Stupid Virus Scan Internet pop up

[Slaydon]

Hi, i just got the thing my title said, i know its Virus since my buddy has it, now, i got into it, it closed a tab, and some Real popups got up, so i pressed ok on those, and then the next one said starting virus scan, and that was not fake aswell, now that i pressed that i quickly pressed ALT_F4 and i got out, turned the laptop off in a hurry, now, do i have the Virus? someone knows? Will it return often?

 

[TheDivineBoss]

I know what you've seen but I have no clue what type of virus it is. It claims to be a virus scanner web page that 'scans your computer for viruses, not. It's easy to see through the scheme when you have a D, E, I and A drives too. Just don't click on it and/or kill your browser with Task Manager.

Something is telling me that you have been browsing Google for naughty sites.

 

[Slaydon]

I was just on facebook. And i know it transfer Viruses

 

[TheDivineBoss]

I was just on facebook. And i know it transfer Viruses

Report the user which linked you the pornsites.

 

[Slaydon]

What? i dont know anything about that, maybe it was my buddy that was here and lent the internet? the question is, will i get it up alot?

 

[TheDivineBoss]

Well, these "LET'S SCAN YOUR COMPUTER KK?" popups/pages come rarely. And if you come across one, just close the browser, kill the browser via Task Managar or return to the last page (note: manually press two pages back because sometimes the backspace button wont do).

 

[Slaydon]

is there a way to block them? or virus scan the site before you enter?

 

[WILL THE ALMIGHTY]

Download avast and try using it to fix whatever horrible mess you've just created. Or Adblock Plus.

 

[Oziris]

I have a plugin for google that doesn't load any animations, sponsors or pop ups until you tell him to

 

[Slaydon]

well, ill try, i dont got AntiVirus installed yet, i will soon. so im just scared =/

 

[TheDivineBoss]

I don't know what you did, but this 'webpage' appeared when I clicked on a Hive thread.

 

[Slaydon]

thats what i mean, it gets out of nothing =/ we need to find out how it gets triggered

 

[TheDivineBoss]

There IS a possiblity the site has a virus or two.


If anyone else finds this 'popup', please respond to this thread.

 

[Slaydon]

well, ive fully scanned my PC, free of viruses, ive havent got it any more, how about you :/, this is a really bad virus..

 

[TheDivineBoss]

well, ive fully scanned my PC, free of viruses, ive havent got it any more, how about you :/, this is a really bad virus..

It's a popup that leads to a virus, the popup itself is harmless, until you click on it.

 

[naitsirk]

i've had this Pop Up... i've had it commed up like 2-4 times but That have stopped happening for a while now But every time it came up i Just closed it... and When i checked my CPU i found no Viruses

 

[Slaydon]

okay, i got how it works now, it gets activated when you enter web pages, all randomly, like homepages (google) now, there is a chance to stop it, but i dont know if it works, it will ONLY open in Internet Explorer, so is it a way to block Internet Explorer from being used, and be able to turn it on whenever you like?

 

[naitsirk]

i uses Mozilla Firefox...

 

[Slaydon]

but my friend also uses Mozilla, but it opens in IE

 

[naitsirk]

mine dosent

 

[The Reborn Devil]

I got that Virus Scan thing while viewing a thread here on the hive... It opened another window and said something about virus scanning. I didn't click it though, I just killed Firefox with task manager.

 

[Deleted member 157129]

I've got it a few times. Only on the HIVE though, so it's definitely something about this place. A user or something that has an attachment perhaps?

 

[Slaydon]

or maybe its vBulletin

 

[Deleted member 157129]

Meh, I got it again just now when I entered Off-Topic section.

 

[HINDYhat]

Never got it once. ABP kkthx?

 

[PurplePoot]

Never got it in 3 years of using THW. Then again, I tend to use browsers with decent popup blockers.

 

[The Reborn Devil]

I think I got the popup while viewing the thread "Mind F*ck Test:: 10 Levels" Link

Don't know which page it was.

 

[Deleted member 157129]

Never got it in 3 years of using THW. Then again, I tend to use browsers with decent popup blockers.

It's not a pop-up. It redirects the page you are viewing. I use Firefox, with additional AVG secure browsing.

 

[Slaydon]

i just got its site name, its 6walm... dont want to say it anymore, you can check it in your log

 

[The_wand_mirror]

i can fix this, read this.

Open IE, all on the right you have ''Extra'' click on that and a menu opens and somewhere 3 buttons down it says ''Add-ons'' click on that and find an add-on named ''IE Help'' and switch it off.

Now go to C: > WINDOWS > System32 and find a file called iehelpmod.dll simply rename this whole file to something like ''stupidvirus'' or something. restart your pc.

Now return to the System32 map and find the stupidvirus file and delete it. Done.

Then you can check if the add-on is still switched on in IE just to make sure it won't come back or anything but it should be fixed now.

 

[Deleted member 157129]

.. and that relates in what way to a redirection in Firefox? Does IE Help redirect you to virus sites at random?

 

[Slaydon]

im not sure, but is there a possibility to block the site, 6malwa.... ? maybe send a mail?

