Need computer HELP!

[iceman61]

Has anyone ever heard of "gpedits"?
I downloaded a program & somehow got a sneaky attachment. The message keeps popping up on my screen saying:
"Patch applied succesfully! If your software is still trial maybe you need to install it before patch it" And it keeps popping up everytime I close it. I need help bad.....anybody?

[crokett]

gpedits is the group policy editor in Windows IIRC. However it sounds like you have a trojan/malware.

This site says they have a cleaner for it:
http://spywarefiles.prevx.com/RRBAJI...EDITS.EXE.html

[OpaDC]

This is all I can seem to find on it
Check out the documents and tools section
I can't try them because I am on a MAC so I can't vouch for them

http://ca.com/us/securityadvisor/vir....aspx?ID=72788

[shup]

Try this spot iceman. They are a great source for this type of crap. It's too bad we can't get rid of the parasites that do this type of sh$t.

http://www.bleepingcomputer.com/foru...Win32/DCKeyg.A

shup

[iceman61]

It seems like CA Antivirus took care of it, although my desktop is still acting a little sluggish. I worked on it until about 3am. I'm running another scan on it right now just to make sure it didn't reload after rebooting. I'll report back.

Thanks guys!

[Kristofor]

Gpedit is the policy editor as David mentioned. Lots of malware tries to use identical or similar sounding names to avoid easy identification and removal.

Glad you were able to wipe it out.

I've taken to using virtual environments whenever I need try something that could be questionable (eg less than millions of existing users, from an un-trusted source, etc.). It takes up some HDD space, but it makes issues like that trivial to fix (blow that instance away...)

Kristofor.

[crokett]

Iceman,

Exactly how did you clean this? My wife's laptop had it today. I just started working on it now. Did you have to purchase CA Antivirus?

[iceman61]

Iceman,

Exactly how did you clean this? My wife's laptop had it today. I just started working on it now. Did you have to purchase CA Antivirus?

I can't remember where I found it (Keep in mind it was 2-3am) but somewhere I found a link for 15 day free trial for CA Antivirus. Try the company website 1st. It seems like I Googled "CA Antivirus" & found it that way. Sorry I can't be more specific but my eyes were crossing & my head was dropping at the time, but it is out there & it seems like it was on the company website. While being faced with spending $39 for it I thought to look to see if by some chance there was a free trial & there it was. I did find another software that found it but it cost also.

Norton didn't give me any kind of warning at all. It won't be renewed when the subscription is up.

[Nilt]

Heck of a place for my first post ...heh. I'm an independent IT guy (geek for hire) when not tinkering with my tools. I've seen that gpedits malware a couple of times recently on client's systems. I've been successful at cleaning this one with NOD32 so far. You can get a 30 day free trial of that at eset.com; I find it catches things a littler sooner than CA, although CA isn't so bad, either. Norton and McAfee have been abysmal at catching this sort offor y stuff for years, unfortuantely.

Anyhow, hi there. Hehe.

[crokett]

I found that CA free trial and cleaned it up last night. I also cleaned up the Windows Antivirus 2009 Malware - that one was nasty. It pops up and tells you Windows Antivirus 2008 (or 2009) is out of date and you should update. Whether you click ok or cancel it gets you. Hijacks your web browswer and prevents you from going to Antivirus/antispyware sites and hijacks security center and prevents you from changing settings. I had to boot into safe mode to clear it up with SpyBot. Then ran Avast and found a couple rootkits. We think she got the bugs Thursday from an online place where she was designing a business card.

[Nilt]

I found that CA free trial and cleaned it up last night. I also cleaned up the Windows Antivirus 2009 Malware - that one was nasty. It pops up and tells you Windows Antivirus 2008 (or 2009) is out of date and you should update. Whether you click ok or cancel it gets you. Hijacks your web browswer and prevents you from going to Antivirus/antispyware sites and hijacks security center and prevents you from changing settings. I had to boot into safe mode to clear it up with SpyBot. Then ran Avast and found a couple rootkits. We think she got the bugs Thursday from an online place where she was designing a business card.

The fake CNN video going around also puts those on there. It'll claim Flash needs an updated codec, as I recall.

I'd suggest a backup of anything important just in case. The Windows Antivirus stuff (variously called Smitfraud, Zlob and several others) often leave a hidden bit of code that puts them back after a few days. Not all of them bother with this but enough so that it's a pain in the neck, forcing some folks to end up reinstalling everything in order to be sure it's gone.

On the plus side, at least it doesn't sound as though you pay them anything. I have a client who did because her AV app was expiring soon. They stripped her entire checking account with various other un-asked-for purchases before she realized what had happened. I wish these things would go away. There're plenty of ways for guys like me to make a good living without having to clean this garbage off computers.

[dlminehart]

This is one of the main reasons why I have a Mac :-)

In 20 years of Mac ownership (and managing scores of Macs), I've spent $0 on antivirus/antispyware protection and have had 0 problems. On my PC, I have to stay constantly vigilant, and pay the annual protection money, and even then stuff slips through.

[Nilt]

This is one of the main reasons why I have a Mac :-)

In 20 years of Mac ownership (and managing scores of Macs), I've spent $0 on antivirus/antispyware protection and have had 0 problems. On my PC, I have to stay constantly vigilant, and pay the annual protection money, and even then stuff slips through.

I'm not going to get into the PC vs Mac holy war thing here. Macs are great, as are PCs. I have both in my own collection of computers as well as Linux and BSD systems. I just want to be clear here that I'm not a "Windows guy" bashing on Apple or anything like that. Besides, nearly 30% of my total revenue in my IT business comes from resolving various Mac issues for clients.

Anyhow, one of the recent ones I had to deal with was a very similar attack. Despite it being around for over a year, my client was hit with it less than a month ago. I've seen it off and on with various Mac clients since it came out. You can find a write-up of it here.

As with all security systems, the important thing about computer security is the user. If a user can be tricked into installing something then no amount of security will help. Unfortunately, the aura of invulnerability Macs have has actually contributed to this, in my opinion. Every single client that I've cleaned this off of has been shocked to discover that Macs aren't immune. Unfortunately, Mac malware is going to grow over the coming years.

[iceman61]

This is one of the main reasons why I have a Mac :-)

In 20 years of Mac ownership (and managing scores of Macs), I've spent $0 on antivirus/antispyware protection and have had 0 problems. On my PC, I have to stay constantly vigilant, and pay the annual protection money, and even then stuff slips through.

LOL That's one way of looking at it....legalized extortion

crokett...Glad to see you got it cleaned up.