QQ Virus

It is extremely common to use a Windows computer in China on the "Internet", and just by opening Internet Explorer, have a bunch of pop-up windows appear showing pornographic images that are unwanted. Pornography that is supposedly illegal in mainland China.

"Nothing can be done about it, it is a virus."

Having downgraded to a Windows version prior to Vista (to help with thermal problems on this laptop), I can definitively debunk that theory. I got the pop-up window problem upon opening the supposedly secure IE7. I also got errors opening drives in My Computer. It seemed to be the "virus" one normally sees.

Alas, Spybot Search and Destroy, Adaware, and ClamAV found nothing. Then I ran HiJackThis, after seeing many forums helping users infected with spyware have the users run it to see what was odd with their Windows installation.

I noticed a lot of IE toolbar crap installed by QQ (the Chinese equivalent of MSN Messenger, but overloaded with way more crap, and unfortunately very popular with Chinese internet users). IE7 being supposedly more secure, it did not display these buttons. But after removing all of the QQ-related garbage from IE, I no longer saw the unwanted popups. So the code ran somehow, even if it did not show anything on the screen.

On my next computer, QQ will get its own virtual machine so I don’t have to waste my day dealing with the effects of its installation or the fact it doesn’t work if the user is not an Administrator.

Also, I hope the people responsible (along with the evil people at 3721, creators of the CnsMin spyware) will eventually be punished for the enormity of their wrongdoing.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: