goofy01
join:2004-02-05
Hammond, IN
 ·Comcast
|  How did someone with a limited account install Antivirus XP
On a second computer here at the house, one of the g/f's kids asked me to look at the comp because something came up. I go and see Antivirus XP 2008 has infected the computer. I thought that by putting all the users as a limited account that stuff like this wasn't suppose to happen. Took me a bit, but I got it off finally and now wondering how to stop this in the future. He was using FF 3.0 at the time of this.I already told the boy to quit going to the porn sites.  |
|
Doctor Olds
I Need A Remedy For What's Ailing Me.
Premium,VIP
join:2001-04-19
1970 442 W30
clubs:
| Safe Mode will let you install programs sometimes
OR
They may have watched over a shoulder to find the Admin Password
OR
There are Linux Boot CDs that can be burned to a blank, placed in the drive so that when rebooted the CD shows all passwords used on the system. 
Regards,
Doctor Olds
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time? |
|
teh_zeus
@cogentco.com
thumbs down from:
ahulett 
| reply to goofy01
Re: How did someone with a limited account install Antivirus XP
Ok, how he did it, i dont know.
But the reason i want to reply after reading this, is that you are already using firefox, which is good.
Just install the no-script extension, and you can visit as many pr0n sites as you want (or he wants) and it wont matter....no-script will do its work to keep your pc safe.
If you want to see streaming content like on youtube, all you do is just allow that particular site in the no-script options.
I've been using no-script ever since it came out, and once you get used to it, infections will be a thing of the past.
(im sure you already are covered on the firewall front) |
|
ahulett
Equal Rights - It's Time
Premium
join:2003-02-02
Redmond, WA
edit:
June 28th, @09:21PM
| reply to goofy01
Running in a Limited User account is a good way to help potentially reduce the degree malware effects a system. Here's some information we have on Limited User accounts under Windows XP, which includes a link for information on Windows Vista:
Microsoft Security At Home
Limited User accounts can protect your Windows XP computer when you browse the Web
»www.microsoft.com/protect/comput···unt.mspx
Hope this helps,
Aaron
--
Aaron Hulett | Senior Spyware Researcher | Microsoft Malware Protection Center
This posting is provided "AS IS" without warranty, and confers no rights. |
|
RedXII1234
Premium,Mod
join:2001-02-26
localhost
Host:
/dev/null
Broadband Tweaks
ISDN
Fiber Optic
AOL Broadband
| reply to goofy01
If it installed globally or changed system policies like it usually does to prevent changing preferences, then it wasn't a limited account. Safe mode won't make a limited account an administrator. An account in both "Users" and "Administrators" group will make it an administrator.
Otherwise you could have just deleted the profile folder from another account and been done with it, or it had failed from installing altogether. |
|
Bubba1
Less is More
Premium
join:2006-09-21 | reply to goofy01
Just curious .. what security software is installed on the machine?
And, what tool did you employ to rid the machine of the infection?
--
"Fast is fine, but accuracy is everything" --Wyatt Earp |
|
goofy01
join:2004-02-05
Hammond, IN
·Comcast
| reply to goofy01
Dr. Olds, he didn't do any of that, he was browsing and said something like "It said to update my player, so I clicked on it"
I know before I have had to log into the admin account just to install Adobe before since another account needed to read a PDF and they were set up the same way.
I will look into adding no-script. Thanks Aaron, will read that in a bit.
It was installed across all accounts, since there was a desktop icon on my admin desktop.
The computer has McAfee Security Center from Comcast on it, fully updated. This did catch the desktop hijack part of the program. I used Malwarebytes to remove it. |
|
bcastner
Premium,MVM
join:2002-09-25
Chevy Chase, MD
clubs: 
 ·Verizon Online DSL
edit:
June 29th, @11:43AM
| I would seriously consider installing the free Microsoft product SteadyState on this computer. The link below has a fairly extensive set of links to discussions as to what it is, how to obtain it, and why it could help: »aumha.net/viewtopic.php?f=26&t=27570
quote:
What state is your shared computer in at the end of the day?
• Hard disk filled with downloaded files?
• Strange options configured?
• Programs installed that you don't want?
• System infected with viruses and spyware?
• Computer bogged down for unknown reasons?
Windows SteadyState, successor to the Shared Computer Toolkit, is designed to make life easier for people who set up and maintain shared computers.
An easy way to manage multiple users
You can manage whole groups of users as single user accounts. The new Windows SteadyState console makes it easier than ever to create and modify user profiles.
