SRL Archive - News and General

So far today we have seen two trusted members post infected .exe files on these forums. We are unsure as to whether they were hacked, or did it on their own free will. There is a possibility that there will be more .exe files posted today, portrayed as useful programs. No matter who posts them, do NOT download them. Even if a virus scan is given, I wouldn't recommend it.

For those who have downloaded one of the two already posted, here is what I tried, and what worked for me:

• System Restore to the closest time before you download it.
• Open up Task Manager.
• Unfortunately I can't remember the process name, so you'll have to look for any unusual processes in the process list. If you are unsure, Google the process name.
• Once you've found it, right click, and End Process.
• Delete the .exe.
• Run a virus scan immediately.

Damn :( Hopefully they get the IP's and see if they did get hacked

What .exe's?

Don't run an operating system which can run such .exe files, ideally. :P

Thanks for the notice.

1 - http://villavu.com/forum/showthread.php?t=59560
2 - http://villavu.com/forum/showthread.php?t=59559

From: Nava2
What .exe's?

The only one I saw was a thread by SandStorm and FT-Fakawi scanned it and found a virus. They claimed to be VB scripts for SCAR/Simba.
That's pretty much… as much as I know on this subject :D

IIRC I saw another one a bit recently too somewhere (but I forget), it was some guy named BlueSomething (maybe Blueworld? I forget). Maybe an admin can check into that IP as well? I think Yohojo closed it and found a virus.

From: cstrike
The only one I saw was a thread by SandStorm and FT-Fakawi scanned it and found a virus. They claimed to be VB scripts for SCAR/Simba.
That's pretty much… as much as I know on this subject :D

IIRC I saw another one a bit recently too somewhere (but I forget), it was some guy named BlueSomething (maybe Blueworld? I forget). Maybe an admin can check into that IP as well? I think Yohojo closed it and found a virus.

the person who posted the scan results were me

the results also show the files which were running that shouldnt have been

~shut

EDIT: look for NVDISP.EXE, SANDSTORM RS BOTTER.EXE or SCAR UPDATER.EXE

that scar updater was clean, made a virus scan with my kaspersky PURE, also a web scan which uses 43 anti viruses to scan.

www.sandboxie.com

From: Tickyy
that scar updater was clean, made a virus scan with my kaspersky PURE, also a web scan which uses 43 anti viruses to scan.

it wasnt clean

~shut

From: Tickyy
that scar updater was clean, made a virus scan with my kaspersky PURE, also a web scan which uses 43 anti viruses to scan.

lol, time to format/system restore and change passes?

From: Tickyy
that scar updater was clean, made a virus scan with my kaspersky PURE, also a web scan which uses 43 anti viruses to scan.

Follow the steps in my first post ASAP.

For god sakes don't system restores like rich says, restoring does not delete any files, it rather buries and hides the viruses which may still be active, just 10x harder to find.

While using a sandbox program is generally a good idea, most "Advanced" malware can detect it and bypass it completely. It's the same with VMs in that regard.

From: Markus
www.sandboxie.com

I suggest using Malwarebytes' Anti-Malware for scanning your computer. The program is free to an extent and is very reliable. But if you are very worried about your computer, you could get a HijackThis log and post it on a HiJackThis community.

In windows check MSCONFIG for your startup programs, but notice some viruses hides them from MSCONFIG, so like CCleaner shows them all.

~Home

From: Feroc1ty
For god sakes don't system restores like rich says, restoring does not delete any files, it rather buries and hides the viruses which may still be active, just 10x harder to find.

System Restoring allowed me to open Task Manager, which allowed me to shut the program down. It worked for me, so will work for others.

No. Do not use system restore. 99% of viruses these days are too advanced to be foiled by it. What you all need to do is boot up your computer with a Live CD, preferably Knoppix, and run several virus scans. Use Malwarebytes Anti-Malware, Avast, and any rootkit finder. Doing things in Windows isn't smart when the program has control over your system. And most likely there's several pieces of malware that were downloaded in the first couple seconds of running the malicious code… These usually don't show up in Task Manager, and can be hidden from antivirus programs. So immediately shut down your computer, go burn a Knoppix CD, boot from it, and run every scan possible on the Windows partition.

Most. This one obviously can be foiled by System Restore, because it worked for me!

From: noidea
lol, time to format/system restore and change passes?

From: Rich
Follow the steps in my first post ASAP.

i didn't open it, i just scaned it … and files don't open from alone afaik? :p

and if it is really active right now, then its just a harmless one, i've seen what a virus/trojan(w/e) can do, also i don't give a f… i need a format anyway :D.

disapointing that a fellow australian wouldl do such a thing, although it may be a proxy, although that may be the sleep deprivation talking…yay sleep deprivation!

Not good news btw how do you know the files was infected ? could be false positive, Scar has in all years been recognized as a trojan from trendmicro.