Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Kaulitz

macrumors member
Dec 31, 2010
31
0
Bromsgrove
Try looking for "System Tools" it's a fake anti virus but unlike many it will cripple the os. I've had a few clients with this same infection since Christmas, it's pretty nasty.
Otherwise install some kind of peer2peer software usually they throw up a lot of fake files wi every search.
 

Ivan P

macrumors 68030
Jan 17, 2008
2,692
4
Home
Since you asked in a Mac forum and your signature indicates you're running a Mac and you didn't specify otherwise in your post, it was only reasonable to let you know that you can't run Windows viruses on a Mac.

I would've thought the fact they posted it in the Windows on the Mac section would've been obvious enough for you.
 

velocityg4

macrumors 604
Dec 19, 2004
7,329
4,717
Georgia
if i really wanted to mess up someones computer i dont need a viruses to do it.

i have a customer who has a system tool virus and i want to practice on removing it before i go to his house.

Though I don't know where to download the virus. For those fake malware programs I just Google the removal instructions. My preferred source for the removal is http://www.bleepingcomputer.com. Which will usually be in the top three results for any fake malware program.

Generally the procedure for most of these is to open Internet Explorer and go to Tools > Internet Options > Connections > LAN Settings. Then make sure "Use a proxy server for your LAN" is unchecked. Then download one of the renamed "RKill.exe" such as iExplorer.exe or eXplorer.exe. Run the renamed RKill. Then run CCleaner to reduce scanning time (removing Hotfix uninstaller in XP). Turn off and clear System Restore points to reduce scan time and prevent reinstalling the virus. Then finish things off my downloading, installing and running Malwarebytes. On the rare occasion Malwarebytes does not find everything a further scan is run with the slower Superantispyware.

Running RKill and Malwarebytes is always in the list of procedures for removing these fake scanners. However, sometimes there are a few registry entries or manual deletes needed which is why I try to find the procedure before beginning removal. I always add the CCleaner step and restore point removal since it dramatically reduces scanning time saving my customers money and reducing my sheer boredom of watching a scan.

Edit: By the way here are the removal instructions for "System Tool 2011". It requires an extra step of replacing and repairing infected Windows Host files so read up on steps 22 and 23. I think I have removed this particular one before. I just come across so many of these fake scanners I can't remember their names.
 
Last edited:

munkery

macrumors 68020
Dec 18, 2006
2,217
1
I'd say most of the people here believe that :p

I would like to perpetuate that stereotype.

How do you know you don't have a virus?

http://www.exploit-db.com/download_pdf/17066 -> shows how to bypass AV scanners.

Especially, given the fact that UAC is not reliable at preventing privilege escalation because of the design of the Windows registry.

http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/ -> outlines how to exploit win32k.sys vulnerabilities by manipulating registry values.

http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=win32k -> list of win32k.sys vulnerabilities.

And, UAC is being bypassed by malware in the wild.

http://www.eset.com/resources/white-papers/Stuxnet_Under_the_Microscope.pdf

http://www.theregister.co.uk/2010/11/16/tdl_rootkit_does_64_bit_windows/

Name one Mac malware in the wild that achieves privilege escalation via exploitation of the system?
 

Hastings101

macrumors 68020
Jun 22, 2010
2,338
1,446
K
Random links + information

I think you went off on some other topic because none of that is going to happen if you simply connect a PC to the internet. Now if you browse the internet that could be a different story.
 

munkery

macrumors 68020
Dec 18, 2006
2,217
1
I think you went off on some other topic because none of that is going to happen if you simply connect a PC to the internet. Now if you browse the internet that could be a different story.

It was meant to be an obvious troll for the sake of humour.

But if you want a link to a public and unpatched remote root vulnerability with a proof of concept exploit that could be used to make that kind of worm, here you go:

http://www.vupen.com/english/advisories/2011/0394
 
Last edited:

Cyberheart

macrumors member
Original poster
Mar 14, 2011
99
0
Cyberspace
I would like to perpetuate that stereotype.

How do you know you don't have a virus?

http://www.exploit-db.com/download_pdf/17066 -> shows how to bypass AV scanners.

Especially, given the fact that UAC is not reliable at preventing privilege escalation because of the design of the Windows registry.

http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/ -> outlines how to exploit win32k.sys vulnerabilities by manipulating registry values.

http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=win32k -> list of win32k.sys vulnerabilities.

And, UAC is being bypassed by malware in the wild.

http://www.eset.com/resources/white-papers/Stuxnet_Under_the_Microscope.pdf

http://www.theregister.co.uk/2010/11/16/tdl_rootkit_does_64_bit_windows/

Name one Mac malware in the wild that achieves privilege escalation via exploitation of the system?

thanks man i downloaded some pdfs im going to read into this good stuff thank you
 

ian.maffett

macrumors 6502
Aug 1, 2008
258
0
Florida
The answer

Well, apparently everyone got sidetracked by the Mac/PC argument, which is normal... lol
However, the answer to this riddle is
http://www.offensivecomputing.net
as they have the most comprehensive list of malware and virus software around with all the data to back it up.

This answer is more for people searching ...
 

reery

macrumors regular
Sep 18, 2012
129
15
Some of the nutters on the MacRumors forums seem to think all you need to do is connect a PC to the internet and you'll be infested with them. :rolleyes:

This happened to me when I plugged in a WinME PC to my first broadband connection in 2001 when I was 17. 1 minute after I plugged in the network cable the system ran slow and froze. After the reboot it was full of **** and I had to reinstall Windows and add a firewall and anti virus.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.