Ms. Ducktoes is really busy removing spyware and replacing power supplies today, but I’ve noticed an influx of this new worm. So I thought I should warn you. It’s called the Downandup/Conficker worm. Millions of computers are infected. To avoid getting it, turn off Autoruns on your computer. Click here to learn how to turn off Autoruns.

To fix or remove Downandup or Conficker worm, there are these free removal tools:
ftp://ftp.f-secure.com/anti-virus/tools/beta/fsmrt.zip
ftp://ftp.f-secure.com/anti-virus/tools/beta/f-downadup.zip

Then run the usual Malwarebytes et al as in this post on Free Anti-spyware just to get rid of any remaining spyware. More later, my chickadees.

Ms. Ducktoes really feels for the readers whose computers have the Hallmark card virus. So many of you are still coming to this blog for a fix. This has been going on for months.

Since so many of you are still getting infected, today I went on-line to do a more research. I was wondering if there were any new variants etc.

What I found troubled me:

The links lead to a Youtube video which pretends to be a Tutorial but really is an ad for AntispywareOn.com, a rogue anti-virus site that will give you–you guessed it–more spyware and viruses. You can play the video without getting infected but don’t go to AntivirusOn.com. The video’s not much to see; it’s mostly obscured by big letters telling you to go to AntivirusOn.com. Click here to see the video.

Now here’s a video that’s more interesting. The video maker “Video search engine” infects a virtual machine with what you get on AntivirusOn.com and makes a video of the result. And, oh dear, the result looks surprisingly familiar: like another variant of the Windows XP Antivirus 2008/2009!

Ms. Ducktoes wants to stamp her (web) foot, she’s so sick of the Hallmark card virus and the Windows XP Anti-virus!!!

If you have the Hallmark virus, don’t go to AntivirusOn.com and even get more spyware and viruses. I’m sure some of you have already.

If you need to remove the Hallmark Card virus, the Windows Xp Anti-virus 2008/2009 or any other spyware, try this first.

If you already have bad spyware problems and can’t download the anti-spyware abovego here for a fix.

Good luck and as always your comments are most welcome.

This year Ms. Ducktoes has added more free anti-spyware to our regulars: Spybot and Ad-Aware SE, which have been on our best anti-spyware list for years.

At Ducktoes we fight spyware on computers everyday and these are our the most potent and useful.

1. Malwarebytes
Our top best free anti-spyware of the year is this newbie (at least to us).
This free-antispyware is the newest and trendiest trick Calgary techies have up their sleeves. At all the tech workshops I’ve been to, everyone’s talking about it. And what’s more, Malwarebytes lives up to the hype, since it is like an avenging angel against potent malware. It nails it!!!

2. SuperAntiSpyware
Here’s another new-to-me and probably new-to-you anti-spyware that is true to its name. It’s a Super hero – really effective against the Hallmark card and other difficult malware.

3. Dr. Web Cureit. Dr. Web Cureit is a dynamo against some of the new malware. Dr. Web is from a Russian company and is endorsed my the Ministry of Defence of the Russian Federation. Since so much spyware and malware is coming from Russia these days, I imagine the Dr. Web people have prior first-hand exposure to it and fight it effectively sooner than some other anti-spyware fighters. It worked well against many nasties for me.

4. Spybot Search and Destroy – Some techs talk about this tried and true anti-spyware (an experienced anti-spywre, no actually, the archetype) as no longer as effective as the newer malware fighters. However this just ain’t true. Spybot’s version 1.6 has a much improved detection and faster scan speed. And the new version 2–almost ready for release–will knock our socks off!

5. Ad-Aware 2008 Another familiar favorite that has gone through a major overhaul. Ad-Aware is the most popular anti-spyware on CNET’s Download.com, no mean feat! All those people must know something we ought to get in on.

And of course there are a few best anti-spyware that aren’t free. But I’ll have to save those for a different post.

To use these best anti-spyware, it never hurts to run more than one, or even, run them all. One at a time. In fact sometimes that’s an excellent way to fignt the Worst Spywares of the year Windows XP Anti-virus 2008/2009 and the Hallmark Card virus. See the post.

And as always, I treasure and welcome your comments.

[ad#new

Sometimes spyware gets so bad, it’s hard to do anything. You can’t go online and download Malwarebytes or Spybot or any anti-spyware (see this post), because your browser–that is, your Internet Explorer or Firefox–is hijacked and redirected and won’t let you go anywhere of use and certainly won’t let you download anything. So you take the next step, and reboot your computer into Safe Mode with Networking by tapping F8 as the computer restarts. But sometimes even in Safe Mode, the malware keeps you from downloading anti-spyware or, if you manage to download it, running it. So now you face reformatting your hard drive and losing all your data and the programs, at least the programs you’ve lost your disks to, or never had disks for in the first place.

