computer virus..OR???

[whipperwilly]

New virus or whatever just hit my computer....buts its DIFFERENT !

My anti-virus and anti-spyware/malware were NOT able to find it or detect it.....

It TARGETED my Microsoft WORD program.....I guess it created a text file then linked it to repeat a message on the screen every minute or two.....IE:  Your computer is infected.....bla..bla....use our antivirus 2009 program....bla..bla..bla

Basically they infect your system then try to sell you their software to remove virus.....(personally, I like to remove them )

CURIOUS THING:   My microsoft word was CHANGED.....I had a screen that showed your document on the left side with a column on the right side that listed my documents I had created, from which I could choose.......NOW I have a FULL screen, no column on the right side at all, to see my documents I have to use the tool bar at top of screen.....Its as if someone just UPGRADED my word program from 2006 version to 2009 version.....Now I' too scared to use it...virus in hiding waiting to pounce

I was NOT able to get rid of this constant message on the screen by using my anti-virus or anti-spyware/malware programs, I HAD TO
RESTORE to a previous date.....seemed to work.

I was looking at websites on metal lathes and airgun related items.....found some nice sites, but didn't count on this beast !!

[Nexweb]

What antivirus and antispyware programs are you running? Whatever the case I would do a scan with Malwarebytes.

[Bentong]

You have acquired an ADWARE from where you were WEB surfing. Mostly, A/V's can't delete this. I have a buddy that has "Antivirus 2009" crap that even hijacked his browser and just loops over and over to telling him to get the antivirus 2009. I was able to clean his PC by going on safe mode and run MALWAREBYTEs from there > http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?cdlPid=10997763 and followed it up with > http://www.superantispyware.com/ . This are free. After downloading both, you only need to run one..do malwarebytes first (need to disable your A/V because it will be slow and they will try to cancel it's other) follow the prompt then uninstall malwarebytes and install and run superantispyware. After clean up uninstall it also then activate your A/V. Most advware are trojans that will linger in your computer then bammmm it'll hit you again. Hope this helps you. BTW, what is your Anti-virus sofware?

[nmmike]

Check out my post in this forum "Internet explorer & Crosman forum". I have Norton & if this is a problem Nortons not finding it.
Mike

[moon]

I've been able to delete these things if I spent enough time.  The last time I had one, I think I went through 5 programs trying to detect the thing.  Sometimes you can nuke them manually.  Sometimes they are spread all over.  Disable messenger service and it will stop some.  Usually you can google your symptoms and find out the name of the thing and go from there.

[bearded_spock]

A colleague here at work made the mistake of installing the trial of "Antivirus 2009" on her computer.  It hijacked her web browser in a similar fashion and would only let her go to their site.  I did some research and found out it was a trojan built into a rootkit - a very nasty little self-cloaking thing that hides itself within the system and intercepts system calls so nothing can see it.  It also blocked the execution of at least two of my go-to cleaner programs, it just wouldn't let them run!  I ended up using 2 different programs to get rid of it - one that recognized its signature somehow and disabled it and then another to clean it off.  I can't remember exactly what they were but I googled "Antivirus 2009" and found a forum that described how to do it.

[Bentong]

Using Mozilla Firefox is much safer to use than Internet Explorer. A lot of hacks are geared towards IE because it has a lot of backdoor. If you use firefox I find this usefull as well ADDS on > adblock plus - to block out ads which most time is clicked because of its enticing flavor, finjan - checks links & websites before you access it and safe for browsing, tweak network setting - speed up loading and browsing & Flashblock - this enable or disable flash media to load or manually load when a screen is loaded on the screen, this is when you are browsing a page, various flash advertising just pop playing videos/animation selling you stuff. with flashblock it will only show a button and if you know what it is you want to do with it...you push the button to play it > with this feature it speeds up loading a page without waiting for all that stuff to load up. Enjoy

[TexasShooter72]

I'd seen an update a few weeks on the very virus/malware problem you're having.  I will indeed change a few things up on Word, will display a continuous message that you've been infected and will display to link to purchase "their" virus and malware software...  which if downloaded IS where the real virus lives.  Restoring to  another date will indeed help but be ready for the same thing to come up again.  I would suggest saving your documents and other files to disk, format your computer, re-load everything that you've saved and THAT will get rid of it.  

