Redirects to PAV scams

[JamesV]

You get a popup in IE saying your computer is infected with a virus. Can't close IE, only click Ok.

But, I recognize this as a 'paid antivirus' scam. You click Ok and get to purchase some software that will fix your system.

End task all IE entries and scan all tasks and services for anything unusual. Check IE add-ons. Check Windows logs. Run MSE and Malwarebytes, find nothing. Search Google for the scam URL (protectmyPC.pl nonsense) and other keywords relating to my issue - nothing.

Sift through services, search in the registry; everything seems to be a dead end.

This happened twice in the last two days, followed by everything I've written above. My homepage is DailyTech, and each time this happened, was when I 'opened in a new tab' a news article.

My last virus was a good 10 years ago; I run virus/firewall religiously, along with weekly scans, and alternatives (malwarebytes) on top of that. I'm used to the signs of infections, whether they be from malicious Javascript to full blow Trojans (from my 'the tech guy' status - everyone calls me)... but I'm stumped.

An exploit in the current version of Flash maybe? Hooking into ad-services maybe? I could use some advice... I don't think I'm infected, and I doubt Dailytech is either... I'm not exactly a security expert, but I know what to look for when something is fishy... until now.

 

[mechBgon]

Malvertising, probably. The site itself could also have been subverted. Those things are annoying, but that type's generally only as harmful as you are click-prone It's never a bad time to review your security game, though... if you haven't done so lately, here's a few thoughts:

1. unless you really need Java for something, uninstall it if it's installed on your system. Lots of Java exploitation out there.

2. glance through your installed software in Control Panel and remove anything else that you have no need for.

3. make sure your Windows Update has been upgraded to Microsoft Update. This is the "get updates for more Microsoft software yadda yadda" you'll see in your Windows Update panel if you haven't upgraded to MU. I think installing MSE will do this automatically.

4. run the Secunia Personal Software Inspector to look for missing security patches on your software. http://secunia.com/vulnerability_scanning/personal/

5. install and configure EMET 3.5, info here: http://forums.anandtech.com/showthread.php?t=2260200

6. max out UAC if you have Vista or Win7. That's the slider in Control Panel > User Accounts And Family Safety > User Accounts > Change User Account Control Settings.


If you want to take it a step further, you can set up a simple payload-killing interlock.

1. make your daily-driver Windows account a Standard User, not an Administrator. If it's the only account on the system, create a new Admin-level account so you can demote your daily-driver to Standard User.

2. use the Parental Controls feature in Windows and enforce program limitations on your daily-driver account. Whitelist all the existing software on your system. Anything new will get arbitrarily blocked until you OK it at the Parental Controls prompt. So for example, if a Flash exploit is used to dump a new executable onto your system and attempts to execute it, that'll be a big FAIL.

The industrial-strength version of this is a Software Restriction Policy, which can be done on the Pro and Ultimate levels of Windows.

 

[Raizinman]

Start the computer in SAFE mode. (I believe F5 while starting will do this).
Then go to START, PROGRAMS, ACCESSORIES, SYSTEM TOOLS, SYSTEM RESTORE.
Pick a date prior to PAV program was installed.
Restart Computer and all should be well.