What do you do now? You take the computer to a tech who nine times out of ten will recommend reformatting. Or you find a tech like Ms. Ducktoes who will fight the malware without reformatting. Ask your tech if he or she will do this. Ask if he will use Malwarebytes or SuperAntispyware or Spyware Doctor with Antivirus.

Or…you can do this.
1. Go to the computer store and buy a device that lets your hard drive to another computer by USB. It’s called a USB to IDE/Sata Adapter and costs from $25 to $35 dollars.

2. Find another Windows computer either your own or a friend’s or relative’s. Download and update Malwarebytes and AVG and SuperAntispyware and Spybot to that second computer. (You have many choices, just make sure you use Malwarebytes and AVG among them.)

3. Turn off the power to badly infected computer and unattach the cables. Open up the case of the and remove the hard drive. Some cases will have large buttons to push–like Dell– others will have screws. Remove the case.

Make sure your computer is turned off and unplugged before you do this.

4. The hard drive will have a wide-band white/gray cable attached to it and a four-prong power cable.

Here is the power cable. You can see a bit of the ribbon cable in back of it.

5. Remove the cables. (Take a digital photo with your camera or cell phone if you think you may forget how they are attached.

What a ribbon cable looks like

5. You’ll probably have to unscrew the hard drive from the where it is attached to the case.

6. After removed, attach the hard drive to the right (same size) IDE/SATA adapter and plug in the power.

Here the hard drive is attached to the adapter.

7. Connect USB cable to the USB port of the second computer.

Plug the USB cable into the USB port of the second computer.

The computer should recognize that new hardware has been attached. If you go into My Computer, you’ll see it as a USB mass storage device and listed as a letter such as E, F, G, or H, depending on how many cd/dvd and hard drives are on that computer.

You'll see this alert "Found New Hardware" in the right-hand corner of your computer screen.

This window will appear on your desktop. Choose the "Open folder to view files" option.

Your hard drive is attached!

7. Now run the anti-spyware and anti-virus programs one at a time. If you can, do a custom scan and single out the attached hard drive. Let each anti-spyware run and then remove or quarantine the viruses.

This is the AVG interface. It allows you to pick the hard drive you want to scan. Here E and F are selected.

8. If you have enough skill, go into the desktop of that drive (the one that is connected by USB) and copy and paste the Malwarebytes installer to the desktop of your user. Find the All Users desktop folder and drag the MBAM installer icon into the window.

Drag Mbam icon into the "All Users" desktop folder.

Then you can run it later when you reattach the hard drive in its own computer.

9. Unattach the hard drive from the USB and put it back into its own case. Reattach the cables all the way so they fit snuggly. Start up the computer. You should now be able to go into Safe Mode with Networking and download the anti-spyware and run it. You still will have a lot of spyware to contend with but now you have more of an edge. If you put the Malwarebytes icon (Mbam) on the desktop you can click on it and run it. Make sure that you update it.

Good luck and let Ms. Ducktoes know how it goes. Please feel free to comment and make suggestions.

See this post for more detailed information on how to download and run the anti-spyware.

Ms. Ducktoes is all aglow because she received a Hallmark Card from a cyber-criminal!! And here it is:

Ms. Ducktoes has an admirer!

But unfortunately, I can’t have a relationship with a man who wants to fill my computer up with spyware and viruses. It just won’t work. Tee, hee.

No, really I am excited, my duckies, I’ve been waiting to receive another one of these Hallmark Card e-card virus emails because I want to deliberately infest a computer and see what happens. I want to see what the current version is like.

Now you know what the fraudulent Hallmark card e-mail looks like. And if you get one, don’t you click the link.

The Hallmark card virus has gone through many variations. According to this wonderful and informative blog post called “Everyone Loves Me” two of the variations are NuWar and Zapchast. These were created by two separate groups of malware creators. Read the post to find out more. Click here.

The Zapchast variant downloads directly from a link in a bogus e-mail. The e-mail usually tells you a generic someone (friend, family member, old classmate) sent you an e-card. Someone did send you an e-mail, a bad someone, who is not your friend, but your enemy. They do not love you; they want to takeover your computer and make money off you. Fraudulently. Clicking the link downloads and installs a chat application (software) in your computer (much like an Instant Messenger) that can be used to control your computer remotely. So after you download the link someone (bad guy) can come into your computer and control it.

Here are two different methods to fix these viruses:
1. Click here for Method one.

2. If that doesn’t work with the variation you have, try this one:
Click here for Method Number Two. The post talks about Vundo but will work also with the Hallmark card virus.

I’m concerned. Today while researching the Hallmark card and postcard.exe virus, I got these results on Google.

Image of Google Results

The highlighted result in the middle leads to a download site for Windows XP Antivirus 2008/2009, a rogue Antivirus that is really a deadly virus for your computer. I mean a nasty.

