Spyware, viruses, & security : Porn virus help please!
Porn virus help please!
by auxtek - 9/6/09 7:32 AMMy gf's daughter asked me to look at their computer because she was getting a pop up internet security virus/malware. When I did, about 10-12 porn sites showed up in the history for the last two days. I erased the links, rebooted explorer, and they came up again. I erased them again then rebooted the computer and they were gone. About a week later, porn icons filled the computer screen. My gf took the computer to an expert(who happens to work for the police in this field) he looked into it, and determined that the only way this could have happened was by actually going to porn sites. I don't think he found anything in cookies or anywhere else as far as I know. I know that I didnt go to any sites at all and I'm also pretty sure her daughter didnt either. I did see some music download stuff but was told it was never opened or used. So my question is - Is it possible for this to happen without going to a porn-type site? Because of this, my relationship ended with my gf but maybe this can help someone else that is put in this situation that is innocent.
get Hijack This
by frifawnwolf - 9/6/09 8:09 AM In reply to: Porn virus help please! by auxtekUse cnet downloads and put
1-HijackThis on a usb flash drive using a good computer
2-install on infected computer,(unplug or turn off net connection beforehand)
3-run program,during which it will ask you to reconnect to the net
4-done
once you register HijackThis,you will have free use for 30 days only
A couple of things
by roddy32
- 9/6/09 9:49 AM
In reply to: get Hijack This by frifawnwolf
1. HijackThis is free always, not just for 30 days.
2. It does not have to be registered.
3. It should also NOT be used without supervision. It is too easy to delete something you actually need. There are forums that do this that have trained experts but CNET is not one of them.
Here are just a few of the reputable ones. There are others also.
1. http://www.lognrock.com/forum/index.php?showforum=5
2. http://forum.securitycadets.com/index.php?showforum=2
3. http://www.temerc.com/forums/viewforum.php?f=12
4. http://www.malwarebytes.org/forums/index.php?showforum=7
5. http://www.bleepingcomputer.com/forums/forum22.html
4. If YOU downloaded a trial of HJT that is only free for 30 days you probably downloaded a fake one. There are many out there.
Actually that was more than a couple of things 
Re: porn virus help
by Kees Bakker - 9/6/09 8:18 AM
In reply to: Porn virus help please! by auxtek
All we know from your story:
(1) there were links to porn sites in the history
(2) there were porn icons (what are that?) on the screen (what screen?)
As for (1), it's uncommon that a link is in the history without the site being visited. But I assume it can be done by a malicious program. But I see no good reason why it should do it. So let's assume that somebody HAD visited that sites using THAT userid. See, it makes sense to have a password protected userid. Then nobody can use that to put something in YOUR history.
As for (2) I assume that any site can leave something on a not-well protected machine that would have that effect. So that only proves that SOMEONE visited SOME site or opened SOME email and maybe was a little bit uncareful doing that.
Kees
RE: porn virus help
by auxtek - 9/6/09 8:42 AM In reply to: Re: porn virus help by Kees Bakker
Thanks for responding to this.
The links in the history were for the day I logged on and the day previous to it. I had not touched her computer until the day I logged on (I don't live with her) They were all different types of sexual catagories..but all sexual in nature.
The computer runs on XP, and everyone uses the same history and stuff..no seperate windows log ins for each individual.
The porn icons appeared all over her windows desktop. (upon looking, these would be called window shortcuts) I never saw them, but from what I was told they had obsene pictures on them and linked to pornographic sites.
The computer guy that looked at the machine said there was no way to have that happen without going to a pornographic site, and being the only male that visits, I'm the prime suspect. That was the first time I had touched the computer in over a month.
The machine was running Norton antivirus, but thats it. Thanks again.
It would have been rather stupid ...
by Kees Bakker - 9/6/09 9:07 AM
In reply to: RE: porn virus help by auxtek
to do it that way. And you don't seem stupid, so that casts some doubts on the conclusion.