BUT...  what you're going to want to do is download a Belarc Advisor.  The Belarc is best used right after a format or when purchasing a new computer.  It will scan and display a page that lists every bit of software your computer had when it was fresh.  PRINT that page!  because when something like you've had comes up you can run the Belarc again and print that page, compare the two from the original print-out and you will be able to see what software was downloaded without your knowing or consent!

It's painstaking, I know but will save your hiney as well as your computer!

[whipperwilly]

Thanks for all the insight and advice.....much appreciated!

I have AVG anti-virus, and Spy-Bot, and have a firewall.
It happened when I got RE-DIRECTED to either a Yahooo or Google page.....I hate those pages, they list other sites but you never get them....just another list of sites..goes on and on like that.....so when I see that first page I get out fast. I hate yahoo and google because they use tracking cookies and other malware themselves for their Marketing Stragedy business....selling info to other businesses.
Yahoo has one of the largest such marketing firms in the world.

I did not allow this adware to download by clicking on their button....I just kept it contained by clicking the big red 'X' while I ran AVG then Spybot then when they didn't work restored to a date a week earlier....reason was that if you do anything else including shutting down then that is when the computer writes to registries....then you can't get some of these things out.

So far....it hasn't re-appeared....after some 60-70 hours of use. As for the WORD program....I have not been able to get my old screen layout back....(probably my fault since I'm not a heavy word user - NO expert)

Most of what I have on my computer, I can re-load. I usually don't keep my wanted info on the computer, so if its wiped its no big deal.
I have had virus before...but never one that targeted any specific program....just found that to be weird.

Again.....Thanks for all the help....I'll keep an eye on this...if it comes back, you will hear it here first.

[whipperwilly]

Thanks for all the insight and advice.....much appreciated!

I have AVG anti-virus, and Spy-Bot, and have a firewall.
It happened when I got RE-DIRECTED to either a Yahooo or Google page.....I hate those pages, they list other sites but you never get them....just another list of sites..goes on and on like that.....so when I see that first page I get out fast. I hate yahoo and google because they use tracking cookies and other malware themselves for their Marketing Stragedy business....selling info to other businesses.
Yahoo has one of the largest such marketing firms in the world.

I did not allow this adware to download by clicking on their button....I just kept it contained by clicking the big red 'X' while I ran AVG then Spybot then when they didn't work restored to a date a week earlier....reason was that if you do anything else including shutting down then that is when the computer writes to registries....then you can't get some of these things out.

So far....it hasn't re-appeared....after some 60-70 hours of use. As for the WORD program....I have not been able to get my old screen layout back....(probably my fault since I'm not a heavy word user - NO expert)

Most of what I have on my computer, I can re-load. I usually don't keep my wanted info on the computer, so if its wiped its no big deal.
I have had virus before...but never one that targeted any specific program....just found that to be weird.

Again.....Thanks for all the help....I'll keep an eye on this...if it comes back, you will hear it here first.

[Bentong]

When you get redirected like that and a pop-up screen saying your infected don't click on the X button..hackers/writers are smart to include exit and cancel button to let them in, what I do is press CTRL-ALT-DELETE button at the same time to bring up TASK MANAGER then under application press END TASK to the application you want to terminate. CCLEANER (google it for the site--it's free) is an excellent program you can use to clean out your browsing cookies, traces and events and you can even choose to have a permanent deletion using the following standards, DOD (3x), NSA(7x) and Gutmann(35x) the more secure you choose the longer it will process it for deletion like the Gutmann will delete it 37 times and only problem you cannot recover it like just pressing delete you can recover that.

[whipperwilly]

Bentong:
                Thanks for the technical advice......I do appreciate it.

                I was just a little surprised by this virus, its the first one that ever attacked by a different route......a specific program like Word.

                I have taken some precautions, all my serious programs are on a dual xeon computer that only gets access to the internet if I REALLY...REALLY have to register or update a piece of software....otherwise it NEVER sees the internet. I have this second el-cheapo HP computer that I use on the internet...like now....that way if the worst does come, I'm only out a couple of hundred and not thousands.

                I don't use Word that much....just there if I really need to use it.....so it was odd that it was attacked.

                I think that whatever you use.....someone somewhere is trying to find a way past it....like my ol-pappy used to say....."you can't stop someone from breaking into your home.....if they are determined enough...they will find a way, its just how much in damages are you willing to pay for out of your pocket ?"  Guess it applies to everything...cars, home, computers..(?).

[whipperwilly]

In case anyone is wondering, I have NOT had any re-occurance or any other abnormal activity to this date - February 9th/2009 - as a result of this virus...hope it stays that way.