Anyone else pick up MALWARE yesterday?

I picked up 4 malaware programs yesterday while surfing here. I am unsure if they came from DC or from an advertiser or from one of the links some folks include in their messages.

Microsoft Essentials missed them entirely. PC Tools "Threat Fire" detected their unusual behavior and quarantined them, but not until they badly messed up my print spooler and made my printers disappear from the control panel.

On XP Pro. SP 3 I was unable to see my printers or to add them back.

I got messages that the printer was disabled or disconnected, but since the scanner was working that was clearly not the case.

It took quite a bit of digging around before I found the culprit buried in a ~temp file.

Once I deleted all my temp files I had to re-run full disc scans with both anti-virus programs and then
clean the free space of my drive to make sure the files were gone.

My machine seems to be behaving normally since, but I'm still feeling a bit uncomfortable about what happened.

One of the programs was a known piece of known malware, "Privacy.exe," and I'm amazed MS Essentials didn't catch it. Another was named "tools" with a .exe extension, and I don't know what the other stuff was.

I'd not have solved the printer problem except that an error message got sent to MS and their system pointed to the temp file which I removed, and it was the culprit.

Nope.

Sent via Tapatalk...and still using real words.

Nope. Are you sure that they came from www.defensivecarry.com?

I have had an influx of fake 'Linked-in' emails, and UPS notifications (all with nasty attachments & links), but this site appears to be clean.

Good.

I hope no one else got bitten since apparently whatever it was got past MS Essentials. If not for Threat Fire I'd never have known there was a problem other than that my printer was disabled.

There needs to be a special cell next to a serial killer for folks who do these things.

Quote:

---

Originally Posted by WHEC724

Nope. Are you sure that they came from www.defensivecarry.com?

I have had an influx of fake 'Linked-in' emails, and UPS notifications (all with nasty attachments & links), but this site appears to be clean.

---

Yes, I am positive it came while browsing DC, but not necessarily from DC. As I said I had been looking at some advertisers stuff and some links others posted. Also, I don't know how long it may have been floating around "in the box" before Threat Fire noticed the unusual activity. One such was a program copying itself.

No, I haven't, but I'll run some scans to be safe.

I use adblock to get rid of all those incredibly annoying and intrusive advertisements. It's free. Here is a link. It might be one of the best add-ons that I have ever used.

Adblock Plus — for annoyance-free web surfing

+1 On the adblock plus on Firefox. I never even see the ads on any website.

Interesting. I picked up some malware yesterday that took me two hours, Microsoft Essentials, and Malwarebytes Anti-Malware to get cleaned up. Now things are acting up a bit again, and I've not done that much surfing today. My junk yesterday totally shut down my print spooler.

Quote:

---

Originally Posted by Lotus222

I use adblock to get rid of all those incredibly annoying and intrusive advertisements. It's free. Here is a link. It might be one of the best add-ons that I have ever used.

Adblock Plus — for annoyance-free web surfing

---

It wasn't an ad issue. It was malicious software which disabled my print spooler and interfered with the printer control panel.

What is odd is that MS clearly is aware of part of it because they knew the ~temp file I had to remove after everything else failed to get my printers working. And, Privacy.exe is a well known piece of malware, so I was surprised it wasn't caught.

Quote:

---

Originally Posted by Hopyard

Yes, I am positive it came while browsing DC, but not necessarily from DC. As I said I had been looking at some advertisers stuff and some links others posted. Also, I don't know how long it may have been floating around "in the box" before Threat Fire noticed the unusual activity. One such was a program copying itself.

---

You may be on to something. Clicking on any ad could take you anywhere. If their sight is bad or hacked... Well... there you have it.

Quote:

---

Originally Posted by bigmacque

Interesting. I picked up some malware yesterday that took me two hours, Microsoft Essentials, and Malwarebytes Anti-Malware to get cleaned up. Now things are acting up a bit again, and I've not done that much surfing today. My junk yesterday totally shut down my print spooler.

---

Ah, well, welcome to the boat. That's the same malware. That's what got hit on my machine; the print spooler. Maybe other stuff too but that for sure.

I had to manually dig the specific ~temp file out from under a bunch of other folders.

I wish I remembered what all I did, but I don't know. I was frustrated to the point of almost doing a clean install and I didn't really think that deleting that one file would get my printers back up. So I did it, and was very surprised when all was well thereafter.

As I wrote above, having deleted that file I decided to clean my free space-- so it became an all night job although I was able to sleep through it.

Quote:

---

Originally Posted by Hopyard

It wasn't an ad issue. It was malicious software which disabled my print spooler and interfered with the printer control panel.

What is odd is that MS clearly is aware of part of it because they knew the ~temp file I had to remove after everything else failed to get my printers working. And, Privacy.exe is a well known piece of malware, so I was surprised it wasn't caught.

---

Well, believe or not, most drive-by-downloads of malware come from scripts or flash contained in advertising. Since the ads are served up by a server that is not associated with the main website, anything can come from them. The only way to be safe from it on a Windows machine is to disable flash and/or block advertising. There are plenty of add-ons that will do that. You can also block javascript. I also highly recommend going into your adobe reader and disabling java-script because a lot of attacks are carried out by sending your computer an infected PDF file.

Or, I suppose you could get a Mac or Linux machine and that will reduce your chances of infection by 99%.

Quote:

---

Originally Posted by adric22

Well, believe or not, most drive-by-downloads of malware come from scripts or flash contained in advertising. Since the ads are served up by a server that is not associated with the main website, anything can come from them. The only way to be safe from it on a Windows machine is to disable flash and/or block advertising. There are plenty of add-ons that will do that. You can also block javascript. I also highly recommend going into your adobe reader and disabling java-script because a lot of attacks are carried out by sending your computer an infected PDF file.

Or, I suppose you could get a Mac or Linux machine and that will reduce your chances of infection by 99%.

---

Yup....:yup: They still get hit, but not nearly as often...

Quote:

---

Originally Posted by adric22

Well, believe or not, most drive-by-downloads of malware come from scripts or flash contained in advertising. Since the ads are served up by a server that is not associated with the main website, anything can come from them. The only way to be safe from it on a Windows machine is to disable flash and/or block advertising. There are plenty of add-ons that will do that. You can also block javascript. I also highly recommend going into your adobe reader and disabling java-script because a lot of attacks are carried out by sending your computer an infected PDF file.

Or, I suppose you could get a Mac or Linux machine and that will reduce your chances of infection by 99%.

---

Yep, this is what I was implying when I posted the link. Also, Windows7 is a valid option. It has much more security than XP. It would be cheaper than going the Mac route ...but not nearly as cheap as going Linux. :wink: