Windows update virus

[devonwoody]

Our daughter got hit by the windows update virus last week.(computer refused to shut down).

I have got a new icon on my screen taskbar. A shield with an ! mark stating windows update required. I am refusing to open it.
Any information on this forum?

 

[DaveL]

So what AV software are you running and what is/was your daughter using?
Is it up to date?
Do you know what the virus was called?

 

[devonwoody]

So what AV software are you running and what is/was your daughter using?
Is it up to date?
Do you know what the virus was called?

I'm running Norton internet security 2006.
The actual name of the virus is unknown to me but was reported on the BBC yesterday morning at the 6.45am program.
Daughter has the same AV.

I ran a virus update and virus scan.
The icon is still there.

 

[devonwoody]

I just did a google search and got this link.

http://news.bbc.co.uk/1/hi/technology/3220887.stm

Called Sober.

 

[RogerS]

John

Look at the date of the news item! 2003...so I don't think that it is Sober.

This from a quick Google...

Web users are being warned to watch out for a fake Microsoft security update circulating as an email.

The hoax message directs users to a bogus website that claims to host critical security updates.

However, anyone downloading from the site will have a virus installed on their desktop that opens a backdoor into their computer. Criminals can then exploit the opening and gain access to private information.

Users are advised to ensure they visit legitimate sites when downloading updates and to type in the name of websites they are trying to reach rather than using hyperlinks, which can mask spoof websites.. The latest virus installs the DSNX-05 Trojan on unsuspecting web users' computers.

Anti-virus firm Sophos said the email, which uses the subject lines "Urgent Windows Update" and "Important Windows Update", contains a web link that looks as though it should direct users to the Windows Update website. The link, in fact, redirects people to a site controlled by the malicious hackers.

"Users must be very careful to be sure they are going to the official update websites, rather than just following links in emails which have been sent by hackers," said Graham Cluley, senior technology consultant at Sophos.

Microsoft has stressed that it only sends emails about security updates and incidents to those that have explicitly requested them and never sends out information before its website has been updated with information about security problems.



Which suggests that it was email born and your AV should have picked it up since, again, this news item is very old.

Your icon is telling you that you have an update from the Microsoft site via the normal update process so you should be safe....right click and choose custom ...that will list the updates waiting to be applied.

 

[Chris Knight]

There was a pretty buggy update last month from M$ but it wasn't a virus. It stopped a number of things working properly as I found out. Workarounds were published by various folk in a couple of days and better patches were issued by M$ themselves. Chances are what you have is perfectly OK to install.

If you check "Custom" install it will tell you what it wants to install. You can Google for these and check they are kosher. Chances are, it's the "Windows Genuine Advantage" thingy.

 

[RogerS]

Chances are, it's the "Windows Genuine Advantage" thingy.

Seem to remember reading somewhere that it's not a good idea to install this one...

 

[devonwoody]

Thanks all.

I'll have a go at the custom install and hopefully I wont evaporate from the forum!

Fortunately I never received any email update just get this pop up from the taskbar, which has never been seen my me before.

 

[Shady]

DW - Don't!

If it says 'windows update required', it's almost certainly some sort of virus/spam thingy. The 'genuine advantage' software from windows comes in like all the rest of their stuff - you'll get the yellow shield, but it will normally just advise that 'updates are ready to be installed' (depending on your update settings). Posting this quickly in the hope that you see it before anything happens - good luck, whatever...

 

[devonwoody]

Shady,
You were just in time.

Thanks.

(doing nothing is a regular feature of my age)

 

[tibbs]

I have got a new icon on my screen taskbar. A shield with an ! mark stating windows update required.

Hi DW

That sounds like an alert from Norton Internet Security that you haven't run Windows Update recently (or else that its detected that new Windows Updates are available that you havent installed yet) - no doubt a consequence of you galavanting around the European countryside for weeks rather than paying homage to your PC every day - they really dont like it when you go off & ignore them :roll:

If you just run Windows Update or Microsoft Update in the usual way & install the critical updates then I expect the shield icon will disappear.

