Updates infected with "Antivirus Soft" virus?

1. New Toshiba Laptop, formatted hard drive
2. Installed Basic Toshiba drivers: Chipset, LAN, WAN, Audio
3. Connected to Wireless Network
4. Run Microsoft Update up to the point where it says do I want to activate
my license
5. Then I let Automatic Updates download and install the updates (don't have
to activate when Automatic Updates does the work for me.)
6. This pc still has XP PRO SP2
7. Downloaded 64 updates
8. Rebooted and the "Antivirus Soft" virus came up, basically locking up all
my exe files.

I've scanned everything and the virus has not been found on any of my media.
I triple checked every file with Symantec's Endpoint Protection 11.0.5, and
Microosft Security Essentials (current) and Malwarebytes. Nothing. I even
decompressed each install file from Toshiba and checked every file on the PC
after the installers ran.

Nothing.

Is it possible Microsoft Update is infected with this virus? I know, remote.

The virus infected my computer after installing the first round of updates
via Automatic Updates which there were 64 updates to download and install
including IE8 and its updates.

After the restart, Antivirus Soft took over and disabled everything.

Thanks.

You are asserting that this system never visited any web sites except
the Microsoft Update site. The only way it could have become compromised
is if there was *no* firewall turned on, which is NOT the case with XP
SP2's Default installation settings, and it was exploited by using a DNS
or SMB vulnerability.

In the steps you've listed, where was Windows XP Pro SP2 installed as
it's not listed ?

> 1. New Toshiba Laptop, formatted hard drive
> 2. Installed Basic Toshiba drivers: Chipset, LAN, WAN, Audio
> 3. Connected to Wireless Network
> 4. Run Microsoft Update up to the point where it says do I want to activate
> my license
> 5. Then I let Automatic Updates download and install the updates (don't have
> to activate when Automatic Updates does the work for me.)

The above is IMPOSSIBLE without installing a Windows OS.
Also, an *XP* system would *have* to visit the Windows Update site first
in order to opt into the Microsoft Update site.

And, you are prompted to Activate Windows during the installation
process, NOT when visiting Windows Update. When visiting WU the system
needs to be Validated by passing WGA.

> 6. This pc still has XP PRO SP2

OK, so when was that installed as it's not listed as any of your
previous steps ?

Rogue AVs, such as Antivirus Soft, are *installed* through User
Intervention. The fake scans that the rogues show are presented to the
User via javascript.

Said rogue AVs will only infect the system when the *User agrees to
install it*, *clicks* the Cancel or OK buttons, BUT *not* when it's
running it's fake scan. Said fake scans are there to Socially Engineer (
scare; frighten; or entice ) the unknowing User into thinking that their
systems are infected.
If the User end tasks the browser's executable, the system will NOT be
infected.

> I've scanned everything and the virus has not been found on any of my media.
> I triple checked every file with Symantec's Endpoint Protection 11.0.5, and
> Microosft Security Essentials (current) and Malwarebytes.

Microsoft Security Essentials will NOT install in Windows XP until the
system has been Validated, which you claim hasn't taken place.

Something is either really fishy here or you've omitted some *vital*
details, either on purpose or accidentally.

Care to fill us in on all the details or should we start guessing ?


MowGreen
================
*-343-* FDNY
Never Forgotten
================

banthecheck.com
"Security updates should *never* have *non-security content* prechecked



Wattsfan wrote:
> 1. New Toshiba Laptop, formatted hard drive
> 2. Installed Basic Toshiba drivers: Chipset, LAN, WAN, Audio
> 3. Connected to Wireless Network
> 4. Run Microsoft Update up to the point where it says do I want to activate
> my license
> 5. Then I let Automatic Updates download and install the updates (don't have
> to activate when Automatic Updates does the work for me.)
> 6. This pc still has XP PRO SP2
> 7. Downloaded 64 updates
> 8. Rebooted and the "Antivirus Soft" virus came up, basically locking up all
> my exe files.
>
> I've scanned everything and the virus has not been found on any of my media.
> I triple checked every file with Symantec's Endpoint Protection 11.0.5, and
> Microosft Security Essentials (current) and Malwarebytes. Nothing. I even
> decompressed each install file from Toshiba and checked every file on the PC
> after the installers ran.
>
> Nothing.
>
> Is it possible Microsoft Update is infected with this virus? I know, remote.
>
> The virus infected my computer after installing the first round of updates
> via Automatic Updates which there were 64 updates to download and install
> including IE8 and its updates.
>
> After the restart, Antivirus Soft took over and disabled everything.
>
> Thanks.

