"Possible" virus on Photobucket

L

lostsoulal2

Messages
1,336
Edit My Images
Yes
Last night my computer got infected with a Fake Antivirus program - at the time of the infection I was only on Photobucket and TP and was trying to put up a thread on TP linking photo's back to Photobucket.

I kept on getting messages, saying my PC was infected (running Windows XP) and a scan started itself even though I did not click on anything - I just tried to close the IE tab down as I did not recognise the pop-up that was warning me of the virus.......... A google search showed that "Antivir Solution Pro is a rogue anti-spyware application from the same family as AV Security Suite and Antispyware Soft"

I followed the instructions online to remove the virus and then eventually did a system restore to the previous day just to be sure.

But this morning, going back onto Phoptobucket to complete my TP thread, the same Fake virus warnings kept on appearring - I had merely logged onto my Photobucket account and within about 60 seconds the fake Virus Program appearred.

I said this was a 'possible' Photobucket virus, as having been infected twice when just visiting Photobucket does appears to be some proof - I have also tried just visiting other sites and there were no issues, but am asking here if any one else has been infected via this route or could there be any other explanantion?

Regards

Roy

ps - I normally use the Windows Firewall, plus AVG (free) and periodically run SuperAntispyware, CCcleaner, Spybot and Malwarebytes - Anti Malware etc, and apart from Adware tracking cookies, nothing is ever found - all drivers and service packs are fully up to date.
 
mattyh said:
It's most likely an advert on PB, rather than PB themselves I'd guess- pretty sure it's happened before too, actually!
Click to expand...

Thanks Matt,

I did a Google search this morning and found some references to it occurring earlier this year.

This morning when I went on Photobucket, apart from signing into my account, I did no browsing or clicking and still the infection occurred. Presumably the action of just going to the site was enough to trigger the virus from within the advert?

Roy
 
I very much doubt if it is an advert.

What happens if you (re-boot first) open your browser and visit another web site other than photobucket?
 
2blue4u said:
I very much doubt if it is an advert.

What happens if you (re-boot first) open your browser and visit another web site other than photobucket?
Click to expand...

Thank John,

Rebooting, starting up IE and browsing other sites is fine, nothing has happened, but its happened twice browsing via Photobucket now and am somewhat loathe to return.

Regards

Roy
 
This is a particularly nasty virus.

If you are infected there's some information about how to get rid on this thread from a Sunderland AFC message board I use.
 
Before running any 'removal tools' consider turning off 'system restore points'
as the problem could remain there & be activated on reboot.
 
That virus is one of the reasons I binned Windows Vista and switched to Linux.

It disguises itself as a Java update. The speech bubble pops up and everything looks kosher with the Java update until it opens up the fake security centre.

It opens up instances of AV.EXE every time you try to access the internet and it redirects all traffic to certain websites. It is also a keystroke logger so be careful with passwords and the like.

I just wiped the hard drive and installed Ubuntu Lucid Linux. Much better :D
 
AB22 Easy Tiger said:
This is a particularly nasty virus.

If you are infected there's some information about how to get rid on this thread from a Sunderland AFC message board I use.
Click to expand...

snoop69 said:
Before running any 'removal tools' consider turning off 'system restore points'
as the problem could remain there & be activated on reboot.
Click to expand...

Thanks for the advice guys, although it appears I have sort of doing the "right things", they may have been out of sequence, although the advice found on the internet does vary in what order the removal process should be.

What I did was I note the time I got infected last night (20.03), so after using the Malwarebytes cleaner, I then restored the PC to a restore point from the previous day and then reran the Malwarebytes cleaner which found nothing. Hopefully that was the correct order.

Regards
 
I was going to say, I've only ever had one virus, and it was a real nasty b****r that normal anit-virus/spyware couldn't touch.

3 hours scanning with Malwarebytes sorted it out :)
 
I thought I had cracked my virus issue............... Wrong!

I reran Malwarebytes in safe mode earlier today, which took a couple of hours, but it found nothing……

But at exactly the same time as last night 20.03 - I noticed a small pop up appear in the task bar that was obviously pretending to be a Java update (as mentioned by –Halli- above) and thereafter was invited to run a virus scan in the Fake security centre.

So it seems that Malwarebytes missed this one (or I ran everything in the wrong order).