Richard

 

[devonwoody]

Thanks tibbs.

In the meantime I have just done a screen capture of the icon.
The one with a drawn black border. Any help?

 

[Shady]

That looks to me like the windows update shield - or an attempt at it - rather than the Norton AV stuff... I foolishly accepted one on my sons' machine about 4 months ago, and had to re-build the entire thing from scratch - it installed some very pernicious adware and redirection rubbish - at the time, I was in a hurry, saw the 'windows' shield, and moved my mouse over it: it said something like 'urgent windows security centre', which, even as I clicked on it, I thought 'hmm, that's poor english for a big firm like MS'. By then it was too late.

As I say, I may be wrong, but - to my knowledge - none of the stuff that is 'real' windows comes out with 'urgent' in it - their only rating is 'critical' or 'other' updates, and they should simply offer advice along the lines of 'new updates have been downloaded/are ready to be installed'. I'd be very wary, and tempted to delete the file without further ado: if it really is a windows update, it'll just reappear in due course, after all...

(edit - try an anti spyware program like spybot S&D - free download, and it'll catch some stuff that Norton doesn't... Off to work now, I'll re-read this once there - hope it helps).

 

[RogerS]

John

I have that shield on my system whenever windows wants to offer me an update. Some of their recent updates have changed the presentation which might explain why you've never seen this icon before OR you had the "automatically please install all your dross, Microsoft" option ticked in which case you'd not see this either. if you then unticked this option...to give you more control over your PC...then that would explain the icon.

Another example is that in the Turn Off window, if you have some updates pending then the Turn Off icon also has a wee little shield showing and they try very hard for you to install before switching off.

So I reckon you're OK to instal

Roger

 

[Shady]

John

I have that shield on my system whenever windows wants to offer me an update. Some of their recent updates have changed the presentation which might explain why you've never seen this icon before OR you had the "automatically please install all your dross, Microsoft" option ticked in which case you'd not see this either. if you then unticked this option...to give you more control over your PC...then that would explain the icon.

Roger - I agree with what you say - as far as it goes... People should just be aware that the clever little so and so's who are spreading some of these viruses (virii??) do make use of exactly that perception, and use the windows 'update shield' to get you -as I did - to click on it...

Check the language and 'tone' of the 'balloon message' when you hover your mouse over the shield - that may give a hint as to whether it's genuine or not.

 

[devonwoody]

Roll up, Roll up.

Place your bets.

Perhaps I had bett wait awhile, it might go away!

Thanks all again.

 

[devonwoody]

I have got a new icon on my screen taskbar. A shield with an ! mark stating windows update required.

Hi DW

That sounds like an alert from Norton Internet Security that you haven't run Windows Update recently (or else that its detected that new Windows Updates are available that you havent installed yet) - no doubt a consequence of you galavanting around the European countryside for weeks rather than paying homage to your PC every day - they really dont like it when you go off & ignore them :roll:

If you just run Windows Update or Microsoft Update in the usual way & install the critical updates then I expect the shield icon will disappear.

Richard

By the way whilst I was galavanting around Europe I had a lovely dream one night.

If anyone wants the details PM me.

 

[RogerS]

Shady - I agree with you but for that to happen the software/Java/Active x whatever has had to have got onto John's computer in the first place.

If John's not opened up any emails nor visited any dodgy sites ( [-X ) then I don't see how.

 

[Alf]

Okay, I may be dense as a lump of lead here, but is there any reason why DW can't go to Microsoft's site and update from there? Surely if it's a genuine update alert the shield will disappear?

Cheers, Alf

 

[devonwoody]

Alf,

I went there a couple of hours ago and microsoft advised I allow an update that installs critical updates.

I declined because I know there is an update knocking around that changes Windows media Player and does not now allow WMP to "save target" any longer. (I like to save music from midi sites)