NZFF

Posted: **Wed Mar 10, 2010 5:28 pm**

This message is for either James Williams or this site's administrator. Please contact me at toksawe@gmail.com regarding your PM and subsequent email sent to my private account. I tried replying to your PM but did not go through since there's no particular address I should refer to.

This is urgent so I require your swift response.

Graham

Posted: **Wed Mar 10, 2010 5:34 pm**

Simply delete the email , admin will or is following up .

Posted: **Wed Mar 10, 2010 5:39 pm**

I got a PM from a James Williams saying that my computer had a virus and was a threat to the NZFF website and that my a/c might be closed. Assuming it was a NZFF adminiistrator I naievely allowed it to run 'Personal Security' on my computer.This programme has taken over the computer and won't allow me to view any website without registering with Personal Secuity.It will not allow their programme to be removed.I have shut down the computer and am using another one.Is this guy bonafide or a fraud and how was he able to access me through PM mail.Beware!

Posted: **Wed Mar 10, 2010 5:45 pm**

Wow that was random!

I got two pm's saying what yours did hoki1185.

Don't these people have anything better to do....

Posted: **Wed Mar 10, 2010 5:47 pm**

Why is his name so close to mine...
and its def not me cos i was at school when that spam thing went out

Posted: **Wed Mar 10, 2010 5:47 pm**

I think most members got that PM but almost everyone should realise we only have one working Admin here at NZFF and that is Robin Corn (toprob) and if it doesn't come from Robin there is a damn good chance it's not a valid PM !!!

Cheers
Ian

Posted: **Wed Mar 10, 2010 5:52 pm**

I got the same too from JamesWilliams, tried to send back a pm to him but his name wasnt on the members list. Came as a surprise to me...this is what he wrote

"Dear, Markk!

Spam sending from your computer was detected.
We highly recommend you to check your computer and perform online virus check at our site immediately: **(I have removed this website addy)**
If you do not pass this test we will have to delete your account and forward a complaint to your ISP with attached log file (your IP address, etc.)."

sounds malicious to me, I wondered how this accessed my Pm mail.
I haven't logged on for ages but have been poking in from time to time without logging in at all.

Posted: **Wed Mar 10, 2010 5:54 pm**

Yep, I received similar email and immediately scanned my system with the latest Norton Security software and found no threats whatsoever. My hunch is that your server may perhaps carry a phishing bot which is masquerading in reverse mode to have me believe my system is sending malware. The idea is to get me to respond to "Jame's" email only to have me go through "his" scanning program to verify whether my system has virus or not. I did not fall for this since I already know.

Please advise other members of this scam immediately or else more computers will be infected.

Cheers,
Graham

Posted: **Wed Mar 10, 2010 6:15 pm**

Lets start a POSSIE and hunt this JW down!!!!

Posted: **Wed Mar 10, 2010 6:32 pm**

I hate these things... never ever click the links shown when you see "your PC is infected" on a web page or pop up box. Even trying to close the window will install the program, which is usually virus like itself. If it does a "scan" it will say nearly all your important Windows files are infected and the only way to remove them is to use their program.

I've cleaned a few PCs of family members that were infected with these sort of programs and it's not a quick process, but the following may help.

If you get this sort of thing, either ctrl alt del or ctrl shift esc and end the browser window using task manager. Don't click anywhere in the browser window.

If you are infected, restart in safe mode with networking, download and install Malwarebytes (http://www.malwarebytes.org/, you may have to use another PC to download it to a flash drive), run it on full check (will take forever) and do what it tells you to do. Then delete all restore points (turn system restore off then on again). I also run CCleaner and HiJack this to see what else is starting up.

These things are the scourge of the internet and prey on the biggest weakness in any PC's spyware / virus defence - the person at the keyboard.

Good luck

Posted: **Wed Mar 10, 2010 6:42 pm**

Wantok wrote:
QUOTE (Wantok @ Mar 10 2010, 05:54 PM) <{POST_SNAPBACK}>
My hunch is that your server may perhaps carry a phishing bot which is masquerading in reverse mode to have me believe my system is sending malware.

more than likely just a spam bot signing up and pming.

QUOTE

Norton Security...[/quote]

some would say that is a virus in itself

QUOTE

These things are the scourge of the internet and prey on the biggest weakness in any PC's spyware / virus defence - the person at the keyboard.[/quote]

+1....

hence the term PEBCAK or the more common ID 10 T error being used by techs when theyve been asked to fix these kinds of problem

Posted: Wed Mar 10, 2010 7:11 pm

by hoki1185

How do you start up in safemode without closing the computer down prematurely?

Posted: Wed Mar 10, 2010 7:33 pm

by 2fst4u

Weird. I haven't got any of these pms and my name is near the top of the list.

Posted: Wed Mar 10, 2010 7:40 pm

by ZK-MAT

QUOTE

How do you start up in safemode without closing the computer down prematurely?[/quote]

Use Task Manager to exit the Browser.

Restart your PC / Start / Shutdown / Restart

Press F8 repeatedly during the start up procedure. Usually the advice is to hold it but I find that sometimes messes up the boot, so I tap it quickly, constantly till I get the black screen with loading options.

2fst4u wrote:
QUOTE (2fst4u @ Mar 10 2010, 08:33 PM) <{POST_SNAPBACK}>
Weird. I haven't got any of these pms and my name is near the top of the list.

Neither

Posted: Wed Mar 10, 2010 9:19 pm

by andrewb

Yeah I got two of these PMs as well. As ZK-MAT said, you should never ever click links or open attachments from strangers unless you're darn sure where it's going to take you or what it's going to do, even then - suspect everybody, an email from a friend or family member can also be fake. A quick look at this guys profile also showed that he had only joined today and never posted on the forums. *warning bells*

Working in support, I've had to fix machines several times where the user just blindly clicked on those fake "your PC is infected" popups, what a mess. Generally the only thing to do to be sure it's absolutely gone is to format and re-install and that would almost always be my recommendation.

Posted: Wed Mar 10, 2010 10:46 pm

by toprob

Sorry, Splitpin, your post had to go because it breached soooo many rules, but the sentiment is appreciated...
-Robin

Posted: Wed Mar 10, 2010 10:49 pm

by Splitpin

toprob wrote:
QUOTE (toprob @ Mar 10 2010, 11:46 PM) <{POST_SNAPBACK}>
Sorry, Splitpin, your post had to go because it breached soooo many rules, but the sentiment is appreciated...
-Robin

Sorry Robin......Ive had a deep breath.......i think you did the right thing, considering the age of some of the members......

Changed my avatar for a while (picture paints a 1000 words).....those kind people just really annoy me.

NZFF

James Williams or Site Admin