So my dad's laptop got, for the second time, got some "Win 7 Antivirus 2012" virus, one of those that keeps popping up a fake antivirus window, etc. It was even popping up in safe mode. The laptop was running Windows 7 Home Premium, his user was the only user and was the set as the admin user. It was the stock Win 7 install from Toshiba that came with the laptop.

I've had him using Firefox with Adblock installed, and when he got the virus the first time Microsoft Security Essentials was installed. After the infection, when I took a look at it, MSSE had been disabled (I'm assuming by the virus). It took a lot of work but eventually I was able to disable the virus from starting up, run MSSE and AdAware and clean things up.

So this latest infection appeared to be the same thing. Same type of virus, same symptoms. MSSE was disabled, AdAware's resident monitor had been installed earlier but the service was being hijacked or something by the virus. On top of all that the virus would run in safe mode even, I couldn't find anything to disable in hijackthis, and it wouldn't establish a network connection over either wired or wireless. It would connect but not get an IP address from my router. Sigh.... and all of this was still with them using Firefox for their browsing.

So my question is, what else can I do to prevent this from happening? I'm really close to suggesting they get a Mac, or installing Linux and forcing them to use that. I couldn't repair the laptop this time so I've wiped it clean and put Win 7 Pro on it. I set up their user as a "normal" non-admin user. I set up MS Security Essentials again on it. I've been using Chrome as my main browser just because it seems to respond better, so I was thinking of pushing them toward that. But really it doesn't seem like it should matter; either alternative browser should be fine.

Bottom line is I don't know how the heck he keeps getting this thing, and it annoys me to no end that I can't seem to prevent it. He just goes to a bunch of old antique tractor sites and stuff, and Yahoo email. My mom uses it pretty much only for email and Facebook. What else can I do to keep my sanity?

  • 2
    turn parental control on ;) – Shekhar Dec 28 '11 at 15:30
  • Don't run random scripts on web pages... Ads are the main source of these which is why you may visit a site and get this malware but I don't get it from visiting the same site (different ads)... Ad block is a good start but no script is the best, it's just a little more bloated to use as it may block functionality of the site itself. – Supercereal Dec 28 '11 at 15:35
  • 1
    Disable the netword adapter. This type of user has no business being on the internet. – Ramhound Dec 28 '11 at 16:40
  • 2
    IME people who learn to clean it themselves, or pay someone to clean it a few times, learn how to avoid it. :) – Ƭᴇcʜιᴇ007 Dec 28 '11 at 16:46
  • 1
    @techie007: This is true. A virus as a user can still delete all their files, and any network resources they have access to. – surfasb Dec 28 '11 at 21:59

This can certainly be frustrating. I have seen this in different variants for a couple years now. The developers are getting more sophisticated each time they deploy this junk. One thing I have noticed is the people who have gotten hit with it repeatedly are not always heavy users, rather ones who aren't as savvy. I know one person who kept clicking "OK" on every window that popped up while another opens every single attachment she gets in her email. Both have been infected multiple times.

The best defense I have been able to come up with so far is education. Maybe your parents are clicking something or opening something they think is normal. Warn them of the types of things they might see and how to save and scan email attachments rather than opening them within the email.

No anti-virus/spyware/malware programs catch 100%, so I would suggest making sure the MSE is updating regularly and possibly adding a malware scanner to run at startup.

  • That's the same exeprience I've had as well. The fake virus scanner dialogs look pretty impressive these days, which could easily trick someone not familiar with how their AV product looks into clicking because it looks so "professional". – Melikoth Dec 28 '11 at 16:26
  • Thanks. I went over this type of thing the first time it happened, but yeah, something must have got through. I'm going to try going over I guess which popups might be legit and hope for the best! – Peter Tirrell Dec 28 '11 at 18:28

I say give him user rights and since you have Windows 7 Pro enable Applocker with possible software restriction policy, or run a VM with linux create a shortcut on the desktop for him and force him to use Google Chrome Browser

  • 1
    This is the answer. Force your folks to use an User account. What the heck? Are we back to the Stone Ages again teaching people not to run Admin 24/7??. – surfasb Dec 28 '11 at 21:43
  • Just make sure they don't know an admin user/pass otherwise they'll probably just type it in when the computer asks anyhow. – Melikoth Dec 29 '11 at 13:17
  • @Melikoth this seems to be the biggest drawback so far. Running as a user account works great, and even if it does get infected if it limits it to that account to where I can get on as the admin and clean it I'll take that as a win. But it's prompting for the admin password for even things like Windows Update. I was going to instruct them what the password is but if they get prompted while browsing some site or something to call me. <shrug> – Peter Tirrell Jan 4 '12 at 18:03
  • Well everything is fine except the Linux VM... Just don't allow anything but Chrome to run. – Phoenix Logan Nov 6 '13 at 13:00

I'd go with the Linux option you had mentioned.

Any change from windows is going to give them a little bit of a learning curve so you will have to hand-hold them a bit until they get used to it. Firefox looks the same though and since they seem to be sticking with browser based activities the underlying OS shouldn't be a big issue.

  • 1
    "Teach parents to use linux!?" Shudder. . . – surfasb Dec 28 '11 at 21:41
  • 1
    It'd be easy to teach mine. Turn computer on, same as before. Double click "Foxfire" icon, same as before. Type URL's into google search bar and check the first result, same as before. I couldn't explain the URL bar, but as long as google is the default homepage it would work great. – Melikoth Dec 29 '11 at 13:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.