Yep. I caught a virus, a nasty one aswell. First of all I noticed adverts keep on popping up in Internet Explorer windows, when IE wasn’t even running, then when I next booted up I was confronted with a fake anti-virus window and some thing telling me to download WinAntiVirus pro, so I did – not really, I wouldn’t download that. Anyway, next boot and nothing happened. I just logged on, and nothing came up. I hit “ctrl+alt+del” to bring up the “Windows Security” dialog box and opened Task Manager. Guess what, no “explorer.exe”! I hit “New Task…” and typed in “C:\WINDOWS\explorer.exe”, and I was confronted with a “You do not have the correct permissions to open this file” message. Damn! The main system file, and I couldn’t even open it. Something had to be seriously wrong, in the end I used IE’s file manager (similar to Windows Explorer) to back up my important files and decided to do a reformat.
Shame that I had to do one really, but thats viruses. When the installation was complete I loaded some crucial files and programs back on to it and immediately downloaded Avast! 4 Home Edition. Once it had installed, I was faced with 7 virus alerts! 7 virus alerts! My installation of Windows XP was less than 2 hours old, how could 7 viruses have got into my system? Anyway I moved them to the chest and everything seemed okay.
Lets hope it stays this way, since I’m on my forth XP installation in just under 2 years! Should operating systems really need reinstalling this many times?
Research
I did some research on the virus that I had caught, tracing back everything I had downloaded. It appears that the site http(colon)//www.theserials.com have changed their “textbox” attempt to a download.
I investigated where these downloads were coming from, it appears that the following addresses are spyware generators:
http(colon)//d.theserials.com/files/ANYTHING-HERE.exe
http(colon)//keys.thekeys.ws/files/ANYTHING-HERE.exe
If you type in a non-existing address such as:
http(colon)//d.theserials.com/some-non-existing-file/
http(colon)//keys.thekeys.ws/some-non-existing-file/
You will find that Apache (server) will return a 404 error for the server:
http(colon)//storage.ss.ru
Which obviously is a Russian server, not just from the domain extension but from the domain report, which says the server is located in St. Petersburg, running off the Davis Zao Network. The only whois information available for this is:
domain: SS.RU
type: CORPORATE
nserver: ns.avmgroup.ru.
nserver: ns2.avmgroup.ru.
state: REGISTERED, DELEGATED
org: JSC "Dewis"
phone: +7 812 5289637
phone: +7 812 5289685
fax-no: +7 812 5289637
fax-no: +7 812 5289685
e-mail: (removed)
registrar: RUCENTER-REG-RIPN
created: 1999.08.06
paid-till: 2008.09.01
source: TC-RIPN
Which really doesn’t tell us much about who owns this domain, note that the email address has been removed for anti-spam purposes. My conclusion is that the following addresses CNAME to http(colon)//storage.ss.ru:
http(colon)//d.theserials.com/
http(colon)//keys.thekeys.ws/
This is the end of this rather long blog post, but just be warned; think your safe without an anti-virus, think again!