WARNING: A TROJAN INFECTED SITE

[Ron T. Storm]

This morning I went to Adultwork and without doing anything a trojan called 'Antivir Solution Pro' was installed on my PC.

This disabled my antivirus and even prevented me from running Control Panel.

I used my other PC to find the removal solution and found out that sites can be injected with this trojan and automatically install this malware.

The malware tells you that your PC is infected and ultimately you have to pay to have the viruses removed.

This is the first time in 20 years of computing that I have been caught out and wanted to warn others.

It goes without saying I keep my antivirus and Windows updated daily so it was a nasty shock to get this.

Ron.

[Ron T. Storm]

I have not Installed Vista Service Pack 2. So this is probably the problem. !idontbelieveit!

[BigMattyP]

Shit, that is not good fella, i am on that site too!
I run a mac though so maybe I won't be affected. It is shit though. I hate viruses etc, why can't people just get a grip?
Thanks man, hope you get it sorted
Big Matty P

[Ron T. Storm]

It won't aafect your Mac. Bloody annoying thing is I got an iMac as well. Should have used that.

Normally I use Firefox on the PC but because uploading pictures doesn't work through that I had to use Internet Explorerh is where the trojan got in.

I have now updated to the new service pack and am going to try the site again.

Hopefully I should be ok otherwise I will be offline line for another half hour.

Ron.

[BigMattyP]

Ok cool, thanks man.
I am a bit of a techno spaz to be honest so things like that usually take me forever to fix!
Good luck with it though and thanks for the warning

[TattsIt]

The right pain the $%?$ with this is that it stops you starting Anti-Virus/Malware software, Task Manager & other programmes - saying they're infected.

But, if you reboot into Safe Mode (F8 on boot up to choose Safe Mode). Then see what programmes are Auto-Starting on bootup - how? Well, I would recommend CCleaner (using the 'Tools' then 'StartUp' option) or Run (from Start Menu) and then msconfig. You will then see some sort of randomly named exe file (like I had gmjklntssd.exe).

Obviously disable the autostart and then find (and get rid of the file) - again, in a randomly named folder in.... C:\Documents and Settings\ \Local Settings\Application Data.

While you're at it, I would recommend getting rid of your Temp and Temp Internet Files - again CCleaner or ATFCleaner can help!!

Oh, and seriously consider Malwarebytes Anti-Malware (there is a free version available).

[Ron T. Storm]

Hi,

Did exactly what you said - that malwarebytes did the trick. The problem has not come back since I installed service pack 2.

I hate these fuckers who write this shit. It cost me about 1 hour of valuable time to fix this morning.

Ron.

[sparky]

Ron, That's bad from a major website. I was on there yesterday.

Later I had a message my Avast had failed to update although it updated earlier. It seems to still be running properly today as I have just run a scan which completed but I'm watching for anything abnormal.

Thanks TattsIt for recommending the MalwareBytes Anti-Malware program too.
I have just downloaded and scanned my PC - fortunately it is reported clean.

When we caught something at work Kaspersky Virus Removal Tool, again a free download updated every few days, cleaned up when others failed.

[Arsewithclass]

Guys, it probably isnt AW. Im on that every day & most nights while working on other sites. AW has no infection.

Ron, which sites were you scanning last, before you turned your pc on?

These are the culprits, not the first one you looked at. Thats how a virus works.

[Arsewithclass]

Adding another comment so that the subject can be seen also....

I have been on AW all day & no problems here. I think it could have been your last site you looked at before you let your pc rest for the night. When you turned it on & began surfing, your pc was probably already infected.

Hope you sort it out Ron