Where did this version of XP SP2 come from? Did this ship with your laptop
or did you acquire it 'elsewhere'?

--


"Don't pick a fight with an old man.
If he is too old to fight, he'll just kill you."


"Wattsfan" <> wrote in message
news:9E2255AB-3402-43FA-AE7D-...
> 1. New Toshiba Laptop, formatted hard drive
> 2. Installed Basic Toshiba drivers: Chipset, LAN, WAN, Audio
> 3. Connected to Wireless Network
> 4. Run Microsoft Update up to the point where it says do I want to
> activate
> my license
> 5. Then I let Automatic Updates download and install the updates (don't
> have
> to activate when Automatic Updates does the work for me.)
> 6. This pc still has XP PRO SP2
> 7. Downloaded 64 updates
> 8. Rebooted and the "Antivirus Soft" virus came up, basically locking up
> all
> my exe files.
>
> I've scanned everything and the virus has not been found on any of my
> media.
> I triple checked every file with Symantec's Endpoint Protection 11.0.5,
> and
> Microosft Security Essentials (current) and Malwarebytes. Nothing. I even
> decompressed each install file from Toshiba and checked every file on the
> PC
> after the installers ran.
>
> Nothing.
>
> Is it possible Microsoft Update is infected with this virus? I know,
> remote.
>
> The virus infected my computer after installing the first round of updates
> via Automatic Updates which there were 64 updates to download and install
> including IE8 and its updates.
>
> After the restart, Antivirus Soft took over and disabled everything.
>
> Thanks.

Thank you for response. I've installed clean OS's at least 200 pcs, xp, vista
and currently windows 7. A lot of experience in installing but perhaps not in
explaining because this is the first time I've been hit by a virus during a
pc setup. This is why I posted the question and I will respond as follows. I
am not leaving anything out. I need to figure this out.

WHAT I DID

1. New Toshiba Laptop
2. New Seagate harddrive
3. Installed XP Pro OEM SP2 from a clean CD. Formatted the new seagate drive
with NTFS
4. Entered my product id
5. Put in USB stick (which was already scanned with antivirus softwarwe many
times over) and copied over to the seagate drive the Toshiba drivers to the C
drive. The drivers and usb stick have been scanned with Norton Internet
Security Version 10, McAfee Online Scanner, Symantec SEP 11.0.5,
MalwareBytes, Microsoft Essential Security, and Bitdefender Online Scanner. I
have a main machine that scans via Virtual Machines and several XP
Partitions. A workhorse desktop. This is where I scanned with Microsoft
Security Essentials, on the workhorse machine BEFORE copying over the Toshiba
drivers to the new pc. You are right, cannot install Microsoft Security
Essentials on a machine that is not validated. I also scanned the drivers on
the virustotal website from my workhorse desktop. No viruses found.
5. Installed from manufacturer's website, the WIFI driver from the USB stick
to the C drive.
6. NO WEBSITES VISITED yet on the new Toshiba. Have not opened Internet
Explorer on the new Toshiba.
7. Connected to my internal wireless network
8. Opened Internet Explorer (which is version 6 at this point) since this is
still SP2
9. When to Windows Updates and installed all the updates up to the point
where the Microsoft page says that in order to get anymore updates I need to
activate my pc.
10. I don't activate until I know the pc is stable and working. And yes, a
WGA message pops up reminding me to activate.
11. I let Automatic Updates run (via the control panel) at that time and the
updates will download and install without activation. You have to activate
Windows if you hit the EXPRESS buttton in Internet Explorer. I also use
Microsoft Update, not Windows Update. I run the active-x controls needed for
Microsoft Update.
12. Updates start to download and install on the new hard drive, at this
point 64 updates need to download and install. Part of these updates are IE8
and WGA. SP3 presents itself later.
13. I downloaded the 64 updates and restarted
14. "Antivirus Soft" launches and all my executibles are disabled. Have to
reformat the Seagate drive again on the Toshiba.

