Not a hello but a PC security warning

[Tringa]

As the Hello section is at the top of the forum page and we don't have a dedicate computer section I thought I'd put this here.

On 24th June I received a message in my Inbox from the "IT White papers". The title was "The Friday Five". As I was looking through my mail and deleting as I went along this message opened as I deleted the one above it. It purported to have information about IT issues and suggested I click on the link.

I know enough about unsolicited email not to do that but the damage was already done. A screen popped up saying 'XP Home Security 2012' had detected all sorts of nasties on my PC (I assume the name varies with the OS you are using).

These are usually no more than a nuisance but this one, in common with similar named variants from 2011 and I think 2010 is a difficult one. It disables all the security applications on your PC. If you have things like MalwareBytes and SpyBot S&D - forget them, they won't work. Online security scanners like FSecure also will not work. Web browsers are disabled and you are continually encouraged to buy the software that has allegedly detected a host of nasties.

It took me the best part of a day to deal with this one and get the machine back to normal.

I'm posting this now as today I have received another email from the same place(about one week later and also called the Friday Five) - this time I did not let it open and its gone, but just in case your email client automatically opens the next message if you delete the one you are reading, have a look at the list in your Inbox first and if it is there delete it.

As this one appeared in the Inbox, not Junk mail it could easily be taken to be OK.

Hope no one gets it, but if you do, do not pay anything. It is not the easiest of things to get rid of but it is possible.

Dave

[KentYeti]

Thanks for that Dave.

I think I probably rely on my SPAM filter too much.

Will be keeping an even closer watch on what is in my In Box now.

Bryan

[Stinky Bob]

Originally Posted by Tringa

As the Hello section is at the top of the forum page and we don't have a dedicate computer section I thought I'd put this here.

On 24th June I received a message in my Inbox from the "IT White papers". The title was "The Friday Five". As I was looking through my mail and deleting as I went along this message opened as I deleted the one above it. It purported to have information about IT issues and suggested I click on the link.

I know enough about unsolicited email not to do that but the damage was already done. A screen popped up saying 'XP Home Security 2012' had detected all sorts of nasties on my PC (I assume the name varies with the OS you are using).

These are usually no more than a nuisance but this one, in common with similar named variants from 2011 and I think 2010 is a difficult one. It disables all the security applications on your PC. If you have things like MalwareBytes and SpyBot S&D - forget them, they won't work. Online security scanners like FSecure also will not work. Web browsers are disabled and you are continually encouraged to buy the software that has allegedly detected a host of nasties.

It took me the best part of a day to deal with this one and get the machine back to normal.

I'm posting this now as today I have received another email from the same place(about one week later and also called the Friday Five) - this time I did not let it open and its gone, but just in case your email client automatically opens the next message if you delete the one you are reading, have a look at the list in your Inbox first and if it is there delete it.

As this one appeared in the Inbox, not Junk mail it could easily be taken to be OK.

Hope no one gets it, but if you do, do not pay anything. It is not the easiest of things to get rid of but it is possible.

Dave

I have had to remove a few of these from clients computers over the last week or so, you can also get them from "dodgy/infected websites" and the method of removal varies depending on the O/S. ESET NOD32 will remove it after a couple of scans, you may also find that applications and executables will no longer run even after cleaning, to fix this you will need to edit the registry or find a program that will fix the broken association.

Attached are some screen shots of the fake alerts look like.

[Tringa]

Those are the screen shots I saw, Bob.

You are correct about editing the registry. It was only way I managed to begin to get a handle on this one.

After deleting a few entries I could do a bit more and eventually got a way to remove the nasty.

Dave