So this is the dramatic scenario, my innocent ducklings, you receive a Hallmark card or other e-card e-mail. You know you are not supposed to open attachments on e-mails especially those ending with .exe or .dll but on this e-mail there are none. So you feel safe. There is a link, however, for you to see the Hallmark card (or other e-card) someone sent you. You click the link. Instead of an ecard, your computer fills with the Hallmark card virus, and depending on what variant you download, a pretty bad virus.

Your computer is now looking and acting strange. You’re worried. You search online for solutions. You search for “Hallmark card virus removal”. You get results such as the ones above. You may luck out and click Ducktoes or another legitimate antispyware site or you may click a link to the fraudulent rogue anti-virus Windows XP Antivirus 2008/2009 above. Immediately your computer starts to fill with an even more lethal virus. So now you have one bad virus and one very bad virus.

The fraudulent website looks like this:

Bogus Antivirus Site

Now Ms. Ducktoes has to go to her day job fixing computers and get back to this later. Please be careful until then. Let me know what’s happening to your computer right now, so I have more information on what new variants there are and the type of frustation and problems you’re having, so I can help you more effectively.

Click on the Comment or No comment tag below. Or e-mail me at admin@ducktoes.com.

And the virus removal techniques in yesterday’s post about How to Fix Vundo in Safe Mode should also be quite effective agains the Hallmark Card and Windows XP Anti-virus. Give them a try. Until later.

Also I’m curious. What spyware or virus are you struggling with right now? Or if you don’t know, what symptoms do you have? I invite your comments. Comment here.

Many, many people are coming to this blog site looking for a fix for the Hallmark card virus. So it’s not a hoax!!! (The hoax part is that the virus will wipe out your harddrive. It doesn’t. But it does make a mess.) Thee-mails going out purport to be a link to Hallmark card, read more here (see this post), and if you click that link, you’ll get a direct download of a virus.

If you already have the Hallmark Card virus, there is a fix, or several of them. Usually, normal virus software will remove it. Here are some free anti-virus software that will do the trick. Make sure your software is updated first, after you install and before you run the scan. Without virus definitions, it’s impossible to catch anything.

First to get rid of the virus use one on these antivirus software:

AVG 8 Free for Personal Use
Avast!
Dr. Web CureIt

Then use this antispyware:
SuperAntiSpyware

Virus software is not enough. You’ll also need an excellent anti-spyware tool. The one that is the highest-rated in reviews all over the Internet is Spyware Doctor. It will save you a lot of grief, because spyware prevention is much easier than spyware removal, although Spyware Doctor does an excellent job of removal too.

The below is a secure link to the Spyware Doctor website. Call me at 403-483-0105, if you have any questions. (Please, not in the middle of the night in Canada, however!)

Now if your computer is so bad already it won’t allow you to download anything, you’ll need to go into safe mode.
1. Restart your computer and tap the F8 key repeatedly. Soon you’ll get to a screen that has many different options.

2. Pick the one (use your up and down arrows to move) that says Safe Mode with Networking.

3. A long list of drivers will scroll down the screen. Then you’ll be given and option of Yes or No. Pick Yes, you do want to go into Safe Mode.

4. Now open your browser such as Internet Explorer or Firefox. And type in http://ducktoes.com/blog. Find this post Hallmark Card Fix. And click this link to download Malwarebytes Antispyware.

5. Run and update the program. Make sure you update it first. If your computer (actually the virus or malware) won’t let you update it, run it anyway. Do the quick scan first. Remove the malware it finds and restart the computer and then run it again. If you can update it on the second time, update it and run it again, this time do the full scan.

Then go to the top of this blog post and install one of the antiviruses and the SuperAntispyware.

Good luck and let me know what works or doesn’t for you. Also let me know if it’s hard to download the antispyware. How bad is the virus? Click here to comment.

Ms. Ducktoes is in a flap and a flutter because right now there is a new type of spyware danger that is so new it is causing a bit of havoc and making all of us anti-spyware professionals work overtime. Thousands of computers are infected. Phoney e-mails that purport to be from friends or legitimate businesses encourage the victims to click a link. This will initiate a download of a most dangerous group of spyware and viruses. One is a trojan horse that lets the criminal hacker take over your computer and control it remotely. Others will install a back door in your computer that gives hackers access to do even more damage or add even more spyware. Still others tell you, in a warning on your desktop, that you have spyware, and try to get you to buy a rogue anti-spyware, that will give you even more malware.

I have received three of these phoney, dangerous e-mails. One told me a friend had sent me a Hallmark card that linked to a nasty download of binary code (trojan). I already wrote a blog about that one. Read it here.

Another, my cousin Jack warned his friends and family about, a postcard e-mail that links to a virus download. Here is his e-mail:

Please be careful of the upcoming virus.