HOW I CHECKED FOR VIRUSES/MALWARE

1. I checked my USB flash with my main desktop's Antivirus which is Symantec
SEP 11.0.5. the latest and also MalWareBytes. No viruses found.
2. I checked the Toshiba drivers with my main desktop Symantec SEP 11.0.5
and Malwarebytes. No viruses found.
3. I booted off another partition on my main pc that has the consumer
version of Norton Internet Security 10 and scanned my C drive and the USB
stick. No viruses found.
4. I opened a virtual machine with Microsoft Security Essentials and scanned
all the files from the USB stick and the Toshiba drivers. No viruses found
5. I opened a virtual machine with McAfee online scanner. No viruses found
on the usb stick or Toshiba drivers.
6. Opened up a virtual machine with BitDefender. Scanned everything again.
No viruses found.
7. Scanned C drive and USB stick with Malwarebytes from a virtual machine.
No viruses found.
8. Submitted all the toshiba drivers (downloaded from toshiba's website,
verified the page sources) to virustotal.com. No viruses found.

The only software that downloaded to the new Toshiba were the 64 updates
done via the Automatic Updates in the Control Panel. These updates were not
checked by an antivirus because I did not have an antivirus loaded yet on the
new Toshiba seagate drive.

Normally, you can install even SP3 without activation. Do it all the time.
But I don't run the updates in Internet Explorer


Thank you.

Wattsfan
"MowGreen" wrote:

> You are asserting that this system never visited any web sites except
> the Microsoft Update site. The only way it could have become compromised
> is if there was *no* firewall turned on, which is NOT the case with XP
> SP2's Default installation settings, and it was exploited by using a DNS
> or SMB vulnerability.
>
> In the steps you've listed, where was Windows XP Pro SP2 installed as
> it's not listed ?
>
> > 1. New Toshiba Laptop, formatted hard drive
> > 2. Installed Basic Toshiba drivers: Chipset, LAN, WAN, Audio
> > 3. Connected to Wireless Network
> > 4. Run Microsoft Update up to the point where it says do I want to activate
> > my license
> > 5. Then I let Automatic Updates download and install the updates (don't have
> > to activate when Automatic Updates does the work for me.)
>
> The above is IMPOSSIBLE without installing a Windows OS.
> Also, an *XP* system would *have* to visit the Windows Update site first
> in order to opt into the Microsoft Update site.
>
> And, you are prompted to Activate Windows during the installation
> process, NOT when visiting Windows Update. When visiting WU the system
> needs to be Validated by passing WGA.
>
> > 6. This pc still has XP PRO SP2
>
> OK, so when was that installed as it's not listed as any of your
> previous steps ?
>
> Rogue AVs, such as Antivirus Soft, are *installed* through User
> Intervention. The fake scans that the rogues show are presented to the
> User via javascript.
>
> Said rogue AVs will only infect the system when the *User agrees to
> install it*, *clicks* the Cancel or OK buttons, BUT *not* when it's
> running it's fake scan. Said fake scans are there to Socially Engineer (
> scare; frighten; or entice ) the unknowing User into thinking that their
> systems are infected.
> If the User end tasks the browser's executable, the system will NOT be
> infected.
>
> > I've scanned everything and the virus has not been found on any of my media.
> > I triple checked every file with Symantec's Endpoint Protection 11.0.5, and
> > Microosft Security Essentials (current) and Malwarebytes.
>
> Microsoft Security Essentials will NOT install in Windows XP until the
> system has been Validated, which you claim hasn't taken place.
>
> Something is either really fishy here or you've omitted some *vital*
> details, either on purpose or accidentally.
>
> Care to fill us in on all the details or should we start guessing ?
>
>
> MowGreen
> ================
> *-343-* FDNY
> Never Forgotten
> ================
>
> banthecheck.com
> "Security updates should *never* have *non-security content* prechecked
>
>
>
> Wattsfan wrote:
> > 1. New Toshiba Laptop, formatted hard drive
> > 2. Installed Basic Toshiba drivers: Chipset, LAN, WAN, Audio
> > 3. Connected to Wireless Network
> > 4. Run Microsoft Update up to the point where it says do I want to activate
> > my license
> > 5. Then I let Automatic Updates download and install the updates (don't have
> > to activate when Automatic Updates does the work for me.)
> > 6. This pc still has XP PRO SP2
> > 7. Downloaded 64 updates
> > 8. Rebooted and the "Antivirus Soft" virus came up, basically locking up all
> > my exe files.
> >
> > I've scanned everything and the virus has not been found on any of my media.
> > I triple checked every file with Symantec's Endpoint Protection 11.0.5, and
> > Microosft Security Essentials (current) and Malwarebytes. Nothing. I even
> > decompressed each install file from Toshiba and checked every file on the PC
> > after the installers ran.
> >
> > Nothing.
> >
> > Is it possible Microsoft Update is infected with this virus? I know, remote.
> >
> > The virus infected my computer after installing the first round of updates
> > via Automatic Updates which there were 64 updates to download and install
> > including IE8 and its updates.
> >
> > After the restart, Antivirus Soft took over and disabled everything.
> >
> > Thanks.
> .
>

