Is Trade Me spreading virus again? (updated: metservice)

Forums › Desktop computing › Is Trade Me spreading virus again? (updated: metservice)

graciem

19 posts

Geek

Trusted

Topic # 88365 14-Aug-2011 18:55
my the other laptop just got infected after visiting trademe, metservice and nzherald last night. didn't click on anything. this personal shield pro somehow is installed on the pc. have been trying to do something since. managed to "pause" the program to do something. my other laptop (the one i'm using) is fine, so I can search some articles about removing it. surprising the microsoft security essentials didn't pick anything up, after 3 hrs of full scan. called TM and emailed nzherald. curious to find out who it is to spread the virus.

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8

13286 posts

Uber Geek

Trusted

Vodafone NZ

Subscriber

Reply # 506373 14-Aug-2011 19:01
Give me one good reason why TM / NZherald / Met service would spread a virus? You emailed them they must be rolling around on the floor laughing Systems Engineer Vodafone NZ http://forum.vodafone.co.nz

graciem

19 posts

Geek

Trusted

Reply # 506378 14-Aug-2011 19:04
not on purpose of course. they've been targeted. probably spread via some of the advertisements (they can be very heavily scripted) this is what happened last year: http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=10677853

stuzz

128 posts

Master Geek

Subscriber

Reply # 506379 14-Aug-2011 19:08
I have always used http://www.malwarebytes.org/ to get rid of these. Download & install the free version. Install & do any updates. Then boot to safe mode & run a full scan from there.

graciem

19 posts

Geek

Trusted

Reply # 506382 14-Aug-2011 19:13
thx! doing a full scan with Malwarebytes right now. fingers crossed. still curious which site is spreading it.

johnr

13286 posts

Uber Geek

Trusted

Vodafone NZ

Subscriber

Reply # 506384 14-Aug-2011 19:16
It might be a false positive John Systems Engineer Vodafone NZ http://forum.vodafone.co.nz

freitasm

BDFL
43668 posts

Uber Geek

Administrator

Trusted

Geekzone

Subscriber

Reply # 506385 14-Aug-2011 19:16
johnr: Give me one good reason why TM / NZherald / Met service would spread a virus? You emailed them they must be rolling around on the floor laughing It happened before, and not a reason for them to laugh. It only needs someone to approve a rogue ad coming from a unknown source and all hell breaks lose. Mauricio Freitas (Geekzone Admin, Devil's Advocate, my blog, technology disclosure, my tweets, Web Performance Optimization) Geekzone Price comparison \| Amazon Kindle order page \| How to get the best out of Geekzone \| New Zealand IT Jobs \| Geekzone News \| Jinglebugs

l43a2

803 posts

Ultimate Geek

Reply # 506386 14-Aug-2011 19:16
funny you should say that.. my sister had a virus alert come up after visiting metservice last night

johnr

13286 posts

Uber Geek

Trusted

Vodafone NZ

Subscriber

Reply # 506387 14-Aug-2011 19:17
freitasm: johnr: Give me one good reason why TM / NZherald / Met service would spread a virus? You emailed them they must be rolling around on the floor laughing It happened before, and not a reason for them to laugh. It only needs someone to approve a rogue ad coming from a unknown source and all hell breaks lose. Fair point I never thought of the ads on the page! Systems Engineer Vodafone NZ http://forum.vodafone.co.nz

freitasm

BDFL
43668 posts

Uber Geek

Administrator

Trusted

Geekzone

Subscriber

Reply # 506388 14-Aug-2011 19:18
These guys are clever. They approach as an ad agency, book ads and start running something that is ok, so if the media managers check they don't reveal anything. Half way through the ad campaign they switch to a script with some malware, and no one will notice until a lot of users are infected. Mauricio Freitas (Geekzone Admin, Devil's Advocate, my blog, technology disclosure, my tweets, Web Performance Optimization) Geekzone Price comparison \| Amazon Kindle order page \| How to get the best out of Geekzone \| New Zealand IT Jobs \| Geekzone News \| Jinglebugs

graciem

19 posts

Geek

Trusted

Reply # 506391 14-Aug-2011 19:24
l43a2: funny you should say that.. my sister had a virus alert come up after visiting metservice last night is it Personal Shield Pro? it keeps popping up pretending to be an anti spyware warning you about your pc's infected. it's a malware itself. don't agree to "protect" your computer or even purchase their software.

kyhwana2

2146 posts

Uber Geek

Reply # 506395 14-Aug-2011 19:33
And people wonder why I use noscript/etc to block ads!

l43a2

803 posts

Ultimate Geek

Reply # 506398 14-Aug-2011 19:36
graciem: l43a2: funny you should say that.. my sister had a virus alert come up after visiting metservice last night is it Personal Shield Pro? it keeps popping up pretending to be an anti spyware warning you about your pc's infected. it's a malware itself. don't agree to "protect" your computer or even purchase their software. that didnt come up, her anti virus (AVG) came up with an alert with some random .exe file and it was removed.

freitasm

BDFL
43668 posts

Uber Geek

Administrator

Trusted

Geekzone

Subscriber

Reply # 506406 14-Aug-2011 19:46
kyhwana2: And people wonder why I use noscript/etc to block ads! You are only really at risk if you don't keep your PC up to date. Some drive-by downloads use a mix of vulnerabilities, most of them old. If you have a machine that is up-to-date is less likely anything like that would affect you, script or no script. Mauricio Freitas (Geekzone Admin, Devil's Advocate, my blog, technology disclosure, my tweets, Web Performance Optimization) Geekzone Price comparison \| Amazon Kindle order page \| How to get the best out of Geekzone \| New Zealand IT Jobs \| Geekzone News \| Jinglebugs

DonGould

don@i.am.a.can.do.kiwi.nz
3129 posts

Uber Geek

Subscriber

Reply # 506413 14-Aug-2011 19:55
Nice - after debate, wife is now installing adblocker :) Promote New Zealand - Get yourself a .kiwi.nz domain name!!! Check out mine - i.am.a.can.do.kiwi.nz

graciem

19 posts

Geek

Trusted

Reply # 506415 14-Aug-2011 19:58
malwarebytes found 2 infected files and removed them. However, it's still not right. All the google search results point to some random URL. IE. nzherald site, if you move cursor over the link, you will see in the status bar it's pointing something like 178.12.343/something/something. it goes to a travel site. tried some others, goes to some gossip sites. something's still there :( interesting though, when I run google.co.nz on chrome, clicking on "search" it just won't go anywhere.

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8