A locked-down platform for stable shared computing
Not every computer user should have access to every software capability. Your system can be more stable and consistent when you limit user access to control panel functions, network resources, and other sensitive areas.
Set it and forget it
Once you have everything set up the way you want it, you can share the computer and rest easy. Any changes a user might make to the configuration or hard disk can be undone by simply restarting the machine
Recommended.
(Now available for Vista 32-bit as well).
Bill Castner
--
============
MS-MVP 2004 - -2008, ASAP Member
Users Helping Users
|
|
ahulett
Equal Rights - It's Time
Premium
join:2003-02-02
Redmond, WA
| reply to goofy01
quote:
he was browsing and said something like "It said to update my player, so I clicked on it"
Wild guess: Zlob "Media Codec". You go to watch a video. It looks like it's about to play, then wham! A dialog appears saying a new media codec is needed to play it. User, wanting to see the video, clicks Yes, and then is hit with desktop shortcuts, rogue security software, or other potentially unwanted software.
--
Aaron Hulett | Senior Spyware Researcher | Microsoft Malware Protection Center
This posting is provided "AS IS" without warranty, and confers no rights. |
|
jdong
Eat A Beaver, Save A Tree.
Premium
join:2002-07-09
Rochester, MI
clubs:
| reply to goofy01
This is why I've warned from time to time a limited account alone is not a magic bullet. A limited user account can infect himself with malware and also a compromised program under a limited user account can destroy all of the data that account has write access to.
So, if you're the only user of your system, and run under a single limited account for most of your work, are you really better off? I would make the argument that no, you're not much better off... At least to me, losing all my documents is probably a bigger inconvenience than having to reload the OS.
This day and age, we need more fine-grained limited permissions, possibly to the point of sandboxing each application to its own account or security sandbox context.
--
Ubuntu MOTU Developer and Forums Council |
|
Shriyash
Sungazer
Premium
join:2005-02-23
PuNe, InDiA
edit:
June 30th, @10:42PM
| reply to goofy01
said by goofy01 : he was browsing and said something like "It said to update my player, so I clicked on it" Yep, definitely sounds like a fake codec update that installs spyware upon execution.
It may have looked something like the pic in this post.
Edit: i would install No-Script if i were you. |
|
Lanik
Lab-nik
Premium,ExMod 2002-03
join:2001-06-25
Bay Area
·DSL EXTREME
edit:
June 30th, @11:12PM
| reply to goofy01
This just happen to a coworker of mine and to make matters worse the desktop background gets hijacked and Display properties are missing tabs so you can't switch your desktop now. Does anyone know what Antivirus XP 2008 installs and how to get rid of it.
Thanks.
--
"If it ain't broke don't fix it." |
|
Shriyash
Sungazer
Premium
join:2005-02-23
PuNe, InDiA
| Thanks Google.
»www.xp-vista.com/spyware-removal···rus-2008
»www.2-spyware.com/remove-antivirus-xp.html
»fix-computer-problem.com/rogue-a···rus.html
»www.bleepingcomputer.com/malware···-xp-2008
--
Skin colour is only skin deep.
Everybody wants to be Loved and give Love. |
|
Doctor Olds
I Need A Remedy For What's Ailing Me.
Premium,VIP
join:2001-04-19
1970 442 W30
clubs:
| reply to Lanik
XP Antivirus 2008 Removal Instructions (XP Antivirus 2008)
»www.windowsvistaplace.com/xp-ant···-removal
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time? |
|
La Luna
Surviving Ashraful
Premium
join:2001-07-12
Warwick, NY
clubs: | reply to goofy01
More on Antivirus XP:
»What is this Antivirus XP? |
|
Lanik
Lab-nik
Premium,ExMod 2002-03
join:2001-06-25
Bay Area | reply to Shriyash
I've already been through them guys, thanks.
I can't unregister these files shlwapi.dll, wininet.dll there is no unregister information.
--
"If it ain't broke don't fix it." |
|
Lanik
Lab-nik
Premium,ExMod 2002-03
join:2001-06-25
Bay Area | reply to La Luna
That did it thanks.  |
|
RedXII1234
Premium,Mod
join:2001-02-26
localhost
edit:
July 1st, @02:04AM
| reply to goofy01
It wasn't a limited account if it could place a shortcut outside the limited account; and hijack your desktop, if you mean it prevented you from making changes.
Or not using NTFS. |
|
goofy01
join:2004-02-05
Hammond, IN | reply to goofy01
Wrong Red. When this one hit me, it placed the icon in the shared desktop folder, so this icon came up on all users desktops. It didn't hijack the backgrounds on all users though, just on the one that was logged in. |
|
