Anybody else been hit with the Russian spyware attack of VBS:Gamaredon-CM

[Two on Tour]

Both our pc's at home have been attacked with this Russian malware.
Our AVG anti-virus caught it, but it has quarantined all my Thunderbird email accounts and a few other parts of our system.

 

[Jimbohorlicks]

Not heard of that one but thanks for the heads up.

 

[irnbru]

Both our pc's at home have been attacked with this Russian malware.
Our AVG anti-virus caught it, but it has quarantined all my Thunderbird email accounts and a few other parts of our system.

How would we know? Does something pop up on the screen?

 

[Two on Tour]

How would we know? Does something pop up on the screen?

Your anti-virus should do if you keep it up to date.

 

[Andacami]

Yep AVG caught it for me. Thunderbird email, prefs.js. Could also impact Firefox browser and other Mozzilla based apps.

Yikes!!!

^{_{Subscribers  do not see these advertisements}}

 

[Two on Tour]

Yep AVG caught it for me. Thunderbird email, prefs.js. Could also impact Firefox browser and other Mozzilla based apps.

Yikes!!!

Just trying to find a way of getting rid of it now !!
Do you have the full version of AVG or the freebie ?

 

[Andacami]

Just the one PC so far...

 

[Andacami]

Just trying to find a way of getting rid of it now !!
Do you have the full version of AVG or the freebie ?

Full.

I use Revo uninstaller to get rid of Thunderbird and all its files and registry settings.

Just rerun AVG, all clear.

Emails via web anyway

 

[Andacami]

AVG have definition and program updates this evening, worthwhile installing them of course.

 

[Figaro]

What are Thunderbird emails ?

^{_{Subscribers  do not see these advertisements}}

 

[Just smiffy]

I’ve got an iPad…. The only virus I’ve known over 8yrs is covid….

 

[Andacami]

What are Thunderbird emails ?

Thunderbird is an email program from Mozzilla. It is used to read and compose emails on your computer.

 

[Figaro]

Same as Outlook or Gmail ?

 

[Taran_Las]

I only get a virus if I go to iffy porn sites.

 

[Realist]

I only get a virus if I go to iffy porn sites.

You as well.

^{_{Subscribers  do not see these advertisements}}

 

[Andacami]

Same as Outlook or Gmail ?

Yep. Although Gmail is more of an app as it's primarily web based.

 

[the1andonly]

I only get a virus if I go to iffy porn sites.

my son ( it guru) says thats now an old wife tale as porn is such a legit business now that they cant afford to be associated with virus's. More likely to be ifffy game forums.

 

[icantremember]

Both our pc's at home have been attacked with this Russian malware.
Our AVG anti-virus caught it, but it has quarantined all my Thunderbird email accounts and a few other parts of our system.

Yes, it was picked up and quarantined by AVG.

I only installed AVG about 10 days ago after I removed Kaspersky having been warned it could be a problem.

 

[Gellyneck]

What are Thunderbird emails ?

Same as Outlook or Gmail ?

In simple terms Thunderbird is an email client for managing your email accounts.
Instead of having to log into multiple GMail \ Outlook \ etc email accounts you can link them all to Thunderbird and view \ use all your accounts in one screen \ desktop.
I've got about a dozen email accounts linked to Thunderbird so one login \ password instead of twelve! One of these accounts has 100's of masked accounts associated with it.

 

[Gromett]

False positive I believe.

^{_{Subscribers  do not see these advertisements}}

 

[rod_vw]

VBS:Gamaredon-CM was secured by AVG yesterday when I accessed Facebook! It happened twice then I guess Facebook got rid of it off their systems.

 

[Gromett]

AFter doing more research on this I am inclined to believe that this is a false positive.

VBS is for visual basic script... .js files are javascript and are nothing to do with VBS.
Gamaredon are a spear fishing outfit who target the people they want to attack. Usually organisations. They do not do widespread attacks like this appears to be.

Due to this and the widespread nature of the reports that happened right after a signature file was updated I believe this is a false positive and I wouldn't worry about it.

 

[Gromett]

Microsoft discloses new details on Russian hacker group Gamaredon

Join today's leading executives online at the Data Summit on March 9th. Register here. The Russia-linked threat actor Gamaredon, which

maislsenders.com