Spectrum Malware Bot Detected

TheJesusNinja · October 2018

Has anyone else gotten this message while on Lulu? I have gotten it three times this week. It says "spectrum botnet malware detected on your computer." And there is a graphic that appears on screen with a link for me to download a scanner. I find this strange for an IP to contact you this way especially since I have none of their software on my pc. I have ran all scanners I have and found nothing. I did a fresh install from a backup I have and the warning came again today on this site again. I check Google and found some others have found this on their pc as well but never find anything after scanning.

Just Kevin · October 2018

No I have not seen it. It's strange you only see it here because they usually embed on to PCs and you would see it all the time. (unless it's hidden in Lulu's own servers.) But what is telling you it detected it?

https://heimdalsecurity.com/blog/all-about-botnets/

Paul_Lulu · October 2018

Not something I've heard anything about, but I'll forward this to our IT folks to be sure we don't have anything malicious lurking in the bowels of Lulu's site.

TheJesusNinja · October 2018

When I clicked on either revenue or projects, can't remember which a graphic popped that had Spectrum logo on it. It said they had detected a malbot on my pc and to click on the link to download their scanner. I ignored it as that's how they get things downloaded onto your computer. It's happened three times and each time it was on this site. I ran all antivirus and malware scanners I have and found nothing. I even went to Spectrum website and ran their scanner and found nothing. I did a fresh install of windows from a backup and had the graphic pop up again. I'm still checking my pc just in case but thought I'd make you aware of it just in case something got into the site somehow. What is strange is how Spectrum would get a graphic on my pc when none of their software is installed. But I've logged on a few times since then and it didn't happen this time. So I don't know.

TheJesusNinja · October 2018

Kevin these can be installed by clicking on links embedded on websites. Even clicking on a graphic. What a malbot does is turn your pc into a server which they then use to connect to other pc's. They are very hard to detect. And was not accusing Lulu of anything. I'm just alerting them just in case. And wanted to see if anyone else had it happen. I'm giving my pc the once over to see if it's on my end.

Just Kevin · October 2018

Kevin these can be installed by clicking on links embedded on websites. Even clicking on a graphic.

Yes, I know, but they download and install on to PCs and start to appear no matter what site you later visit, or even when you first log in to Windows.

What a malbot does is turn your pc into a server which they then use to connect to other pc's.

Yes, I know. I even pasted a link that said that and more, did you click it? ...

They are very hard to detect.

Depends what you scan with. As I asked before, what scanner told you it had 'detected' it?

And was not accusing Lulu of anything.

Hardly anything you can accuse them of. It's not unusual for sites to have malicious software hacked in to them.

I'm just alerting them just in case.

Indeed. But once on a PC, and you have some scanner running, then the warning should pop up all the time.

From what I can tell, Spectrum themselves are legit.

And wanted to see if anyone else had it happen.

Seems not.

I'm giving my pc the once over to see if it's on my end.

Some malware and viruses, etc., are also able to embed in to the CPU, and they are almost impossible to shift because they are still there even if you reformat the HD. Happened to one of my sons once.

Anyway, there's these >> https://www.antivirusbest10.com/best-anti-malware-software

TheJesusNinja · October 2018

I already use most of those. I have ran five different programs including the Spectrum bot scanner and MS Malicious File Remover. They didn't find anything.

Just Kevin · October 2018

Very strange.

Did you try them in Safety Mode? Or just after POST?

Skoob_ym · October 2018

TJN, this is probably what's known as "Scareware." It can be linked to a website, or a cached copy of a website on your PC, or to a portal you go through, or to toolbar/BrowserHelperObject (BHO) that you may have inadvertently installed.

The goal is to get you to "Download the Scanner" which then encrypts your files and makes you pay a ransom. After which, you may or may not get the unlock code and instructions.

My advice:

1.) Back up all of your work, regularly (daily?), and in more than one place. At least one copy should be on your person or off the premises, in case of fire / flood / hurricane / alien invasion / zerg rush.

2.) Run your scanning software / Antivirus

3.) In your browser, select settings and manage add-ons. In IE 11, for example, you do this by clicking the gear in the top right and selecting "Manage Add-ons." Make sure that there are no Browser-Helper-Objects, including toolbars. Also check search providers and make sure that only search providers you have specifically chosen are present.

4.) On the PC operating system, go to settings and select "Programs" (in Win 10, might be called "Apps"). If you see programs that you cannot identify, google the names of them to see what they are. If there is a new game program that you did not install, uninstall it. For all programs you did not install, uninstall (but google first!).

5.) Go to the startup folder and look for possibly malicious startup items. In Win 7, open a command line and type MSCONFIG <enter> then examine the items on the start-up tab.
In Win 10, right-click the taskbar at the bottom of the screen, then select "Task Manager." Use the start-up tab and the services tab to find and remove unexpected start-up items (GOOGLE THEM FIRST). Restart when done.

6.) Try using a different browser. This will identify whether the source of the issue is in the Browser or in the OS. If it happens in all browsers, the OS has issues. If it happens only in IE, for example, consider uninstalling and reinstalling IE.

TheJesusNinja · October 2018

I use Windows 7 Pro. Don't like Ten as it has huge privacy issues. So no apps or new icons on pc. Did a fresh install months ago and after running all scans made a system image which was stored on an external drive. That copy is what is on here now after I got the popups. I basically have 3 copies of that stored up. I use Watchdog which shows me startup programs as well as hidden ones and lets me disable or remove them. Nothing there so far. The only change is I used Waterfox browser instead of Firefox now since it doesn't support some of my addons. But I used them in Firefox for years and never had this happen. I will try another browser and see if that changes anything. Like I said I did have a clean fresh installation on an external hard drive and I put that on last night after formatting the drive. The pop up showed up again today after clicking the same link here. I have a clean installation of Firefox from two days ago and will use that to test as you suggested.

TheJesusNinja · October 2018

I checked MSconfig, nothing there but MS, firewall, graphic drivers,and Intel. Adobeflash is there but I had it disabled.

TheJesusNinja · October 2018

Going to use Firefox for a few days to log on here. There are no addons and see what happens.

Just Kevin · October 2018

This advice may help https://www.reddit.com/r/techsupport/comments/8numwk/spectrum_isp_botnet_warning/

Just Kevin · October 2018

do you have this? https://www.zonealarm.com/software/free-firewall/

Just Kevin · October 2018

MSCONFIG can also be found via the Windows searchbar (click Start, it's just above it.) When it lists it just click it.

Paul_Lulu · October 2018

The consensus on our end is that the scanner was likely triggered when navigating from mixed content (http and https) to a fully secured (https) page. We think this may have just triggered an over-eager scanner that Spectrum provides. Our research into this scanner seems to indicate that the tool itself is not dangerous.

Just Kevin · October 2018

Indeed, from what I can gather that warning is actually from his ISP, and some are known to use Spectrum in their servers.

TheJesusNinja · October 2018

I think it's as Paul said , something in the mixed content on this site. It doesn't happen anywhere else and it's on the project link or revenue.

Spectrum Malware Bot Detected

Comments