Author Topic: Security Toolbar 7.1 virus  (Read 4654 times)

0 Members and 1 Guest are viewing this topic.

Offline frankb

  • Newbie
  • *
  • Posts: 4
Security Toolbar 7.1 virus
« on: July 31, 2008, 10:03:13 PM »
Has anyone been infected with this virus?
Security Toolbar 7.1 virus

It sits on top of your internet browser. It's apparently a very nasty one.
My AVAST anti-virus wasn't able to see it or remove it.
I have read on the internet that you can't get rid of this one. Even if you remove the virus
it still sits somewhere in the core of your OS.

This virus can do the following:

"Security Toolbar 7.1 is a dangerous spyware toolbar and it comes from a very dangerous trojan, called Trojan.Zlob. Once the Security Toolbar 7.1 installed, you start receiving warning messages claming that your system is infected and recommends buying various type of fake & dangerous antispyware application."

Once your computer is infected, there is no way to make sure that it is 100% cleaned other then reinstalling the entire OS. There are rootkits that are installed and operate BELOW the OS. Read Microsoft's website on it, you must completely reinstall your OS if you want a 100% clean system.



Is Avast aware of this virus??

Frank

Offline sanctuaryforever

  • Sr. Member
  • ****
  • Posts: 252
Re: Security Toolbar 7.1 virus
« Reply #1 on: July 31, 2008, 10:45:56 PM »
are you able to submit the infected files to Avast for analysis?

virus@avast.com

place the infected files in a compressed folder which is passworded and submit them to the above address with the password in the main body of the e-mail
« Last Edit: July 31, 2008, 10:48:15 PM by sanctuaryforever »
Celeron 1.30Ghz, 1Gb ram, Windows XP SP3 32-bit

running Avast 6.0.1289

Offline frankb

  • Newbie
  • *
  • Posts: 4
Re: Security Toolbar 7.1 virus
« Reply #2 on: July 31, 2008, 11:37:32 PM »
Hello,

I wish it was that easy. Because Avast didn't find it, I don't know where it is.
Plus, I have read it goes pretty deep into the os.

I did report the information to virus@avast.com yesterday but I haven't received a response. 

Offline wyrmrider

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1298
Re: Security Toolbar 7.1 virus
« Reply #3 on: July 31, 2008, 11:55:54 PM »
there are lots of versions of the Zlob infection
the one YOU have may be known or unknown
I'd suggest that you update avast and then rt click on the ball and schedule a boot time scan
send any hits to the Chest- do not delete/remove
report back
The C:\Program Files\Alwil Software\Avast4\DATA\report\aswBoot.txt providers a more user friendly summary of the boot-time scan and it should list any detections.
post it back here


upload results to virus total and avast again

from David R
You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here. You can't do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.

Create a folder called Suspect in the C:\ drive, e.g. C:\Suspect. Now exclude that folder in the Standard Shield, Customize, Advanced, Add, type (or copy and paste) C:\Suspect\* That will stop the standard shield scanning any file you put in that folder. You should now be able to export any file in the chest to this folder and upload it to VirusTotal without avast alerting.

If it is indeed a false positive, see http://forum.avast.com/index.php?topic=34950.msg293451#msg293451, how to report it to avast! and what to do to exclude them until the problem is corrected.

if not a false positive or for further investigation

run a scan with Malware Bytes Anti Malware
any hits?
post the MBAM log in the Virus and Worms Forum here at Avast
with a link to your virus total results if any
and a link to this thread

do not panic or hose your OS just yet
good luck
« Last Edit: August 01, 2008, 12:08:38 AM by wyrmrider »

Offline olddog

  • Poster
  • *
  • Posts: 566
Re: Security Toolbar 7.1 virus
« Reply #4 on: August 01, 2008, 06:03:01 AM »
frankb,

SecurityToolbar can modify Internet Explorer homepage to a site that promotes rogue security programs. It can also download and install Rogue Security Software onto the infected computer.
Threat Level: Low
Type: Adware
Systems Affected: Windows All

There is a description here http://www.precisesecurity.com/adware-spy/sectb71.htm on how to remove Security toolbas 7.1 which looks worth a try. You will need to download and install a copy of the free version of SuperAntiSpyware. There is a link to this in the instructions.
Hope this helps
3.4Ghz Intel i7, 8Gb Ram, GeForce GTX560, Win 7 Pro 64 bit, Dual 1920x1080 monitors, Avast 2014, Firefox 26, Malwarebytes Pro, Paragon 14

Offline wyrmrider

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1298
Re: Security Toolbar 7.1 virus
« Reply #5 on: August 01, 2008, 07:00:29 AM »
frankb

no reason you can't do both posters suggestions
just quarantine do not remove/delete
in the end you do want to post a hjt in the virus and worms forum just to make sure additional baddies did come along for the party

keep in touch