Saturday, January 23, 2010

Skype Virus Automatically Sends Facebookgallery.info links

Here's how you get infected: 

One day you're on your computer and you get a message from a friend asking you to look at these crazy pictures of them, making sure they look okay (there are other variants of this message).  The links points to a site called facebook.info, in the example below it's http://srv06.facebookgallery.info:89/.  You click the link and accept all the prompts after that and the next think you know, those same messages are being sent from you to friends on your Skype list.

The following example says "I can't believe I got tagged in this picture!!  Do you think I look ok?"






What's worse it that you can't download the regular virus-removal tools because when you click to download one, you get a page that says "Google Error.  Not Found.  The requested URL /Files/ProcessExplorer.zip was not found on this server".  NOTE:  This came up when I tried to download Process Explorer to stop services.  See below:









Also, if you already have tools available, they close shortly after opening. 

Here's how to remove it:

1)  Edit the hosts by going to Start > Run... and entering the following:
 notepad "C:\Windows\System32\drivers\etc\hosts"

2)  Scroll down a little ways and delete everything at the bottom.  It's going to be a bunch of garbled text.  After deleting, then save the changes. 

NOTE:  If you're not comfortable with this, you can try HostXpert, but you'll have to download it on another computer and transfer it to the infected computer before you can use it.  Just run it and click "Restore MS Hosts File"

3)   The above steps get rid of the Google Error pages, so now you're free to download any tool you wish to fight this thing.  I used ComboFix to get rid of this thing.  Download it to your desktop and rename it to "nothing.exe" -- otherwise the virus will recognize it and close it automatically.

4)  Run "nothing.exe" and accept everything it wishes to do and you'll be virus-free soon.  It may require a restart.

Sometimes an extra step is needed if you lose your internet connection after performing these steps.  Right-click the My Computer icon and go to Properties.  Click on the Hardware tab and click the Device Manager button.  In the list under Network Adapters you'll see two copies of each of your network devices.  Uninstall the copy without the exclamation point next to it -- it'll remove both copies from the list.  Then go to Action > Scan for hardware changes.  Windows should detect your network device drivers and get you going again.

6 comments:

  1. Do you have any suggestions for Vista users? I've tried the above steps and have also run Malware Bytes' anti-malware software with no results. Any tips would be much appreciated.

    ReplyDelete
  2. you all are my hero!! this process is great.

    thanks!

    ReplyDelete
  3. Thank you, a very simple selution to a potentialy huge problem, system is up and running 100%.

    ReplyDelete
  4. Combofix cant be ran wit 64 bit pc's what about them ? :<

    ReplyDelete
  5. Scroll down a little ways and delete everything at the bottom ???

    how long should i delet ?? plz help

    ReplyDelete
  6. host is a file or a folder

    ReplyDelete