Original OEM SP2 CD.

"Michael" wrote:

> Where did this version of XP SP2 come from? Did this ship with your laptop
> or did you acquire it 'elsewhere'?
>
> --
>
>
> "Don't pick a fight with an old man.
> If he is too old to fight, he'll just kill you."
>
>
> "Wattsfan" <> wrote in message
> news:9E2255AB-3402-43FA-AE7D-...
> > 1. New Toshiba Laptop, formatted hard drive
> > 2. Installed Basic Toshiba drivers: Chipset, LAN, WAN, Audio
> > 3. Connected to Wireless Network
> > 4. Run Microsoft Update up to the point where it says do I want to
> > activate
> > my license
> > 5. Then I let Automatic Updates download and install the updates (don't
> > have
> > to activate when Automatic Updates does the work for me.)
> > 6. This pc still has XP PRO SP2
> > 7. Downloaded 64 updates
> > 8. Rebooted and the "Antivirus Soft" virus came up, basically locking up
> > all
> > my exe files.
> >
> > I've scanned everything and the virus has not been found on any of my
> > media.
> > I triple checked every file with Symantec's Endpoint Protection 11.0.5,
> > and
> > Microosft Security Essentials (current) and Malwarebytes. Nothing. I even
> > decompressed each install file from Toshiba and checked every file on the
> > PC
> > after the installers ran.
> >
> > Nothing.
> >
> > Is it possible Microsoft Update is infected with this virus? I know,
> > remote.
> >
> > The virus infected my computer after installing the first round of updates
> > via Automatic Updates which there were 64 updates to download and install
> > including IE8 and its updates.
> >
> > After the restart, Antivirus Soft took over and disabled everything.
> >
> > Thanks.
>

Hi Michael, It is an original OEM SP2 XP PRO CD. Used many times.

"Michael" wrote:

> Where did this version of XP SP2 come from? Did this ship with your laptop
> or did you acquire it 'elsewhere'?
>
> --
>
>
> "Don't pick a fight with an old man.
> If he is too old to fight, he'll just kill you."
>
>
> "Wattsfan" <> wrote in message
> news:9E2255AB-3402-43FA-AE7D-...
> > 1. New Toshiba Laptop, formatted hard drive
> > 2. Installed Basic Toshiba drivers: Chipset, LAN, WAN, Audio
> > 3. Connected to Wireless Network
> > 4. Run Microsoft Update up to the point where it says do I want to
> > activate
> > my license
> > 5. Then I let Automatic Updates download and install the updates (don't
> > have
> > to activate when Automatic Updates does the work for me.)
> > 6. This pc still has XP PRO SP2
> > 7. Downloaded 64 updates
> > 8. Rebooted and the "Antivirus Soft" virus came up, basically locking up
> > all
> > my exe files.
> >
> > I've scanned everything and the virus has not been found on any of my
> > media.
> > I triple checked every file with Symantec's Endpoint Protection 11.0.5,
> > and
> > Microosft Security Essentials (current) and Malwarebytes. Nothing. I even
> > decompressed each install file from Toshiba and checked every file on the
> > PC
> > after the installers ran.
> >
> > Nothing.
> >
> > Is it possible Microsoft Update is infected with this virus? I know,
> > remote.
> >
> > The virus infected my computer after installing the first round of updates
> > via Automatic Updates which there were 64 updates to download and install
> > including IE8 and its updates.
> >
> > After the restart, Antivirus Soft took over and disabled everything.
> >
> > Thanks.
>

"Wattsfan" wrote:

> Hi Michael, It is an original OEM SP2 XP PRO CD. Used many times.
>
> "Michael" wrote:
>
> > Where did this version of XP SP2 come from? Did this ship with your laptop
> > or did you acquire it 'elsewhere'?
> >
> > --
> >
> >
> > "Don't pick a fight with an old man.
> > If he is too old to fight, he'll just kill you."
> >
> >
> > "Wattsfan" <> wrote in message
> > news:9E2255AB-3402-43FA-AE7D-...
> > > 1. New Toshiba Laptop, formatted hard drive
> > > 2. Installed Basic Toshiba drivers: Chipset, LAN, WAN, Audio
> > > 3. Connected to Wireless Network
> > > 4. Run Microsoft Update up to the point where it says do I want to
> > > activate
> > > my license
> > > 5. Then I let Automatic Updates download and install the updates (don't
> > > have
> > > to activate when Automatic Updates does the work for me.)
> > > 6. This pc still has XP PRO SP2
> > > 7. Downloaded 64 updates
> > > 8. Rebooted and the "Antivirus Soft" virus came up, basically locking up
> > > all
> > > my exe files.
> > >
> > > I've scanned everything and the virus has not been found on any of my
> > > media.
> > > I triple checked every file with Symantec's Endpoint Protection 11.0.5,
> > > and
> > > Microosft Security Essentials (current) and Malwarebytes. Nothing. I even
> > > decompressed each install file from Toshiba and checked every file on the
> > > PC
> > > after the installers ran.
> > >
> > > Nothing.
> > >
> > > Is it possible Microsoft Update is infected with this virus? I know,
> > > remote.
> > >
> > > The virus infected my computer after installing the first round of updates
> > > via Automatic Updates which there were 64 updates to download and install
> > > including IE8 and its updates.
> > >
> > > After the restart, Antivirus Soft took over and disabled everything.
> > >
> > > Thanks.
> >

Wattsfan,

One possibility is that your wireless router might be compromised and
redirecting you to malicious websites. I'm not very familiar with the issues
involved so can't provide much advice, but one thing you could try is explicitly
configuring your DNS servers (your ISP should be able to provide you with this
information) rather than using the DNS service provided by the router.

Harry.

On 2010-03-04 10:36 a.m., Wattsfan wrote:
> 1. New Toshiba Laptop, formatted hard drive
> 2. Installed Basic Toshiba drivers: Chipset, LAN, WAN, Audio
> 3. Connected to Wireless Network
> 4. Run Microsoft Update up to the point where it says do I want to activate
> my license
> 5. Then I let Automatic Updates download and install the updates (don't have
> to activate when Automatic Updates does the work for me.)
> 6. This pc still has XP PRO SP2
> 7. Downloaded 64 updates
> 8. Rebooted and the "Antivirus Soft" virus came up, basically locking up all
> my exe files.
>
> I've scanned everything and the virus has not been found on any of my media.
> I triple checked every file with Symantec's Endpoint Protection 11.0.5, and
> Microosft Security Essentials (current) and Malwarebytes. Nothing. I even
> decompressed each install file from Toshiba and checked every file on the PC
> after the installers ran.
>
> Nothing.
>
> Is it possible Microsoft Update is infected with this virus? I know, remote.
>
> The virus infected my computer after installing the first round of updates
> via Automatic Updates which there were 64 updates to download and install
> including IE8 and its updates.
>
> After the restart, Antivirus Soft took over and disabled everything.
>
> Thanks.