 

[Kercyn]

You can always use No-Script...

 

[Dr Super Good]

By default, internet browsers can not axcess everything on your PC.

It makes no sense for a browser to ever need to read that random text file on your desktop or that picture in your documents, thus they should not be able to and probably are not.

The whole thing about viruses is they need to trick you into giving you permission to get into your PC or to use something which has permission to get into your PC. Example, installing an active script gives just that permission or using bugs in an already installed script will as well.

Popups are generally harmless as long as you do not click stuff on them or allow them to do stuff.

 

[Deleted member 177737]

Just download AVG free. I had the same virus before, it always poped up saying starting virus scan and I always closed it instantly. Now I don't since I installed it xP.
(It beats a lot of other virus scanners)

 

[Avex]

The popup usually is called the Anti-Virus doctor, it'll say it'll scan your PC for threats/alerts.

Usually it automatically says alert.

The funny thing is that it actually DOES scan your computer like any other would, but it gives you a virus afterwords to trick you.

How do I know? It gave me the same results Norton did except the site didnt show the virus it gave, Norton did.

Norton CAN be useful =D.

But yes this does come rarely, just Alt+f4 out of it before it does or if you're a fast clicker, press OK then hit the red X as fast as you can.

 

[The Reborn Devil]

I got it again now, while viewing the spells section. The address is "6cleanspyware.com".
I got suddenly redirected to that site.

Edit: I got AVG as well and it reacted to that site.

 

[Reaper2008]

Just download AVG free. I had the same virus before, it always poped up saying starting virus scan and I always closed it instantly. Now I don't since I installed it xP.
(It beats a lot of other virus scanners)

AVG? It's not good for people like me though, it flags half the QtEditor & MASM32 as viruses, plus it has no firewall. Best combo is (for free) Avast! & Online Armor, plus 2 antispywares (they aren't like av's, so they won't destroy one another).

PS: Doesn't AVG flag NewGen as a virus too?

PS2: For popups, don't rely on AV's, you need antispyware and a decent browser (anything except IE ). If you really need an ActiveX browser, use Avant. Else use Opera or Firefox. Chrome is kinda good too, but it's stable in name only.

 

[Slaydon]

maybe they got alot of those site, mines 6malwarescan

 

[The Reborn Devil]

Hmm.
It might be one of the ads.

In the spells section there are 3 ads with images that can be the source.

 

[Deleted member 177737]

AVG? It's not good for people like me though, it flags half the QtEditor & MASM32 as viruses, plus it has no firewall. Best combo is (for free) Avast! & Online Armor, plus 2 antispywares (they aren't like av's, so they won't destroy one another).

PS: Doesn't AVG flag NewGen as a virus too?

PS2: For popups, don't rely on AV's, you need antispyware and a decent browser (anything except IE ). If you really need an ActiveX browser, use Avant. Else use Opera or Firefox. Chrome is kinda good too, but it's stable in name only.

Never heard of QtEditor o MASM32.
Don't use NewGen ether so dunno lol...
Firefox get's rid of my popup's AVG check's all the websites to see if their safe to go to or not.

 

[supertoinkz]

i had eset and i use chrome. i never encounter diz probs.

 

[Yixx]

2 threads with the same problem. I also got the pop-up twice lately. And both were in 2 days or such, i guess it is a problem that has occured lately, but never before. Next time i get it, i will screen it.

 

[Deleted member 157129]

Meh, I still have not got it as a pop-up, but that's probably because I use Firefox.
AVG flags a lot as trojans, aye, but it's easily ignored. I prefer an AV that reacts too often than too rarely.

 

[Deleted member 177737]

^--------I second that

 

[Deleted member 157129]

Okay I caught the virus in action (it eventually prompts you to download a file), here's a nifty screenshot, for what it's worth.
Notice how there's actually a typo in the 'Favourite Links' list .. Seraches.

 

[Avex]

Yup, thats it.

 

[BlargHonk]

Oooo, what if you've got FF3.5?

Does it react to different browsers, or does it say FF3 all the time?


Another way to tell: Lists OS on the D: Drive, most people have OS on the C:, unless it's reacting to your OS once again.

Also I can't tell if your running Vista or not, so if your running 7 then you can tell by that too, under the FF part


And then there is also the error of "Erase all infected and suspicious files and make your system protected" Technically you wouldn't be protecting the system, just curing or removing a virus, protection is a Firewall or active search

And also the fact Trojan's are not classified as viruses by most.

 

[Slaydon]

nah, they can never trick you like they did in the old days

 

[Aesthetics]

Okay I caught the virus in action (it eventually prompts you to download a file), here's a nifty screenshot, for what it's worth.
Notice how there's actually a typo in the 'Favourite Links' list .. Seraches.

LOL. Obvious fraud?

- 100% secure site (yeah, sure it is!)
- Mouse over, if your cursor changes into that cursor where you're clicking a link, the rest is pretty obvious
- Your local disk is empty? (or are you just censoring that)
- You don't even use that windows color
- Browser and OS, there is no space after the : (Windows uses perfect formatting and stuff)