Thursday, March 14, 2013

This Connection is Untrusted -- virus??

13-March-2013 Web browser on Margie's computer started saying "This Connection is Untrusted" whenever she went to hotmail or zoho.  This happened with both IE and Foxfire.  She took computer to Uptech to get rid of possible virus.  We'll see what Uptech says.

I let her use the mostly un-used clear case computer (Windows 2003 server) but it also had same problem!  So I booted a live CD of Puppy linux and still the problem persisted!  Then I used Gparted (linux) to change the filesystem  of 57 GB partition (really the only partition on the computer) to ext 2 thinking that that would basically erase Windows and anything else on that partition.  Rebooted into Puppy Live CD and still the problem was there!! It still said "This Connection is Untrusted"when you went to hotmail (or yahoo mail or zoho login screen) even in the version of Firefox on Puppy!

I knew Gparted had really changed the file system and probably erased the contents of the partition because the computer would no longer boot to Windows; it simply hung.  So how could the virus still be there?  I finally downloaded the latest version of LXDE Fedora and actually installed it to hard disk.  I picked LXDE Fedora because it said it was specifically for older computers with low system specs.  Clear case computer has only half a Gig of RAM.  During installation, an alert popped up that said "Warning - boot sector virus detected!".  So maybe the "This Connection is Untrusted"virus is a boot sector virus.  That would explain why it persisted even when I used linux and even when I reformatted the main partition.  Does the boot sector remain untouched even when other partitions are changed?  Does the boot sector stay the same no matter what operating system you use?  These are good questions.

I assume that Fedora was so thoroughly installed that it overwrote the virus wherever it was.  I had tried to "install" puppy to the hard disk, but I think it only copied its system files to a folder on the hard drive and did not really install it so that it would automatically boot to puppy from hard drive when you restart computer.  I knew this because after I installed puppy (supposedly), and took CD out of computer and rebooted, it just booted into Win 2003 server as always.

When LXDE Fedora was installed I guess it also installed a "boot loader" and maybe that goes into the boot sector of the hard drive and maybe that's why it finally stopped the virus.  ????  So now Win 2003 is gone and clear case computer boots LXDE fedora from hard drive as it should.  Margie will use that computer for a few days until her computer is back from Uptech Computer.




Tuesday, February 12, 2013

Possible virus on Jaywalker

Jaywalker computer started acting weird yesterday.  I may have clicked a link in an email and gotten a virus that way.  Symptoms:
Won't shutdown - shutdown screen just hangs
Devices and Printers screen is blank
Control panel screen is blank
runs slow
would not print from notepad

Found a guide for how to remove viruses on wikiHOW and it said to boot into safemode with networking and then to download Malwarebytes.  I did that and did a scan with Malwarebytes (all the time still in safemode with networking) and it did not detect any problems.  But after that everything seemed to work.  So I don't know what happened.  Once I was in safemode, I was able to bring up control panel and devices and printers screen; maybe that somehow "fixed" it.

Friday, February 1, 2013

bighornmemphis hacked!!

On 30-Jan-2013 I noticed that bighornmemphis.com had no pictures on home page and when I clicked on the Cotton Plant Shops link to see if pictures were on that page it took me to a weird spanish-language surfing school site!!!  Logged into fatcow control panel and created a help desk ticket and waited 2 days but got no response so I called fatcow today.  Guy who aswered was very helpful and fixed the problem by editing the .htaccess file in the bighornmemphis directory on the fatcow server.  He said that some one had probably hacked into the .htaccess file.

I had to hit CTRL-F5 several times to get foxfire to stop showing me the old cached version and show me the new (fixed!) version of the big horn site.

Sunday, January 27, 2013