--
Harry Johnston
http://harryjohnston.wordpress.com

Thank you, Harry.

I am looking at that. I use OPENDNS router numbers.

Another possibility is after I installed all the updates. I went on the
default home webpage which was msn.com and clicked on clicks on the top of
the MSN page. One of the pages requested I install the adobe flash player
which I did. Also, to test the stability of th enew system, I open all the
programs that come with XP PRO and I open all the games, including the
internet games included in XP PRO. I noticed today when I opened some of the
internet based games, there were ads on the games themselves. Is this normal,
ads on the games? I need to look at that.

Anyway, I tried to reproduce the virus today without success. Installed
every driver I had on the flash drive and no "Antivirus soft", which by the
way is very hard to remove. Even in safe mode.

I've had instances where Symantec Endpoint Protection 11.0.5 was not
catching some variants of "fake" adobe flash player updaters which present
themselves as .exe files and I know to avoid them.

I did install a flash player update from an MSN top page linked site. But
the update came through Internet Explorer like it always has.

I checked my router and the DNS numbers are hard coded.

I did open Media Player and I remember it going to a BRAVO based page with
the housewives movie playing and I think that is when the virus launched.

I can't duplicate the problem. I checked every disk and software piece I had
with several up to date antiirus/antimalware programs and nothing came up.
Norton Internet Security version 10 is pretty good at detection but no
viruses.

I know there are cases where a file is downloaded and it is not a virus.
Then the file launches, still undetected, then downloads a virus. At that
point, Symantec will catch it but it is too late, the pc is compromised.

If my router was compromised, my other pcs would also be infected. I think
they would be.

My wireless security is solid.

Thank you.


"Harry Johnston [MVP]" wrote:

> Wattsfan,
>
> One possibility is that your wireless router might be compromised and
> redirecting you to malicious websites. I'm not very familiar with the issues
> involved so can't provide much advice, but one thing you could try is explicitly
> configuring your DNS servers (your ISP should be able to provide you with this
> information) rather than using the DNS service provided by the router.
>
> Harry.
>
> On 2010-03-04 10:36 a.m., Wattsfan wrote:
> > 1. New Toshiba Laptop, formatted hard drive
> > 2. Installed Basic Toshiba drivers: Chipset, LAN, WAN, Audio
> > 3. Connected to Wireless Network
> > 4. Run Microsoft Update up to the point where it says do I want to activate
> > my license
> > 5. Then I let Automatic Updates download and install the updates (don't have
> > to activate when Automatic Updates does the work for me.)
> > 6. This pc still has XP PRO SP2
> > 7. Downloaded 64 updates
> > 8. Rebooted and the "Antivirus Soft" virus came up, basically locking up all
> > my exe files.
> >
> > I've scanned everything and the virus has not been found on any of my media.
> > I triple checked every file with Symantec's Endpoint Protection 11.0.5, and
> > Microosft Security Essentials (current) and Malwarebytes. Nothing. I even
> > decompressed each install file from Toshiba and checked every file on the PC
> > after the installers ran.
> >
> > Nothing.
> >
> > Is it possible Microsoft Update is infected with this virus? I know, remote.
> >
> > The virus infected my computer after installing the first round of updates
> > via Automatic Updates which there were 64 updates to download and install
> > including IE8 and its updates.
> >
> > After the restart, Antivirus Soft took over and disabled everything.
> >
> > Thanks.
>
>
> --
> Harry Johnston
> http://harryjohnston.wordpress.com
> .
>

What anti-virus application or security suite is installed, is your
subscription current, and when did you install it: Before or after visiting
Windows Update? What anti-spyware applications (other than Defender)? Has
a firewall been enabled at all times?

