Why you keep getting fake antivirus warnings

[dubbs]

Originally Posted by Papa_Complex

Then you haven't seen a fraction of the stuff that i have. This thing has been coming down various forms, for the last year and a half. I've been doing no less than 4 of them, per week, over that time period and as many as a dozen. If you're cleaning it up in 20 minutes, then you're leaving some of it behind.

It lives in user temp, internet temp, windows temp, all users appdata, system32, recycle bin, system dir, it's own directory under system dir, windows restore, the Java applets store, HCCR\exefile, HCLM\Software\Microsoft\WindowsNT\Winlogon, and I've seen as many as 32 separate entries in the Tasks list all set to reinfect the system, on a schedule. None of that includes the rootkits that they've pushed up, after the system was infected.

Well all those ones I left behind. going back around that year and a half.. they still haven't been re-infected.. I would know about it too because they're on managed services plans so we know about everything..

Edit - Yes I check all of those folders and reg keys too.. how slow do you work? You remind me of my tier 1 tech.. Only reason I even see these is because he can't get it. lol

[Papa_Complex]

Originally Posted by dubbs

Well all those ones I left behind. going back around that year and a half.. they still haven't been re-infected.. I would know about it too because they're on managed services plans so we know about everything..

Edit - Yes I check all of those folders and reg keys too.. how slow do you work? You remind me of my tier 1 tech.. Only reason I even see these is because he can't get it. lol

I don't work slowly, I work thoroughly. Odds are that you're either working with locked down systems, if they haven't been reinfected, or they were never disinfected in the first place

[dubbs]

Originally Posted by Papa_Complex

I don't work slowly, I work thoroughly. Odds are that you're either working with locked down systems, if they haven't been reinfected, or they were never disinfected in the first place

Last thing I'm going to say about this -

Never disinfected?

It's pretty simple.. You can see different tasks running while it's infected as well as icons in the taskbar and an annoying program that won't quit.. When I test if it's gone or not, you can see icons and files re-appearing.. When you actually get it all, there's no more fake AV or any files in all of those folders previously listed..

Yes, some are mandatory profiles as well as locked down with GP's. But even infections on home user laptops are stupid easy to get rid of. See I work fast and thoroughly, unique combo, I know...

[Papa_Complex]

Last thing I'm going to say about this

The fake virus warning isn't the only package delivered, in all cases. There are at least a dozen variants, with different packages and effects.

[dubbs]

I just love the dumb look on their face.. Well.. how did I get that?

I had one lady tell me she was lookin up porn.. She was pretty hot too..

[tallywacker]

Yeah the google pics bullshit got me twice and neither time was porn. I'm done using that shit.

[Porkchop]

Originally Posted by tallywacker

Yeah the google pics bullshit got me twice and neither time was porn. I'm done using that shit.

This...

[Papa_Complex]

And the latest little wrinkle; it takes all of your Start Menu icons and moves them to a hidden temporary folder. Bastards.