Internet Extortion?

I am suddenly getting popups stating my computer is infected and AntiVirus Software will fix it for $49.95. I scan my computer with Spy Bot Search and Destroy but it says I am not infected. What is this:
<TABLE cellSpacing=0 cellPadding=0 width=830 border=0><TBODY><TR><TD width=747>Internet Explorer Warning - visiting this web site may harm your computer!

</TD></TR><TR><TD class=errorCodeAndDivider id=statusCodeAlign align=right> </TD></TR><!-- Error Body --><TR><TD> </TD><TD id=likelyCausesAlign vAlign=top align=left>Most likely causes:

• <LI class=style4 id=causeNotConnected>The website contains exploits that can launch a malicious code on your computer <LI class=style4 id=causeSiteProblem>Suspicious network activity detected
• There might be an active spyware running on your computer

</TD></TR><!-- What you can do --><TR><TD> </TD><TD id=whatToTryAlign vAlign=top align=left>What you can try:

</TD></TR><!-- Check Connection --><TR><TD> </TD><TD id=checkConnectionID vAlign=center align=left><TABLE><TBODY><TR><TD vAlign=top width=30>http://browser-security.microsoft.com/bullet.png</TD><TD vAlign=top>Purchase Spyware Protect 2009 for secure Internet surfing (Recommended). </TD></TR></TBODY></TABLE>
</TD></TR><!-- retype address --><TR><TD> </TD><TD id=retypeAddressAlign vAlign=center align=left><TABLE><TBODY><TR><TD vAlign=top width=30>http://browser-security.microsoft.com/bullet.png</TD><TD vAlign=top>Check your computer for viruses and malware.</TD></TR></TBODY></TABLE>
</TD></TR><!-- back to previous page --><!-- InfoBlock --><TR><TD id=infoBlockAlign vAlign=top align=right> </TD><TD id=moreInfoAlign vAlign=center align=left><TABLE><TBODY><TR><TD vAlign=top width=30>http://browser-security.microsoft.com/down.png</TD><TD vAlign=top>More information </TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE>
How do I make it go away?
Thanks,
Brad

I use Anti-Vir and Adaware, and I don't have any problems with popups. Both programs are free.

There are several solutions to this, and I'll list them in no particular order.

1. Find somebody who has dealt with the exact same bug, and follow their solution.

2. Keep throwing various anti-spyware and anti-adware applications at it until one of them get's it.

3. Switch from IE to Firefox and hope that it's IE specific.

4. Carefully comb through running processes and see if you can figure out which one is responsible, then spend countless hours filtering through the windows registry and your hard drive to get rid of it manually with a HIGH risk of bricking your desktop.

5. Format your hard drive and reinstall everything from scratch. This is equivalent to fixing a car that burns oil by having it torn down to the floor pan and rebuilt. A total over-kill waste of time, but 99.999% effected

Any of those options will 'eventually' solve the current problem, but only until you get another virus/worm/spyware/malware. There's only one permanent fix, which is.......

6. Install linux. Yeah, it can be a pain to learn, and you'll have to find different programs to do the same stuff, and only 70% of new video games will run, but you'll never have these problems again.

sounds like malware, getting more common unfortunately, and incredibly frustrating. sometimes easy to get off, sometimes now. I recommend installing malwarebytes. google it, installs and goes after malware.

Red

I had this fairly recently and it was a malicious virus or some such called a rootkit.None of my freeware spyware and virus scanners could find it.My brother-in-law is my computer guy and he used malwarebytes to tell what it was but it wouldn't remove it.He planned to format my hard drive and when he tried to save some of my files on a thumb drive,it infected that too.He finally wiped the hard drive clean,and that got rid of it,but I lost a lot of good stuff.

Now I use a virus/spyware software called Vipre.Had to pay $50 for a year,but you get a home license which allows you to use it on all computers in your home(or relatives?).

Edit: I was using IE at the time----Now I use firefox.

Quote:

---

Originally Posted by Big Red

sounds like malware, getting more common unfortunately, and incredibly frustrating. sometimes easy to get off, sometimes now. I recommend installing malwarebytes. google it, installs and goes after malware.

Red

---

+1. malwarebytes is one of the best malware-busters out there.

Bart.

I had something like that happen when I ran some free spyware removal tool on a client's computer. The spyware removal tool was actually spyware. I used a bunch of utilities to remove the program. I found the install files for the program and deleted them manually. I then used a registry cleaner to remove whatever remnants were left. Sometimes you can restore to a previous restore point. That will remove all programs that were installed after the restore point.

