Infeced by Punch's Virus? Helpful tips on removal

[kineda]

Ok a bunch of us seemed to have been infected by that russian website from the "Big Hole" thread in pics/vids. The virus is win32/clspring.fa not a real dangerous infection but a pain in the ass to remove. After initially scanning the pc it removed 2 files as being the virus, spybot found a few entries as did adaware. i manually browsed through the registry removing added garbage from hklm>sw and hkc>sw thought i had it beat, booted up today and started getting more command prompt scripts running from %userprofile%\local settings\temp. scanned those files with antivirus and spyware but were not detected! ended up running filemon from sysinternals and found 2 running processes that seemed a little odd, c:\program files\common files\{24-8e5529-0257-1033-1029-040408190001}\ update.exe and services.dll these seemed to be what was propegating the scripts. i also went back and removed any references to that dir from the registry. if you are still fighting this little bastard take a look for what i listed and let me know if you find anything different...

-philip

[worduphomefry]

pwned

[Xtort]

Heh, would have just did the ol' F12 just for shits and giggles. But thats on other peoples comps, heh.

[sturte30]

Weird...I clicked the link the other day and didn't get a virus. Hooray for me

[HopAlong]

Im not sure what happened with the computer I was on yesterday but IT here at the clinic has yet to contact me.

[D3thM3tal]

It came from a xbox 360 popup. The link was taken down, but I was cleverly able to find where he got the link and got the popup at school... I dunno if the pc is infected, I even clicked on the popup, but no virus warning... Maybe those compys dont have protection...

[Xtort]

heh, maybe you just haven't found out your infected yet. Maybe our virus software doesn't completely suck after all.

[CleanLX]

I got a virus from Punch.

......it burns real bad.

[mnstang]

no virus protection here.

you get the full effect this way.

[LES]

Got it here too , spyware shit. I tried to use WINDOWS to get rid of and my office client scan couldnt do it either, soi I did a Windows Return to previous settings for 2 days B4 i got it, wich was on Monday and its GONZO now.

[punch]

If you used Firefox you sould be fine, IE.

When I origonaly posted the link there was no malware, the link got on digg and then whoever runs that site added some malware after the fact.

Sorry for the bad link, but this is why you use Firefox + antivirus + antispyware at all times!

[Video_Master]

Hmmm, I didn't have an issue with the site.

[Stock GT]

i HAD NO PROBLEMS

[StangerJon]

my computer is bullet proof, not even free internet porn can phase this bad boy.

[LX Sport]

i HAD NO PROBLEMS

except it some how turned put your caps lock in reverse mode...