> Another possibility is after I installed all the updates. I went on the
> default home webpage which was msn.com and clicked on clicks on the top of
> the MSN page. One of the pages requested I install the adobe flash player
> which I did...

Maybe not. See
http://groups.google.com/group/micro...87fd9c8c07d067



Wattsfan wrote:
> Thank you, Harry.
>
> I am looking at that. I use OPENDNS router numbers.
>
> Another possibility is after I installed all the updates. I went on the
> default home webpage which was msn.com and clicked on clicks on the top of
> the MSN page. One of the pages requested I install the adobe flash player
> which I did. Also, to test the stability of th enew system, I open all the
> programs that come with XP PRO and I open all the games, including the
> internet games included in XP PRO. I noticed today when I opened some of
> the
> internet based games, there were ads on the games themselves. Is this
> normal, ads on the games? I need to look at that.
>
> Anyway, I tried to reproduce the virus today without success. Installed
> every driver I had on the flash drive and no "Antivirus soft", which by
> the
> way is very hard to remove. Even in safe mode.
>
> I've had instances where Symantec Endpoint Protection 11.0.5 was not
> catching some variants of "fake" adobe flash player updaters which present
> themselves as .exe files and I know to avoid them.
>
> I did install a flash player update from an MSN top page linked site. But
> the update came through Internet Explorer like it always has.
>
> I checked my router and the DNS numbers are hard coded.
>
> I did open Media Player and I remember it going to a BRAVO based page with
> the housewives movie playing and I think that is when the virus launched.
>
> I can't duplicate the problem. I checked every disk and software piece I
> had
> with several up to date antiirus/antimalware programs and nothing came up.
> Norton Internet Security version 10 is pretty good at detection but no
> viruses.
>
> I know there are cases where a file is downloaded and it is not a virus.
> Then the file launches, still undetected, then downloads a virus. At that
> point, Symantec will catch it but it is too late, the pc is compromised.
>
> If my router was compromised, my other pcs would also be infected. I think
> they would be.
>
> My wireless security is solid.
>
> Thank you.
>
>
> "Harry Johnston [MVP]" wrote:
>
>> Wattsfan,
>>
>> One possibility is that your wireless router might be compromised and
>> redirecting you to malicious websites. I'm not very familiar with the
>> issues involved so can't provide much advice, but one thing you could try
>> is explicitly configuring your DNS servers (your ISP should be able to
>> provide you with this information) rather than using the DNS service
>> provided by the router.
>>
>> Harry.
>>
>> On 2010-03-04 10:36 a.m., Wattsfan wrote:
>>> 1. New Toshiba Laptop, formatted hard drive
>>> 2. Installed Basic Toshiba drivers: Chipset, LAN, WAN, Audio
>>> 3. Connected to Wireless Network
>>> 4. Run Microsoft Update up to the point where it says do I want to
>>> activate my license
>>> 5. Then I let Automatic Updates download and install the updates (don't
>>> have to activate when Automatic Updates does the work for me.)
>>> 6. This pc still has XP PRO SP2
>>> 7. Downloaded 64 updates
>>> 8. Rebooted and the "Antivirus Soft" virus came up, basically locking up
>>> all my exe files.
>>>
>>> I've scanned everything and the virus has not been found on any of my
>>> media. I triple checked every file with Symantec's Endpoint Protection
>>> 11.0.5, and Microosft Security Essentials (current) and Malwarebytes.
>>> Nothing. I even decompressed each install file from Toshiba and checked
>>> every file on the PC after the installers ran.
>>>
>>> Nothing.
>>>
>>> Is it possible Microsoft Update is infected with this virus? I know,
>>> remote.
>>>
>>> The virus infected my computer after installing the first round of
>>> updates
>>> via Automatic Updates which there were 64 updates to download and
>>> install
>>> including IE8 and its updates.
>>>
>>> After the restart, Antivirus Soft took over and disabled everything.
>>>
>>> Thanks.
>>
>>
>> --
>> Harry Johnston
>> http://harryjohnston.wordpress.com
>> .