Damn! I had that exact thing pop up last week. After I figured out that it was seemingly a Java Applet and I ran McAfee (and it found nothing!) I just let it sit and waited to see what it might do. Ultimately, left on it's own it popped up 4 windows (touting that sale) and sat there. At one point I restarted it and kept it disconnected from the internet and the web page still appeared! That was the key that it was a Java thing. Since this was a work laptop that has heavy encryption, and - I'd recently had a HD crash so everything was newly installed anyway there was no damage it could do really - but I'm not sure I'd let it sit like that without first running a virus detection program.

Long story short, McAfee found nothing, I ultimately shut it down and used another computer until I could get back into town, and 3 days later when the tech guys came to see it, it was all gone! No sign of it since. No clue really as to what is was, but the consensus is that that company popped the Applet on it, programmed it to annoy the user for a day or two, and goes away naturally after a day or two.

The key for me would be to immediately run a virus detection program in case it's something more destructive and just a temporary annoyance.

I'm not sure if this is the same thing I've seen, but it might be basically popup ads which hijack your browser. The ones I've seen are annoying for sure. The pop ups would tell me my Windows system has x number of viruses detected (I use a Mac) and when I'd try to hit cancel it would send me to a page where I could buy 'anti-virus' software. The website wouldn't have any legitimate contact information - just a link for buying their software. Usually I could just close the page and resume my browsing.

I ended up installing anti-ad software, deleting all of my cookies and being more mindful of the sites I browse and I haven't seen one of these popups for quite sometime.

This sounds like the Conficker worm to me. Here is a link to Wikipedia about it. There is also a paragraph about how to remove it. Hope this helps.

It really is extortion. The bug gets into your computer and tells you it can go away for $49.95! As it turns out Scarlett bought a laptop a few months ago and had the disc for Webroot Spy Sweeper. I loaded it and the problem is solved.

I don't understand how the people who do this aren't in jail.

I paid a one time fee to be free of this type of stuff for the rest of my computer's life. It's called the Apple tax. :D

-Rob

Quote:

---

Originally Posted by icedog

I don't understand how the people who do this aren't in jail.

---

Mostly it's because law enforcement can't get at them. For example, the code of the Conficker worm has been analyzed and the first thing it does is check to see if the computer is using a Ukrainian keyboard. If it is, the worm shuts itself off. What does that tell you?

Quote:

---

Originally Posted by sicboater

I paid a one time fee to be free of this type of stuff for the rest of my computer's life. It's called the Apple tax. :D

-Rob

---

One Time Fee?

LOL he's on a Mac.
They hardly get affected by any of that stuff.

All of my computers are behind my wireless cable router.
Cable routers are also NAS boxes, and by default they block all incoming traffic. This means that if your box is behind one of those, you really shouldn't be affected by anything unless you launch something yourself.

Putting a computer directly on the internet without something in between is NOT a good idea. EVER. No matter what OS.

But indeed, if you install XP with an active internet connection, then your box will be infected before automatic updates has installed SP2 or 3.

Even if you don't use wireless and have only 1 computer: buy a cheap cable router and use that for connecting to the internet. That will save you worlds of grief.
As soon as I needs to install a computer for my kids, for school, I will buy a low end juniper firewall for a couple hundred of euros, and shove that directly behind my cable modem. That way I can prevent a lot of problems.

I would do the following:

Contact the company who's product is being advertised (Spyware Protect 2009 - Powerfull PC Protection !). After a quick glance, the only contact info I see (besides an order form) is the "support" option on the above page.

Ask them how to remove the code that pops up that message.

If you don't get a satisfying answer, report this to your state's Attorney General.

are you using windows?
are you using internet explorer?
are you behind a firewall?
do you have an integrated AV solution that works with your browser?

any of those things could be the problem. windows is way more vulnerable than most OS offerings, and internet explorer is a comedy of errors on it's own. you should NEVER connect to the internet without a firewall, and if you have windows, you should never connect it to the internet without "medicine".

on the occasions when i have to use windows and internet explorer (for example, here at work) i make sure i'm behind at least one firewall (in this case, 3, in layers) and i have strong medicine installed and constantly running. if you must use windows, use a browser like srware Iron.

as to why the people that write this stuff aren't in jail, the answer is: writing virii isn't illegal in all countries. if you release the virus into the wild from a 3rd world country that doesn't have a lot of computer laws, it can be perfectly legal.

hell, sony did it to everyone that bought a cd from sonyBMG a few years back and i'm pretty sure they didn't see jailtime.