Big Virus coming

http://www.snopes.com/computer/virus/postcard.asp

Hi All, I checked with Norton Anti-Virus, and they are gearing up for this virus!

I checked Snopes (URL above:), and it is for real!!

Get this E-mail message sent around to your contacts ASAP.

PLEASE FORWARD THIS WARNING AMONG FRIENDS, FAMILY AND CONTACTS!

You should be alert during the next few days. Do not open any message with an attachment entitled ‘POSTCARD,’ regardless of who sent it to you. It
Is a virus which opens A POSTCARD IMAGE, which ‘burns’ the whole hard disc C of your computer.

This virus will be received from someone who has your e-mail address in his/her contact list. This is the reason why you need to send this e-mail to all your contacts It is better to receive this message 25 times than to receive the virus and open it.

If you receive a mail called’ POSTCARD,’ even though sent to you by a friend, do not open it! Shut down your computer immediately.

This is the worst virus announced by CNN. It has been classified by Microsoft as the most destructive virus ever. This virus was discovered by McAfee yesterday, and there is no repair yet for this kind of virus.
This virus simply destroys the Zero Sector of the Hard Disc, where the vital
Nformation is kept.

COPY THIS E-MAIL, AND SEND IT TO YOUR FRIENDS. REMEMBER: IF YOU SEND IT
TO THEM, YOU WILL BENEFIT ALL OF US. “

While the e-mail is incorrect that the virus will burn a hole in your hard drive, it may cause you to have to get your hard drive reformatted, which will indeed burn all your data, which is essentially the same thing. Also it lets the attackers take control your computer. The trojan is very difficult to remove. The e-mail is confusing a few viruses and hoaxes but is a good warning nevertheless, since it lets everyone know not to open the postcard e-mails. I did receive one this week so it’s definitely making the rounds.

The third one I received–today–was supposedly from Paypal. It said my account had been limited. But the link to fix the account limitation problem was—again, you guessed it—a link to a download of nasty virus code.

So the Phishers and Hackers have stepped up their attacks with a new method. Instead of just getting your passwords and account numbers and credit card numbers as they do in regular phish e-mails and websites, now they give you an immediate download of binary code.

To protect yourself click the below link. It will connect you to PC Tools Spyware Doctor which will protect you from these e-mail viruses.

Also read my guide to preventing spyware. Or the Self-Help tutorials here.

Please feel free to comment. I invite all comments. Or let me know whatyour experience is with e-card viruses. I’d really like to find out what is going on in the larger world.

Yesterday I received an e-mail purportedly from Hallmark cards telling me a friend had sent me an e-card. I immediately knew it was fake but was surprised that it led not directly to a phish (phoney) website but to a trojan download. So don’t click the link; it’s not from a friend but a cyber-criminal.

I cut and pasted the e-mail here in italics. (Notice the error in the subject line, “send” instead of “sent.”. Often fraudulent e-mails have misspellings or display poor English.)

From: “Hallmark Cards”
Subject: You have a card send from a friend!
Date: Mon, 5 May 2008 03:18:53 +1000
Hello ,
A friend has sent you a Hallmark Ecard
Click here to view your Ecard .
If you would like to return an Ecard to him simply go to http://ecards.msn.co.uk/
MSN
in association with
Hallmark Cards
Your privacy is our priority. Click the “Privacy and Security” link at the bottom of any page on http://ecards.msn.co.uk/ to see our privacy policy.

The link to view the e-card immediately initiated a download of the malware trojan horse . So beware an e-card from a unspecified or generic friend. I suspected something was amiss because the misspelling of “send” instead of “sent,” an unlikely error for a major retailer like Hallmark. Also it didn’t say which friend had sent it, which e-card e-mails usually do.

Click here to see what Hallmark says about these fraudulent e-cards.

I knew it was a phish (fraudulent) and wanted to report it to Phishtank so that is why I clicked the the link. However, instead of taking me to a phoney website, it started downloading the spyware immediately. To click the link, I deliberately used a Mac as a precaution. Macs are not susceptible to most spyware. Afterward, I ran my Mac virus software anyway. But I thought I would warn you. I still don’t know how to report it to Phishtank. I wrote to them but they didn’t write back. Sigh. Another unrequited relationship for Ms. Ducktoes.

Zapchast Trojan is the trojan. It is the most dangerous kind. It allows the criminal to take control of your computer. Click here for removal instructions. They are difficult, I warn you.

Also see this Ducktoes blog post on fixing the Hallmark Card malware. It will tell you some free or trial antispyware programs that will fix the Hallmark virus.

Or you can use Spyware Doctor with Antivirus. I am a reseller for this product, and it will work very well although it isn’t free. Spyware is getting worse and worse and Spyware Doctor is the highest rated antispyware. It will fix your problem.