Let me give one tip to readers wanting to use computers other than their own for visiting whatever sites (especially sites they wouldn't tell in public): use portable Firefox. Runs from a USB-stick and leaves no traces in the computer used. Good both for privacy and for (computer) safety.
Kees
Porn virus help
by auxtek - 9/6/09 5:35 PM In reply to: It would have been rather stupid ... by Kees Bakker
Has anyone been in or seen a situation like this? Is it possible to get this stuff without actually going to a pornographic site?
The computer was fixed by the computer guy so it just boils down to my word vs. his. I think the relationship is done anyhow but I would like to find out the answer for my own piece of mind.
P.S Thanks Kees..it would have been very stupid. Especially when I live somewhere else with my own computer.
To further elaborate
by auxtek - 9/6/09 9:03 PM In reply to: Porn virus help by auxtekI know the most likely way for something like this to happen is by actually browsing pornographic sites, but this computer guy says its the only way. I really find that hard to believe. I would think you might be able to get a virus like that via an email, music or video download (even the clean kind) or even going to a smaller, untrusted site (say, checking on underground bands or similiar) She does have an 18 year old daughter that had just moved back home and the only reason I even got on that computer that day was because that daughter alerted me to a problem on that system..it was already acting funny before I touched it. One of those scanner spam pop-up's would run when windows would originaly load. She also complained that the computer was processing very slowly compaired to normal.
The "Fake AV" Malware That Was
by tobeach - 9/6/09 11:03 PM In reply to: To further elaborate by auxtekcausing the pop-ups always, once clicked on, downloads a trojan downloader that allows the original malware to download & install as many other programs as it pleases.
Given that the originator gets paid xx$ for each successful download installed & sex sites pay well, I would be surprised if some of those didn't show up along w/ key loggers/screen captures and likely a more evolved rootkit. Yes, they would likely put in links to the sites (probably pay by adding to phone bill if dial-up ISP)).
I disagree with statement that visiting is the ONLY way.
Good Luck!
Thank you so much!
by auxtek - 9/7/09 7:00 AM In reply to: The "Fake AV" Malware That Was by tobeachThat's the answer I was looking for. I would have never touched the computer that morning if I was not alerted to a problem. They are out to make money, it's too bad they have to destroy lives to do it. I think for me it's too late but maybe this might help someone else that has a family that could potentially be destroyed by something like this. I searched and searched the internet, and could not find much on this subject..only cases where the porn site was actually accessed. Thanks again.
Porn Viruses...
by AMcCoy09 - 9/20/09 11:40 AM In reply to: Thank you so much! by auxtekI've found those same icons on my mother's computer.. She's 62 yrs. old and it's HIGHLY UNLIKELY that she'd be looking at porn..lol Her computer is infected with no telling how many Trojans and other problems.. Malwarebytes will usually get rid of most of them, but they still seem to come back sooner or later.. She's on Cable internet, and I'm guessing that it's also why you can leave the computer one minute and it's fine, then turn it back on a little while later and it be full of viruses again.. Been fighting these things for about 3 weeks... Ready to just get out my hammer and see if that'll fix it..!! lol
Just A Recent Post To Show How...
by tobeach - 11/9/09 10:20 PM In reply to: Thank you so much! by auxtekan innocent can be had....Posted S,V,S Form News November 9th/09:
"AP IMPACT:Framed For Child Porn — By PC virus
By JORDAN ROBERTSON
Mon Nov 9, 2009
Of all the sinister things that Internet viruses do, this might be the worst: They can make you an unsuspecting collector of child pornography.
Heinous pictures and videos can be deposited on computers by viruses — the malicious programs better known for swiping your credit card numbers. In this twist, it's your reputation that's stolen.
Pedophiles can exploit virus-infected PCs to remotely store and view their stash without fear they'll get caught. Pranksters or someone trying to frame you can tap viruses to make it appear that you surf illegal Web sites.
