Bebo Virus

Hi, I spent ages trying to rid this virus from a friends computer, I did scans with lots of spyware, malware, antivirus programs and even though they all found threats none of them removed the virus. Following advice from heresjonny30 here I did a search for files modified on the date that the virus was downloaded. I noticed that MSXML 6.0 was installed in C:\Program Files\ around the time of the virus was installed. I'm sure exactly what MSXML is but it is supposed to be a legit microsoft tool, but I removed it anyway (I was thinking either this was the virus or else that the virus needs this to run). Anyway this did the trick for me and now the internet is working fine again. Also just to note the symptoms of the virus were that it kept changing firefox and IE proxy settings to 127.0.0.1.

bebo is now reporting links as a virus (since this morning)
Safe Link to the warning message.

Virus is relatively new signature of an older one, so update your anti-virus, disconnect from the internet, and save all important files to a memory stick or dvd as soon as you can.

Change startup items(i usually find that ccleaner is good for this sort of stuff), and remove whatever you don't need from the startup list OR go to your start menu and either search for(in vista) or Run...(in windows) an application(already on your computer) called 'msconfig'. (Be careful in here, at your own risk), set it to diagnostic startup mode, restart your PC. This will ultimately just freeze the virus and give you an opportunity to carry out the anti-virus scan.

Up until three days ago, AVG did not even have anti-virus protection against this particular 'signature'. However, when I was taking anti-virus off someone's computer before that, Avast(www.avast.com) found the virus in a matter of seconds in the system32 folder.

Quote from heresjonny30:

heresjonny30 wrote: »

I found a file called algg.exe in this folder: c:\windows\system32, there is another file next to it called alg.exe but this is a safe file. Check the date modified for the file, and it should match the date and time that you clicked the link. delete the algg.exe if you can but malware bytes will/should pick it up. Its also worth sorting this folder by date modified and ditching other files modified at around this time. A couple of other files I deleted had random numbers and letters making up the file name.

After running the malwarebyte scan I also ran my virgin virus scanner everything came back clean. I usually run this in "on access mode"

Hope this helps, also worth clearing all you internet cookies and temp files. Change your passwords once your machine is clean. Clear you recycle bin.

And people are asking why viruses are created. Thats because viruses create money for the people that make them. Norton International, AVG, Avast, and other antivirus companies are huge companies that depend on fear of viruses for money, and people like me fix people's computers after other people make and distribute viruses. Other people get satisfaction out of exploiting holes in technology because they're so socially inept, they cannot get any other holes.

My recommendation is to use Google Chrome or Mozilla Firefox as your default browser rather than Internet Explorer. They have malicious website detectors. Also use Avast Anti-virus. It's ugly, but the free version has more features than it's counterparts (AVG), such as more comprehensive scanning, and on-access, live scanning. And when using Bebo, detect reality; a lad isn't going to write OMG title, followed by one line saying your an idiot followed by a link to a polish website.

Deleted User wrote: »

any worries for mac users?

If it's a phishing site yep, those are OS independent.

AlmightyCushion wrote: »

I was just about to say that, gave me a good laugh.

biki'd

supersub14 wrote: »

my laptop didnt crash. i was still able to shut it down ok. all that happened was a lot of IE browser windows opened up trying to take me to a antivirus website.

the virus seems to have changed my internet settings (if thats possible) and even though im still connecting to my wireless router ok it wont load up webpages?

Any help??

Has it changed your proxy settings?