Its been a long hard night, BUT I WON!

[kiwi1960]

I have only had about one hours sleep last night, I was hit hard by a malware attack and its proving to be stubborn to eradicate.

Firstly, I had better name the "offender" because if I don't, then that casts a shadow over ALL the uploaders to this site, but please..... Please please please...

It was NOT his fault, he was a victim as much as I was, in fact, he was a pawn. He probably didn't even KNOW they did this... anyone bad mouths him, and you will be up against me... you want nasty... you will GET nasty. So please, don't attack Laroza ....

I was downloading his share of ANATOMY FOR BEGINNERS because I'd had it years ago and it was very informative... anyhow, I download episode one easily enough.

I then started downloading episode 2 from the same first links.... then I noticed they had mirrors, so I started to download part 3 but discovered that site didn't like download managers.

This was about 2am, and I was tired, I should have known better, but I started to download part 3 from the first batch while part 2 was still in progress... whether that was the trigger or not, I'm not sure.... but I was able to download part three in a few seconds... then I noticed it was an exe file, not a RAR but it had the file name in it... so I thought it might be a special way to download it....

STUPIDLY..... I double clicked on it... I was tired... that was when I woke up to how stupid I was being... but there was no way to stop the installation....

Too late... my home page was being changed, so was my DNS settings... arghhh.... I ran SPY HUNTER 4 and it found 1199 infections.... bad infections, registry and files, hard to get rid of files...

I ran that program 4 times and each time it came up with the same 1199 infections... I called in the big guns.... other malware fighters and that was when I started making headway...

The scan being done now, has found (so far) 61 infections.... and its now 8:35am.... I have only gotten 1 hours sleep last night.

This is a warning to everyone.... tired or not.... DON'T BE STUPID LIKE I WAS.... if you are expecting a RAR file then anything else has got to be EVIL.... right?

I wonder if the uploading site in question should now be blacklisted?

I'd hate for this to happen to someone like Katz who is still using XP etc ......hell, I'd hate for it to happen to my worst enemy....

...and its NOT Laroza .... got it.... he is a good dude, he wouldn't want that to happen to anyone... and I am certainly NOT blaming him ....

But if that site is knowingly doing this, then we should warn all the other warez sites... shouldn't we?

At least... if caring is sharing, then we should care enough to blacklist that site....

(but only after I have the other 3 parts from that site.....)

Excuse the typos... lack of sleep.

 

[Katzenfreund]

Well, it's ironic that only yesterday you were telling me about the insecurity of XP. And my theory is that malware doesn't work according to theory, hence my XP is still going strong, against all predictions. Actually, by coincidence, I had problem starting my computer this morning, however not due to malware but to hardware, probably my power supply. If I disappear for a while, it means I'm having it fixed.

Back on topic, if you haven't already done so, get the free Malwarebyte's and run a scan with that. Also SuperAntispyware is free and good, and there's a portable version that won't burden your computer. Do not consider your system clean, until you've scanned with several tools.

Anyway, if I can be of use to you in the future, since you thought of me, have a look at my tut here to safeguard yourself against future infections, and not only. Then you won't lose your sleep again, you'll be dreaming of pussycats of both kinds.

http://forum.dirtywarez.com/viewtopic.php?f=53&p=1651926#p1651926

 

[kiwi1960]

Problem is.... they are not called trojan horses for nothing... you know the story, they built a wooden horse, hid in it, offered it to their enemies as a gift... they wheeled it into the castle... late at night, they left the horse and opened the gates and slaughtered, raped and pillaged their way through the city....

Same with my computer.... all my defences were facing towards the internet.... two problems... I clicked on the link to download this file.... it wasn't the file I wanted, but the defences I had didn't know that... same when I double clicked on it... Win7 assumes I wanted all that carp on my computer so allowed it to happen...

For all its advantages.... malwarebytes is good at preventing anything getting onto your computer, and yes, I should have had it installed, and I did, but the licence expired and it nags you every few minutes so I unloaded it... but once its on the system... its really CRAP at getting it off.

It would have happened to anyone, old OS or new... doesn't matter... a trojan horse is really nasty....

 

[Katzenfreund]

If you had a backup, all you'd have to do is restore it and your system would be as before the mishap.