- I saw that a copy of svchost.exe was acting strangely (higher than normal CPU activity) and noticed that using Google Chrome, my Google searches were being redirected to other Internet sites and that through TCP/IP the PC was attempting to connect to other websites.

I then checked what programs were set to auto start and saw a program I did not recognise called “ocuko.exe” (could not find any info on this online) which was set to auto run every-time the PC started. I managed to finally disable it, although it took a few attempts, which makes me think there may be something else lurking around, so will have to monitor my PC very carefully in the short term.

Having spoken to my nephew, he has also experienced something similar recently and from our discussions it seems that Photobucket may not be the culprit, but we think that the malware / virus is hidden inside a banner on a website which is downloaded and then some time later gets activated, in my case at 20.03. Because of this delay, it becomes difficult to track down where it was picked up from – it just happened at 20.03 I was only using Photobucket.

Computers and Viruses, Grrrrrrgh!
 
bin AVG, its let a few nasties through for me before.

i use MS security essentials on the work laptop and avast on my personal stuff, MSSE is a little heavier, avast is very lightweight and probably a little better overall in my opinion.
 
neil_g said:
bin AVG, its let a few nasties through for me before.
Click to expand...

I was running a fully updated of Symmantec and it let it through. Nothing about it on the Symmantec website and they then went on to say it wasn't a problem and they weren't going to be addressing the matter when I emailed them!
 
The last time I had to fix a friend's computer suffering a Trojan, which is what I think this is, I had to reinstall the system. Malwarebytes and the like just don't cut the mustard.
 
lostsoulal2 said:
........... I managed to finally disable it, although it took a few attempts, which makes me think there may be something else lurking around, so will have to monitor my PC very carefully in the short term.

............QUOTE]

If it was me, it would be a complete reformat and reinstall jobby.
Click to expand...
 
For what it is worth my anti virus software picked up a threat on Photobucket this morning - it told me the threat had been blocked.
 
For SVChost stuff, look in the registry, HKLM\software\Microsoft\Windows NT\CurrentVersion\SVCHost

Look at the netsvcs entries, the last one should probably be hkmsvc If some thing's fired in as a service it's probably here.

You can copy and paste the entries into notepad to keep the list, just in case.

Also run msconfig and take a look at your startup options. Untick anything you don't really need.

We've had a couple of virus infections that install themselves into the scheduler and start at a given time later. If you don't take these jobs out they fire off to the internet sometime later (in our case 7 days) and download the infection again. Check your scheduled tasks (start, programs, accessories, system tools)
 
tbh, even after I had repaired my virus, I backed everything up, formatted and reinstalled :)

It's the best way of being safe :)

And, it's a hell of a lot quicker than spending hours running around with virus checkers, editing registries etc.
 
The Fatbirder website has had similar problems caused by an open-source ad server - openX. Any site using the same resource is probably causing the same problems to its users.

Firefox and NoScript seems to have kept it away from my machine.
 
Fingers crossed, I may have cracked it - well “I” is the wrong word, as all I have done is to use all the various antivirus programs available, but some picked up on certain issues and missed others.

I tried to download Microsoft Security Essentials, but the virus blocked it as it did with other AV programs when trying to get updates – I am not too sure which program broke the cycle, but a combination of Spybot, Hitman Pro (free for one use), CC cleaner and Malwarebytes, and although AVG missed the virus being installed, it did manage to later find and delete 3 Trojans and one virus. Then using Hitman that detected a rootkit virus.........

Finally I was able to install Microsoft Security Essentials and initially it gave me a clean bill of health...........Hmm, but I could see or I thought that my PC was still communicating with other sites when it should not have been. MSE then later popped up a message and said it had detected a Password Stealer and then it delected the "fake Virus" Trojan. But bizarre how each AV program picked up only certain elements.

So a combination of products, appears to have got me running again, but its still early days and I am now paranoid about what my PC is connecting to - checking on this it seems that Microsoft / IE / Google Chrome all connect to a wonderful variety of sites all with strange names/web addresses to further worry me - no doubt to track what we are all doing on the Internet!