Quote:

---

Originally Posted by Bruno

All of my computers are behind my wireless cable router.
Cable routers are also NAS boxes, and by default they block all incoming traffic. This means that if your box is behind one of those, you really shouldn't be affected by anything unless you launch something yourself.

Putting a computer directly on the internet without something in between is NOT a good idea. EVER. No matter what OS.

But indeed, if you install XP with an active internet connection, then your box will be infected before automatic updates has installed SP2 or 3.

Even if you don't use wireless and have only 1 computer: buy a cheap cable router and use that for connecting to the internet. That will save you worlds of grief.
As soon as I needs to install a computer for my kids, for school, I will buy a low end juniper firewall for a couple hundred of euros, and shove that directly behind my cable modem. That way I can prevent a lot of problems.

---

Definitely. It's amazing how quickly one can get viruses on the internet. My favorite way to circumvent this is to have an image of the system with AV and firewall already installed. Gets rid of a lot of headaches!

Brad, I've always had great success with AVG Anti-Virus (AVG Free - Download Free Antivirus and Antispyware for Windows XP and Vista) and ZoneAlarm Firewall (ZoneAlarm by Check Point - Award winning PC Protection, Antivirus, Firewall, Anti-Spyware, Identity Protection, and much more.). Everyone I suggest it to that used to have virus issues haven't had any issues since installing both of those (and these are the least internet savvy people around). It's all free and works quite well.

When I say firewall, I mean a physically separate box.
Broad band routers are not firewalls, but they refuse incoming connections by default, so they are already a very good protection measure.

The windows software firewall is better than nothing, but not that great either. For that matter, any software based firewall is inherently susceptible to attack.

Physical firewall boxes are much better, because they allow you restrict traffic fairly easy, based on direction (in / out) IP addresses, port numbers and protocol. Once that is done, nothing on your computer can change it. And these things are hardened against attack so much that they are inpenetrable for all intents and purposes.

The disadvantage is that they cost a couple of bucks (low end juniper is a couple of 100) and you have to understand TCP/IP pretty well in order to configure them correctly. But they are infinitely more secure than anything software based.

Just in case anybody ever finds it useful:

If you suspect (or know) that you've got some malware on your machine, and especially if your various programs don't seem able to solve the problem, you should try running your sweeps and scans in Window's "Safe Mode". It keeps the malware from hiding itself on startup and/or disabling your security software.

In XP, for example, you access the Safe Mode by pressing F8 as Windows loads. Instructions for other Windows OSs can be seen here.

Quote:

---

Originally Posted by Bruno

Broad band routers are not firewalls, but they refuse incoming connections by default, so they are already a very good protection measure.

---

Some also keep a log of attempted incoming connections that weren't initiated from your end. Once you've seen just how many of these random probes are happening constantly, you never underestimate the problem again.

It doesn't help that Windows itself sends out probing network requests. If you and your neighbour use the same ISP and connect without NAT routers etc., your machines could be chattering away to each other - along with all the other customers connected to the same part of the ISP's subnet.

If you assumed your ISP filters all that stuff, you might get a rude awakening.

I use ccleaner to keep my computer running pretty well. I have used it for a while now and have not had any problems with it. It's freeware, too. I've learned what is and isn't supposed to be in my startup and registry and it has several features that allow you to control what is in both of those. It also cleans out your cookies for you. It also has a more detailed list of what is on your add or remove programs list. I run it everyday to delete my cookies. You should also keep in mind that things can hide in the recovery files that windows makes in case you have to revert back to an old file. I would suggest deleting those every once in a while. I leave mine off for that very reason. Also, delete any old versions of programs that you never use, like java or netframe. You can install newer versions and still keep the old ones, which are more likely to have viruses written for them as they have been around longer. And watch which websites you surf. You should be able to tell which ones are giving you all the problems.

As mentioned before, different anti virus programs have different definitions of viruses. Norton seems to be the big dog as far as viruses are concerned. There are free ones you can use online, too. I've used ewido antispyware and bitdefender antivirus online before. Ewido is pretty good, bitdefender could be better. They both make you download definitions, though, so use at your own risk.