Get with it! Trend has been supporting it since May of last year at least. Oh yeah and NONE of em support Opera, but at least most now support Firefox.

And last but certainly not least:

MICROSOFT - First I want to know what is in each update, so I can decide if I need it. The user friendly update check just lists updates, one has to go difgging to find out, How ard would it be to put a little sentence or two. Like, fixes a home networking issue. Security issues in OS fixed. I mean they'll all be in the cume anyway. But at least let me save a little time? Then there is the latest udate to I.E. Ok sometimes I still need it to check a site. So I admit I keep it updated. Well I did until recently. Update failed. It happens. So I check details. I get the usual helpful Microsoft Information - Error details: Code 800719E4. So I hit the site and go looking. DO you know running a search for that error code returned the result that the code was not found ANYWHERE on the site? The get help, link next to the code listed a few obvious options but nothing with information about that code.

What's new. Did I really expect Microsoft to make it easy for me to find how to fix my own machine? I am certain they would rather have me throw it away and buy all new from them again. It Ain't happening. Not even if I have to get an AS400 or an HP 9000 and load their proprietary O/S At least they give users of their operating systems a manul with a list of the error codes.

Maybe next month will be better. I doubt it, but I can hope.