Britney Spears virus links in posts

[Steve St.Laurent]

Do you know if this virus will get by the checks in Vista? It's supposed to pop up a little window everytime something is installed so the user has to ok the installation.

Joe - I have no idea. I don't have a machine around here that I was willing to infect to try to find more information on it. One of our members who is a security expert offered to help and he attempted to get a machine infected and was unable to do so. He talked with 3 anti-virus providers his company works with and none were aware of this virus. I found the same basic virus pointing to 3 different domains so there are variants out there.



My primary concern was stopping the virus from spreading further and informing those that already had it that they were infected. Without having the virus in my hands it's hard to find anything out about it other than searching on the symptoms - which produced no results other than seeing the other sites that also had the trace of it on.



I would like to find out what info is in anyones scan logs about the virus so that more could be found out about it.

 

[Joe G.]

Thanks Steve. I have not bought any aftermarket anti-virus stuff since I bought this computer with Vista already on it. So I was just checking. The built in stuff seems to work so far. At least, whenever I install anything, even a patch from some non-MS software I get a popup that asks if the installation is legit. So far, no data miners like plagued me with XP.

 

[The patriot]

Thanks for watching out for us Steve.

Eric

 

[Radshooter]

Hate to admit it, but I did click on it also. Since then I have run several virus scans. Hope they worked. Here is my test post.

Steve

 

[AndrewGray]

 

[AndrewGray]

Since we are talking about virus's and such, what do you all think would be a good virus scan, adware and such download. I had McAfee and seemed to decent. Now I have AVG and Im not happy with it. It is always updating every time I start my computer. Any suggestions.

 

[nps]

hummmm.....



Eric, Grizzly, and B. G. Smith - do your wives know about this? :-laf

 

[fest3er]

Since we are talking about virus's and such, what do you all think would be a good virus scan, adware and such download. I had McAfee and seemed to decent. Now I have AVG and Im not happy with it. It is always updating every time I start my computer. Any suggestions.

Trend Micro is one of the better ones. It doesn't seem to take over the whole computer the way Norton does. The folks at church switched to it a couple years ago, and have had no problems since. They have anit-virus, firewall and perhaps a few other things.



Personally, I've been using ClamWin on my laptop. It may not be the greatest and is not integrated with every Windows application, but it does seem to do a decent job scanning the hard drive the few times I've seen fit to do that. But then, I'm quite particular where I click my mouse and I am *very* particular about what software runs on my computer; these are the biggest reasons I've not been infected. And I nearly always look at the content of strange links before I click them; if the displayed URL differs a lot from the actual URL, I don't go there, since it is most probably malware and, if not malware, not worth visiting because the programmer couldn't be bothered to do a good job and the rest of the site will probably reflect such carelessness.



N

 

[DFranks]

Just testing

 

[Grey Wolf]

It's too bad these generators of virus's, spyware's and whatever else can't put their talents to work in a good way

 

[Grizzly]

hummmm.....



Eric, Grizzly, and B. G. Smith - do your wives know about this? :-laf

What are you trying to say nps? Are you being an a_ or an so_?

 

[hsmith]

Thanks Steve for taking care of that for us.

 

[JFaughn]

I've got a 3 mth old Mac , I'm not real computer tech oriented , but try to keep an eye out just because I use the net a lot .
Question is , about how this works , all of my surfing is at public places , coffee shops ect. , I saw a Speers line on top of a post I read the other day , I am not interested in the Speers thing so I did not click on that link , but did follow the post , read all the other posts ,
Actually this is the real ??? starting yesterday the main coffee shop I go to started having almost a dead stop/slowdown , so I thought this virus could be the cause ? What is the virus doing / symptoms ?
thanks John .

 

[Steve St.Laurent]

The only symptom I'm aware of at this point is that it puts itself into posts on message boards. I doubt this virus was the cause of the problem at your coffee shop.

 

[Steve St.Laurent]

Ok folks. I have the filter in place now. Now if anyone has this virus the text will be removed and the link will be changed to say that executable files cannot be linked. I'll post right below this just what the virus would post so you can see it:

…

LINKS TO EXECUTABLE FILES NOT ALLOWED

So that's all you'll see on your posts if you have the virus. This will protect from it spreading further. I'm sure that other variants will come out so if you see wierd stuff at the beginning of posts please let me know and I can add that text to the filter. By stopped executable links that will stop any spread.

There is one issue however. If a website address has . exe in it that address is going to be killed as well. For example an address like www.executive.com would come out like this:

LINKS TO EXECUTABLE FILES NOT ALLOWEDcutive.com

I couldn't come up with a solution to that problem. But given the option of spreading a virus or this problem protecting our users is more important.

 

[B.G. Smith]

Haven't been able to log on so don't know if my computer has it or not? bg Must be ok.

 

[fest3er]

Hmmm. Regular expressions like "[h][t]tp://[^/]*/. *\. exe. *" or "[^/]*/. *\. exe. *" might work. That'd let the whole FQDN be wildcarded, but still catch the file. exe.

[Hah! It wouldn't even let an RE through! I'll try something else... ]

N

 

[Steve St.Laurent]

Nope - didn't work. That replaces everything including regular text with the statement.

 

[fest3er]

OK, Steve. Try the PHP code at http://murent.us/misc/ssl.txt (right-click and save). This was more fun than squarshin' tadpoles!



N

 

[JFaughn]

Back again , with the Mac , its the only site that has done this , it seems like it may be associated with this , some script is added to the beginning of my posts , here's an example , Gold prospector site .

GPAA Forum: California Prospecting Gone?