Privacy Protection

[Malacite]

Okay, I just spent the latter part of last night & all day today trying to deal with this shit, FINALLY got rid of it.

It's a brand new virus (literally like a few days ago) that masks itself as an anti-spyware program, telling you your system is infected. It force-closes any attempts to run any form of internet browsers or spyware removal software.


The only way I found to reliably get rid of this piece of shit was to get Norton Power Eraser. After trying everything else in safemode, NPE did the trick on the 1st shot and best of all, it's a 1-time deal. Norton is infamous for slowing the shit out of your PC, but this program only runs once and then it's gone - it doesn't install.

Be careful though, it does warn you that it uses highly aggressive methods - i.e. you could end up removing things you didn't intend to. Just make sure there's nothing in the "suspicious" heading at the end of the scan.


Just thought I'd pass the message along. I'm not normally for capital punishment, but I really do wish we could just put the people who make these damn virus to death. I fucking hate this crap.

[Nandito]

Re: Privacy Protection

Reason:

[Armando]

Re: Privacy Protection

Even if you don't use Linux, it's a good idea to keep a distro on a live USB for when Windows inevitably fails you.

[Taskmage]

Re: Privacy Protection

What's the name of the virus and its vector, so I can try to avoid becoming infected in the first place?

[Malacite]

Re: Privacy Protection

It's called privacy.exe, and apparently a LOT of people have just been hit by it and are stressing out.

I'm just glad I finally got rid of it on my rig. There's several youtube videos up describing how to deal with it, that's how I found out about NPE.

[Taskmage]

Re: Privacy Protection

Ok. From what I gather this is a pretty straightforward trojan. There's no chance of accidental infection through normal browsing; you have to download and run it manually. Caveat emptor as always. If you're infected, the key to removal seems to be terminating its main process. Once that is done you should be able to clean it up with normal tools. There's a screen of the program attached.

[Raydeus]

Re: Privacy Protection

I'd like to hear how Mal got it installed in his computer in the first place.

[Kailea]

Re: Privacy Protection

as a Dell on site tech I see this WAY to much -.- to the point of pissing me off ;p

and yeah with dealings in the past of similer type viruses, it seems I have good luck with this method

safe mode, kill process if it is running, delete all files associated with the process, then run malewarebytes and reboot

I have run in to versions that even go as far as hiding every file on the C drive, so the person thinks that "all their files are gone" -.-

the worst I have seen as to date, hid all files, removed AVG and malwarebytes, disabled firefox and IE, and keep popping up with its fake readings

or one similar but did not disable Internet access, but instead if you tried to go to any known anti virus site or anti-spyware site, it would redirect you to their site to buy the "software"


They should really find away and prosecute the people that make these fake anti viruses......



many of my customers dont even get this crap from looking at porn, they get it from those stupid "fix it" websites.... like the one I see on TV cleanmypc.com (for the love of god dont click that link) I dont know about now, but a while back I went there with an old test PC I had for shits and giggles, and it auto installed the crap on the PC -.-

[Taskmage]

Re: Privacy Protection

Most of the guides I saw for removing this trojan involved downloading yet another alleged security program for cleaning up trojans, which sounds like a setup to me. I pieced together manual removal instructions that should work.

In XP click Start>Run or in Windows 7 just type the following line into the search bar in the start menu:

taskkill /F /IM privacy.exe

Run regedit. In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run check the value of the PrivacyProtection key. That will have the path to the trojan's files. Follow that path and delete privacy.exe and any temp files, then delete the registry key.

[Armando]

Re: Privacy Protection

Protip: Keep a separate disk partition with all your data so you can easily reinstall Windows in the worst case scenario. Also use the portable version of programs (e.g. Firefox/Chrome, LibreOffice) whenever possible. That's one less thing you have to install and therefore one less thing to reinstall since you can just move it to your data partition. Then make an image of your Windows partition so you can always go back to a working system without having to reinstall from scratch.

I know in this case it's possible to deal with the trojan, but it pays to be prepared.

[Taskmage]

Re: Privacy Protection

I have not (to my knowledge, obviously) been infected with a virus or trojan in ten years. I'm continually floored with the amount of parasites my parents manage to get on their computers while "just using it for email." I literally don't even know how people manage to have so many problems.

[Armando]

Re: Privacy Protection

Probably clicking on ads.

[Malacite]

Re: Privacy Protection

Ok. From what I gather this is a pretty straightforward trojan. There's no chance of accidental infection through normal browsing; you have to download and run it manually.

I never downloaded it. I've got plenty of good software on my rig already tyvm.

Unless it was my RETARD BROTHER when he was on my PC earlier that day...

He's broken every computer we've ever owned. To this date, this is only the 3rd major infection on my PC and every single time I've managed to get rid of them within a day. It's just a real bitch when it does happen.

Last time I believe it was when I tried to get a keygen for something (which in retrospect, serves me right I guess lol)

[Aeni]

Re: Privacy Protection

Probably clicking on ads.

^ This

The ads are designed to snag the casual and uninformed PC users. Especially seniors (scare alert tactics) and little children (cutesy and colorful) and those that don't read carefully (spoof and phishing)

If you're on a Mac OS environment, you probably are used to not having to deal with the consequences of bad browsing habits, and that's doubly dangerous when (and if) you're forced to use a PC and when (and if) Mac OS become targets for these illicit activities.

Where you can also get these malwares and viruses from:

-Video Streams (Codecs - How the most massive botnet scam ever made millions for Estonian hackers)

-Fake Hardware (This can be done, here's a separate article about fake goods - Selling fake Cisco gear lands Kansas man in prison for 27 months)

-Email attachments (most common)

-Executables embedded within pdf, excel, word, etc.

[neighbortaru]

Re: Privacy Protection

Sandboxie - Sandbox software for application isolation and secure Web browsing

never browse without it