Smitfraud/Antivirus 2009/10/Security Tool etc...

[SilthDraeth]

I am sure some of the people here have came across this or know of someone that has had their PC infected with this malware.

In my current job I must come across at least 1 computer a day with this on it. Most of the people getting it have Norton, Mcafee, AVG, Avira, etc...

So my question is: Is there a commercial antivirus out there that will stop this thing before it infects the PC, and pretty much causing a full system restore?

It used to be, I could boot to safemode, and manually remove the key parts of this application. Then I started coming across computers where it deleted the registry keys needed to boot to safemode, and if I changed it in msconfig I would be stuck in an endless reboot cycle, unless I pulled the drive and mounted it to another PC to change the boot.ini file.

Lately some variants start giving me the "this action has been disabled by the system administrator" when attempting to open msconfig, or task manager, and I can't boot to safemode, and some variants, explorer will not even load. A recent pc must of had it, and later they had another virus, and after norton cleaned it, they got stuck in an endless loop, if they logged on they got logged off, they can't boot to safemode, and they can't run a windows repair, because they just have a recovery disk that will do a destructive recovery.

I can't use stuff like malwarebytes in my job, so that isn't an option, and lately it isn't possible anyways.

So back to my original question, why do the big name companies out there not have a way to stop this, when it has been around for several years, how come they can't remove it, but malwarebytes can?

I have been pushing Kaspersky, and to my knowledge it will block it with banner ad blocking enabled, BUT I am not sure otherwise.

Thanks.

P.S. If this needs to be moved to Computer Help, then please move it mod. But I figured it was more a software security, than help. Thanks.

 

[Silan]

We use webroot business at our work and have not seen or heard of anyone getting smitfraud. Do not know the pricing though, sorry.

 

[baddog60]

Does anyone know if these fake anti-virus programs are spread through email or the Internet? Also, does it matter which browser you are using?

Also, it seems like the only way that I can get rid of them now is to logoff the computer and then launch Task Manager and Malwarebytes as soon as possible.

 

[RebateMonger]

One computer infected a day is VERY expensive. As you know, it's getting very difficult to remove this stuff.

The AV makers say it's very hard for them to tell the difference between a legitimage software install and a spyware install. They have to be able to identify the difference without false positives, which would kill them.

The stickies here talk about Software Restriction Policies and other things that can often be done in a large company. For my small clients, who can't afford a lot of time, I recommend automated system image backups, which allow fast restores to their pre-infected state. One restore and they've gotten their backup investment back.

 

[SilthDraeth]

One computer infected a day is VERY expensive. As you know, it's getting very difficult to remove this stuff.

The AV makers say it's very hard for them to tell the difference between a legitimage software install and a spyware install. They have to be able to identify the difference without false positives, which would kill them.

The stickies here talk about Software Restriction Policies and other things that can often be done in a large company. For my small clients, who can't afford a lot of time, I recommend automated system image backups, which allow fast restores to their pre-infected state. One restore and they've gotten their backup investment back.

If only I had clients vs working retail atm. You could probably guess were I work within three tries.

I hate not being able to provide a total solution, or use any number of freely available tools etc. Not that the price per incident would necessarily be lower for the customer, but I could really push the automated system image backups, etc if I were freelance.

As for webroot, I notice this infection on the webroot that people buy, I haven't dealt with any professional versions of it.

 

[Prophecy1]

We typically deploy Nod32 now, Now of course this is the best overall solution. Of course in a domain environment we have a strict internet policy and access policy on the network.

Good luck

 

[JEDIYoda]

I am sure some of the people here have came across this or know of someone that has had their PC infected with this malware.

In my current job I must come across at least 1 computer a day with this on it. Most of the people getting it have Norton, Mcafee, AVG, Avira, etc...

So my question is: Is there a commercial antivirus out there that will stop this thing before it infects the PC, and pretty much causing a full system restore?

It used to be, I could boot to safemode, and manually remove the key parts of this application. Then I started coming across computers where it deleted the registry keys needed to boot to safemode, and if I changed it in msconfig I would be stuck in an endless reboot cycle, unless I pulled the drive and mounted it to another PC to change the boot.ini file.

Lately some variants start giving me the "this action has been disabled by the system administrator" when attempting to open msconfig, or task manager, and I can't boot to safemode, and some variants, explorer will not even load. A recent pc must of had it, and later they had another virus, and after norton cleaned it, they got stuck in an endless loop, if they logged on they got logged off, they can't boot to safemode, and they can't run a windows repair, because they just have a recovery disk that will do a destructive recovery.

I can't use stuff like malwarebytes in my job, so that isn't an option, and lately it isn't possible anyways.

So back to my original question, why do the big name companies out there not have a way to stop this, when it has been around for several years, how come they can't remove it, but malwarebytes can?

I have been pushing Kaspersky, and to my knowledge it will block it with banner ad blocking enabled, BUT I am not sure otherwise.

Thanks.

P.S. If this needs to be moved to Computer Help, then please move it mod. But I figured it was more a software security, than help. Thanks.

I am positive it does not matter what you use on your computer. IMO and in my experience this smithfraud stuff has to do with your surfing habits.

I know my sister had this on her computer and it took forever to get Vista to load the screen where I could go back to a clean restore point and the boot the computer!!

 

[Modelworks]

The anti-virus companies work pretty hard to keep current, but there are literally several dozen new virus released every day. It has gotten worse in recent years not because there are more people writing virus but because of stupid MTF idiots, and I am being kind here, that thought it a good idea to release virus creation tools , so now people don't even have to know how to program. I found one that has a selection of check boxes for what you wanted the malware to do, complete with code scrambling and hiding from anti-virus programs. Basically a point and click virus creator. In the past people just took old code and modified it, now it takes 5 minutes to turn out a new virus version.


Part of the problem is windows itself. Even win7 UAC doesn't solve the problem, it merely gives the user a false sense of security. MS needs to realize that no program should be able to access anything on the drive that is not part of its install. The way it works now I could write a program that while running catalogs every file on the disk, moves them around , encrypts them where others cannot read them, deletes them, etc without ever triggering a UAC prompt.



For people that are getting virus from surfing I HIGHLY recommend sandboxie. It places the program in a virtual box where it cannot make changes to the system.

http://www.sandboxie.com/

 

[SlickR12345]

I actually find that most security suites now to be extremely good.
It actually the user who even after a note or info about a dangerous file it will download it.
Even in the case of already quarantined virus, people may unleash it, just because they think its actually legit and may be a false positive.

 

[VirtualLarry]

XP Pro and SRP are powerful tools that block these sorts of nasties from ever executing, even if they do get downloaded onto the system.

I find it irresponsible of MS to limit the utility of SRP to "pro" editions of Windows, and leave ordinary home users COMPLETELY DEFENSELESS.

Why someone doesn't point this out, and get people to start calling "Home Premium" as "VIRUS EDITION", and "Pro" as "NON-VIRUS EDITION", I don't know. Once there is an outroar, from knowledgeable users, then perhaps things will change.

 

[us3rnotfound]

XP Pro and SRP are powerful tools that block these sorts of nasties from ever executing, even if they do get downloaded onto the system.

I find it irresponsible of MS to limit the utility of SRP to "pro" editions of Windows, and leave ordinary home users COMPLETELY DEFENSELESS.

Why someone doesn't point this out, and get people to start calling "Home Premium" as "VIRUS EDITION", and "Pro" as "NON-VIRUS EDITION", I don't know. Once there is an outroar, from knowledgeable users, then perhaps things will change.

Forgive me but what is SRP?

This explains why I fix more people's computers that have XP Home versus those that have Pro.