Whatever the motivation, you get child porn on your computer — and might not realize it until police knock at your door.
An Associated Press investigation found cases in which innocent people have been branded as pedophiles after their co-workers or loved ones stumbled upon child porn placed on a PC through a virus. It can cost victims hundreds of thousands of dollars to prove their innocence.
Continued here: http://tech.yahoo.com/news/ap/20091109/ap_on_hi_te/us_tec_a_virus_framed_me
(End)".
Plenty Scary as I see it! 
Unlikely? Only in a small world. Never say never
by Darkkewlz - 9/20/09 1:31 AM In reply to: Porn virus help please! by auxtekTrojans Malware. And good-time Charles.
I have this same bug right now.
Trojan, came in on the back of a typping program I downloaded. .
First sign: I heard the clicks of web browser. Internet Explorer. ( a browser I rarely use)
just clicking away. But the browser wasn't open!
My computer be Deviled I say.
Not long after. Porno icons (weblink shortcuts) appeared on my desktop.
Well, looks like my computer is having a really good time without me!
So I figured I should put on some virus protection. Hmm
the Devil in my box didn't agree with that.
To even atempt an online scan, resulted in nothing more than misdirection.
What I've figued out. Is it's using the desktop itself as a browser. You know that active desktop thingy from Microsoft that absolutly NoBody ever uses.
Well time to excersize this here binary Demon.
I took a look at that system configuation panel.
All kinds of single letter startup items are in there. ex: a.exe, b.exe, c.exe.
Well well.
Time to pull out the good book and go into "Safe Mode with Networking"
to be continued
Please Try This...
by Grif Thomas - 9/20/09 11:54 AM
In reply to: Unlikely? Only in a small world. Never say never by Darkkewlz
On a friend or family member's computer, download the Malwarebytes installer and update files from the links below, copy them to a CD or flash drive, then transfer the files to the problem machine and use them. If you can't start the computer into "normal" windows, try installing, updating, and running the scans AFTER the computer is started into Safe Mode.. I use the sites below to download the installer file and the manual updater:
Once downloaded and before transferring them to the problem machine, rename the program installer "mbam-setup.exe" file to something else like "Gogetum.exe", then copy the installer file and the update file to a CD or flash drive.. Transfer the file to the problem machine, then install the "Gogetum.exe" file, then run the update to get the program current.. After that, run a full system scan and delete anything it finds.
Malwarebytes Installer Download Link (Clicking on the links below will immediately start the download dialogue window.)
http://www.besttechie.net/tools/mbam-setup.exe
Malwarebytes Manual Updater link
http://www.malwarebytes.org/mbam/database/mbam-rules.exe
Next, download the SuperAntispyware program and the manual updater from the links below. After running the Malwarebytes tool above, if you still can't download and install it directly from the problem machine, download it on a friend or family member's computer as well. After installing and updating SuperAntispyware, run another full system scan and delete everything it finds as well. As before, you may need to rename the installer file to get the program to install.:
SuperAntispyware
http://www.superantispyware.com/
SuperAntispyware Manual Updater
http://www.superantispyware.com/definitions.html
____________
In a few situations, in order for the program to run, it was also necessary to rename the main "mbam.exe" file also after installing it.. It resides in the C:\Programs Files\Malwarebytes Antimalware folder....
_____________________
Hope this helps.
Grif
tech support
by Slevitt - 9/21/09 2:39 PM In reply to: Porn virus help please! by auxtekThere are a lot of free antivirus products on CNET. Most are mentioned in the responses. If you still have a problem, CyberDefender offers a technical support service which can solve the problem. It costs money because they use real engineers.
| Forum legend: | |
 |
Locked thread |
 |
Moderator |
 |
CNET staff |
 |
Samsung staff |
 |
Norton Authorized Support team |
 |
AVG staff |
 |
Windows Outreach team |
 |
Dell staff |
 |
Intel staff |
