Gumtree - Beware

[Howard]

Was looking for some things on Gumtree today , and picked up a nasty virus.

ThinkPoint

Basically nearly stopped me from using the computer , even started in safe mode . Couldn't connect to the net , nothing.

I have since found out that a few other people have got the same thing from Gumtree , so everyone just be wary if on there.

I'm usually pretty good , and don't get caught out by these things , but did this time.

All cleared up now with the help of a second laptop and malwarebytes.

 

[Geezer]

Did you click a pron link?

 

[Howard]

No , always careful to avoid pron.

 

[jadefox]

LOL that's not what you told me Howard!!!!!!!!!! :-0

 

[Blackman]

You mean you followed someone's link in their ad description?

 

[Howard]

Nope ...

I'd looked at a few ads , i then clicked on one and a Java box popped up.

Uh oh ! thought i , and started to close the boxes , next thing this Thinkpoint thing had taken control of the laptop and stopped me from doing anything.

It performed a fake scan of the system and told me that i had multiple viruses. It then prompted me to spend a load of money on a virus program to 'fix' it , or i could click 'cancel' , clicking cancel just brought it round in a loop to the start again.

 

[Blackman]

That's something Gumtree should be taking care of, not us...Good to know anyway.

 

[Howard]

I wasn't suggesting that we should fix it , just warning everyone as i know a lot of us use it.

 

[trainer]

I had this sort of thing happen a few years ago where I was told I had viruses and needed to pay for a antivirus package. I found a fix called smitrem and it wiped them all out.

It seem that you just don't know where these things lurk.

 

[manalishi]

Are you saying that the virus automatically installed when you opened a Gumtree ad?

Or that you (inadvertently but understandably) clicked on the wrong bit of a pop-up* and installed it?

* meaning that the virus writers mimic Windows system messages, and that what looks like a 'Cancel' button is nothing of the sort

 

[nick mercedes]

Are you saying that the virus automatically installed when you opened a Gumtree ad?

Or that you (inadvertently but understandably) clicked on the wrong bit of a pop-up* and installed it?

* meaning that the virus writers mimic Windows system messages, and that what looks like a 'Cancel' button is nothing of the sort

It's in the banner ads on websites:

Security Bulletin - ThinkPoint Malware spread via Banner Advertisements

 

[manalishi]

Thanks - I see there: "upon visiting these sites you may be presented with either a fake Adobe Reader 8 Install prompt or a Microsoft Security Essentials “Infection Found” pop-up window." So that's how it gets you to OK the virus install.

Interesting to see that the rogue banner ads also appear on YouTube and MSNBC.

 

[msjs72gs6tvmb]

I had exactly the same problem today

I had exactly the same problem today.

Went to Gumtree to search for a job and opened about 6 different links for jobs and then I got a fake virus scan saying I had viruses which I promptly shut down only to find that nothing worked on my laptop from thence forth (not even control panel or system restore or the internet).

After much panic, I restarted and then pressed F8 to get to Safe Mode then did a system restore to 4 days earlier before I could get my laptop back.

I'm currently running a full system scan to see if any viruses are still left on my laptop.

So, thats my Gumtree days over.

Shame, 'cos you can get a few good bargains from genuine people on gumtree.

 

[jonnyboy]

Thanks for the warning.

Not the best site anyway as when you email an advertiser, they reply from their own email address. If you mail a few at once the only way you can tell who the reply is from (if you even get one) is by looking at the code number attached to the listing description then trying to trace it in your pc history

 

[Howard]

If you do get thinkpoint , i followed the instructions in the link below to get rid of it.

http://deletemalware.blogspot.com/2010/10/how-to-remove-thinkpoint-uninstall.html