FYI reemergence of a nasty Trojan "deepdive" disguises itself as "System Tool 2011"

[DainBramaged]

Great description on You Tube here

http://www.youtube.com/watch?v=XhUEGHi8AMQ


And it puts this awful background with crappy English on your computer




Malwarebytes removes it in safe mode, then you have to rescan in normal start up mode once it finds the Trojan.

Nasty fuckers. I just burned it out of a critical system here. Hidden in an image in an email, and the sender doesn't even know it was in there.

[democraticinsurgent]

1. I got this 2 weeks ago

Malwarebytes in safe mode was the only salvation. It blocks every executable file. Nasty indeed.

[ET Awful]

2. Yeah, one of the computers at work got that a week or two ago . . . I had to laugh at the

"could break your life!" though :).

[DainBramaged]

4. "could break your life!"

We had a great laugh at that, but this one was different from the fake anti-virus going around, Iobit 360 and Emco didn't get it which surprised me, but I found the file in safe mode and deleted it. Last time these guys were using files in Application data, now it's moved.

[Initech]

3. Coworker's computer caught it. Removing it was a pain in the ass.

[DainBramaged]

5. They moved it's hiding place

it's in the video for the rest of us geeks.

[Initech]

22. Most of the time you wind up doing a total reformat and that sucks.

[hobbit709]

6. I've removed this from about 5 computers in the last couple of weeks.

And talked about 4 more through it on the phone

[dkofos]

7. Malware , virus, and trojan free for 10 years.

Linux rules.

[AlabamaLibrul]

13. That just usually causes a schmegstorm in these sorts of threads

but hey, I'm posting from Ubuntu 10.10 dual booted with Crunchbang Statler, and my desktop is always my photos, not some hyped up rogue anti-spyware BS.

[ET Awful]

14. On my personal computers, I've been malware, virus and trojan free since I bought my first one.

And they've all been Windows PC's.

The only time I have to clean anything of the sort is off of other people's machines.

[ikri]

8. Removed it from about 6 PCs already

Piece of piss to get rid of - restart in safe mode & delete the folder in the C:\Users\All Users\ folder with the glaringly obvious random string of letters & numbers, reboot & do a full AV scan.

1 guy at work got it on 3 different computers (his, his wife's & his son's), the only thing they all seem to have in common though is that they'd all recently visited facebook, otherwise there were no similarities in their browsing behaviour. I'd guess that it gets dropped by a rogue script or advert on facebook (at least in the cases I've seen).

What's really bad though is that all the computers had antivirus running, none of them were the usual expired OEM install of McAfee or Symantec crap. All the antivirus software was up to date but they still managed to miss the initial infection.

[formercia]

9. I remember this one.

After 'getting rid of it.', I created another user account to make sure. It was a pain.

[DainBramaged]

10. What bothers me is that some of us knew about this and said nothing to DU.....

And when I do these PSA's I get shit most of the time.


I do not understand the lack of information being spread about important shit like this.


Meh meh and meh.

[ET Awful]

16. In all honesty, for me, cleaning this stuff is routine at work, so it never even

occurs to me to post anything about it here.

[DainBramaged]

19. It's what I do also, but I never hesitate to post (check my journal)

Maybe it's the way I feel about Du that makes me care about this shit.

[toddwv]

11. Just removed that from my niece's computer.

It pretty much shuts everything down, no internet etc...

[DainBramaged]

12. Kick for those who aren't geeks.

and don't get to remove this from 4 or 5 computers a week.

[walldude]

15. Oh shit. Spy Sheriff all over again...

I hate these. The really fuck up your system. Kill your admin rights, disable msconfig, disable right clicking, disable system restore, if I weren't a power user trojans like this would have knocked me out a couple of times...

[ET Awful]

17. As a PSA that fixes this and many other infections . . .

I recommend Combofix.

It is updated pretty much daily and I have yet to encounter something it couldn't clean when used properly.

[DainBramaged]

18. Takes too long, once you know where it hides, zap in safe mode

or MWB in safe mode.


And it amazes me people are unreccing this, DU is certainly pushing my 'end help' button.

[Egnever]

21. last time I checked

Combofix doesnt work on vista or 7 that may have changed though I havent checked in a while. This thing is ridiculously easy to get rid of though Combofox is overkill for this one IMHO.

[Egnever]

20. This thing is a joke as far as removal

its freakishly easy to get rid of but thanks for the video I am sure it wil help many. I almost feel bad charging people to remove this thing its so easy.