I would as mentioned above considered reformatting the hard disk and reinstalling everything, but it would take me ages to do this as I have a large variety of software installed, plus I may not have all the original/update software discs easily to hand, well I know for a fact some are not filed away correctly.......... and may have been buried under a pile of papers/magazines etc. And then there are those programs you can only download. As we have a slow broadband connection, I probably would have lost the will to carry on.

Anyway back to basics, I am now not sure where I got this virus from, may have been Photobucket, but could in reality have been anywhere as other sites appear also to have been compromised.

But what it has shown me is that your PC can still become infected even though you have AV programs installed, as from this experience, there did not appear to be one program that caught everything.

Thanks to all for the advice received. Very grateful.

Roy
 
Mmm . . . Just had the problem flagged up by AVG . . . Serious!!! AVG "blocked the page for my protection"!

I presume Photobucket will get onto this? However any one got an alternative hosting site they might suggest. Tried a couple a long while ago, they were very complex 'to simple me':thinking: dont like 'Flikr'!!!

Suggestions please?

CJS
 
Chaz Photos said:
Look guys its not a virus It script on the web site that runs when you open the page... You can stop this with the right settings on your pc.
You are not infected.
Click to expand...

could you explain please? - what settings?



are these infections occurring when logged into the PC as an administrator or as a standard (restricted) user ?
 
Wookie said:
Are these infections occurring when logged into the PC as an administrator or as a standard (restricted) user ?
Click to expand...

I only have the one account, so I am logged in as the Administrator.......

CJS said:
Mmm . . . Just had the problem flagged up by AVG . . . Serious!!! AVG "blocked the page for my protection"!

I presume Photobucket will get onto this? However any one got an alternative hosting site they might suggest. Tried a couple a long while ago, they were very complex 'to simple me':thinking: dont like 'Flikr'!!!

Suggestions please?

CJS
Click to expand...

So it could be the source of the issue was Photobucket? - who I guess will do something if they are alerted to the problem. (I am loathe to return just in case I get reinfected)

There are various image hosting sites, but to be honest I found Photo bucket was one of the simplest to use and had less restriction. Imageshack seems favoured by some as does Fotopic and Flickr to name a couple of alternatives.

You can of course use the TP Gallery feature, but it does have a restriction in my view that you can only upload 3 photos at a time.

Regards
 
Wookie said:
could you explain please? - what settings?



are these infections occurring when logged into the PC as an administrator or as a standard (restricted) user ?
Click to expand...

Have you ever visited a site to have a pop up appear saying "you have a virus, click here to clean your PC".

It can be blocked by installing adblocker or other plugins that are designed to block adverts popping up. Although I would be highly surprised to find anyone falling for it and thinking they actually had a real virus.
 
Harvey_nikon said:
Have you ever visited a site to have a pop up appear saying "you have a virus, click here to clean your PC".

It can be blocked by installing adblocker or other plugins that are designed to block adverts popping up. Although I would be highly surprised to find anyone falling for it and thinking they actually had a real virus.
Click to expand...

I have an ad blocker installed, I never, never fall for the Photobucket, "you have won . . . " what ever?

As has been said, I'm not going back to PB for a while, I suspect PB will get the massage when they see their hit rate fall?

CJS
 
not seen that sort of popup for a while, but we've hopefully got a lot of effective security running and they should be killed before I see them

I was more worried by the idea that a banner or web page could infect the PC just by being displayed, and if so if I'm missing any tricks in preventing it happening.
 
So, when are we likely to know when PB fixes it if we are not prepared to go to the PB site? . . . if they do fix it that is???

Looks like Flickr might be the only practical solution:gag: Have Flickr don their worst? . . . :shrug:

CJS
 
I read through the ebay forum link given above and it seems that Photobucket have previously replied to users and taken action as the thread was for the period Jan to March of this year.

But obviously the issue has re-appeared, it seems that you can get infected by either hovering over an image or by inadvertently clicking on the small "x" to close a dialogue box - which obviously is just another trigger to start the Fake Virus scan. Reading the thread it appears that both IE and Firefox users have been infected, Google Chrome seemed to be immune, although my experience is that you cannot upload photos using Chrome.......

I have emailed Photobucket to alert them using their Contact us Page (appears to be virus free) and will update the thread if I get a response from Photobucket - but the more people that report the issue will increase our chances of getting a reply.

Regards

Roy
 
You must log in or register to reply here.
Back
Top