Nasty 'System Tool' virus from ebay link

[crugbun]

Was drifting through ebay looking for cars on a sunday afternoon (along with a few other PH members no doubt) pressed on a 'motors' link on the home page and some trojan/virus thing took over the machine.

Claims to be a security software and offers to install for a fee... not particularly sly, but I'm sure many are taken in and pay up. If you do pay nothing changes.

I followed a thread on a really helpful site www.removevirus.org and finally got rid of it. Not easy as it freezes all your task manager and anti virus stuff.

In the process of subsequently updating the anti virus software, I was on the laptop also on ebay and did it again - so definately linked to ebay by some clever eastern european chap.

(anyone else had this)

Beware.

Edited by crugbun on Sunday 27th February 18:37

[B Huey]

I got the same bug earlier, thanks for the info.

[YoungOne]

I got this today aswell, looking at car jacks on ebay I think. Just did a reformat I wanted to do anyway to get rid of it.
The software said it was windows live security or something like that.

[HellDiver]

Can't say I noticed. Then again, MacOS doesn't really do virii.

[edo]

HellDiver said:

Can't say I noticed. Then again, MacOS doesn't really do virii.

Enjoy it whilst it lasts!

[AndyLB]

HellDiver said:

Can't say I noticed. Then again, MacOS doesn't really do virii.

Ah the great Mac security myth raises its head again...

[Autogasm]

I just recently downloaded the Google Chrome browser which is brilliant and much faster than internt explorer BTW, and this has been warning that 'something isn't right' whilst I was in E-bay motors today. I ignored it assuming it was google chrome that was the problem!!

My advise to everyone is to download google chrome as I have avoided this bug all day!

[YoungOne]

Ha I wouldn't be too sure you're clean, I was using google chrome when i got it.
And for the record Windows security essentials did bugger all aswell

[m8rky]

Was on ebay earlier and the screen went bright red and said windows internet explorer has detected a security threat and then shut down the web page.Looks there is something dodgy going on.

[HellDiver]

AndyLB said:

Ah the great Mac security myth raises its head again...

Yeah, it's such a huge myth.

[twazzock]

Happened to two people I know in the last two days, and they aren't the types to be on eBay motors (my muvva was one of them)!

[jr123]

just got a malware warning of a link to autotrader from here, luckily chrome warned me and i was off. looks like everything is fked

[edo]

HellDiver said:

Yeah, it's such a huge myth.

http://www.applebh.com/2010/10/27/new-trojan-apple/

And why do Apple recommend Sophos then?

http://www.apple.com/downloads/macosx/networking_s...

Dont get me wrong, there are way less viruses directed to Apple OS, but it's a very arrogant assumption that they are immune, and more are being directed towards them.

[h4muf]

m8rky said:

Was on ebay earlier and the screen went bright red and said windows internet explorer has detected a security threat and then shut down the web page.Looks there is something dodgy going on.

Me too.

[didelydoo]

I also go this from ebay today. How come normally trustable sites are getting bad links?

[anonymous-user]

there is some dicussion about this on the ebay powerseller board today

AVG is flagging ebay as a rogue site and a number of sellers have had problems similar to the one described here

[Adam_W]

I had an AVG popup when browsing blocking some exploit.. had about 8 different sites open so no idea where it was from.. until now.

[Jon177]

I got this today too after browsing cars on ebay. I use a pice of sowtware called Acronis true image that i keep a bootable cd with the software and a clean image on external HD for these instances. I highly recommend others do the same.

[Compo_Simmonite]

Me too. I was looking for SDS drill adapters so not just motoring section.
I use, and can recommend, http://malwarebytes.org/

Paul H

[Some Gump]

It got me, too, whilst searching for Caterham parts. Used system restore to get rid of it.