Also consider replacing your AV, as it should have detected and blocked the malware while it was still downloading.

 

[kiwi1960]

Not really.... as i said, some AV's are smarter than other... I clicked on the file to download, to my AV, that said I wanted the file... I then double clicked on it... again, telling the AV I wanted the file... problem is, in the old days, it would always nag me to make sure, so I deactivated that option... I also deactivated the option of it scanning the file in a sandbox to make sure it was safe....

Yes.... I fully admit I was stupid... when i make a monumental blunder... I own up to it... and I have. It was totally my fault.

 

[Katzenfreund]

The AVs I know don't work with the logic that if you try to download or install something, it follows that you want it. It's their job to detect and block malware, whatever you may appear to want. Unless they don't recognize the malware. If they do, they may not even warn or ask you beforehand, they just trash it and inform you they've done so afterwards. That's their live guard function.

So if you really want to install something an AV doesn't like, you have to deactivate the AV first - highly inadvisable of course. So some apps that know they're blocked by AVs, tell you to deactivate the AVs first, assuring you they're safe. Even if they do appear safe, it's my policy to never disable my AV and I do without them.

Anyway, the main point is that you've got rid (hopefully) of the nasties and you're now wiser, as you've recognized your mistakes, something many fail to do. I've learned many things this way too, and not only about computers.

Hence Oscar Wilde's famous quote:
Experience is the name we give to our mistakes.

 

[kiwi1960]

You slightly misunderstand... firstly, I'm not in the least bit blaming you...

secondly... try downloading a second RAR from them while you are currently downloading from them.... remember, free download, max one file at a time...

I was stupid... I tried to download a second file without thinking... only, what I downloaded wasn't a RAR file... but an .EXE file, I suspect this may be their way to punish people...

either way, my system is back to normal .... well, 99.9% normal... so I'm not pissed off any more with them.... it was a pretty low down thing to do, I'd hate for anyone else to go through this.

 

[Katzenfreund]

If I understand correctly, the malware was not contained in the uploaded files, but was inserted by the host, uploaded.net. Please correct me if it’s not so. If it is so, laroza bears no blame and the post shouldn’t be trashed.

Now, many hosts try to get you to use their own downloader by default (already ticked), which contains nasties, and you have to take the tick off if you don’t want it. This is not nice of them, but it’s now part of file downloading life we unfortunately have to live with.

What I find surprising are two things:
Firstly, uploaded.net is one of the popular hosts, not associated with spreading malware.
Secondly, I never expected that the nasties would be that bad.

And the lessons to be learned:
1 Don’t trust any file host.
2 Don’t forget to remove the tick.
3 Check that your AV blocks the download if you forget to remove the tick (my AVIRA did more than once).
4 Don’t click on suspicious/unexpected/exe files without scanning them first.
5 Make regular backups of your system, so that you can restore it back to health.

 

[kiwi1960]

Katz nailed it in one.... Laroza, I said you were not to blame because you were not...

The fact is... the file I got from them was NOT YOUR FILE.... it happened when I stupidly tried to download TWO files as a free user... punishment?

YOUR file was a RAR.... this was an .EXE file containing NOTHING but malware.... YOU, LAROZA.... ARE NOT... REPEAT NOT TO BLAME.... how many times do I have to say it... this post is NOT attacking you but in all fairness, I had to name you to keep it fair...

...had you been to blame... this post would not have been made public, I would have PMed an admin and had you banned.... OK... but you were NOT to blame...

The reason I made it public was to warn others NOT to make the mistake I made... I wouldn't even want that loser Cho or whatever his name was to get infected like that... NO ONE deserves that.... NO ONE.... hence the public warning... and if you read the first post again, you will see that. I specifically say you are **NOT** at fault....

...So please.... stop turning this into what you consider a personal attack... Katz nailed it in one... and I'd appreciate if you STOP trying to turn this into a personal attack because others might think it is and get malware on their computer... OK... please.... its NOT about you.... OK?

Now... from what Katz said, banning the file host won't be a good idea as its popular.... OK...

So this warning SHOULD stay...... to beware evil file hosts..... (NOT the uploaders... they are pawns as much as I was in this saga!)

Thank you.