1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

possible malware called white smoke

Discussion in 'Security and Privacy' started by BillB, 2011/02/03.

  1. 2011/02/03
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    A friend of mine keeps getting something called White Smoke translator on their machine. There's a pop-up window that comes up at boot time asking you to sign up, the only way to get rid of the window is to use alt+F4 to close it. Doing some research, I found that there is a legitimate program called White Smoke translator, however, what they have apparently isn't legitimate. Malwarebytes and Superantispyware seem to be able to clean it up, but somehow it keeps coming back, not sure if it's from a site they are visiting or from something in an email. This person doesn't do a lot of surfing, so this is kind of strange.

    I was wondering if anyone has heard of this or has any idea what site(s) it might be coming from so I can pass the information along to them. This is the third time they have been bothered by it so far.
     
    BillB,
    #1
  2. 2011/02/03
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    PeteC,
    #2


  3. to hide this advert.

  4. 2011/02/03
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    Hi PeteC,

    I don't have the PC with me, they were asking me about it so I thought I would post and see if anyone knew anything about it before asking them to bring it to me, since it seems to be cleared up when they run the scans.


    Thanks
     
    BillB,
    #3
  5. 2011/02/03
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Bill - these statements are at odds with one another :)
     
    PeteC,
    #4
  6. 2011/02/03
    MrBill

    MrBill SuperGeek WindowsBBS Team Member

    Joined:
    2006/01/14
    Messages:
    4,328
    Likes Received:
    270
    Did they run MalwareBytes? When scans are run, it is best to post the results in the proper section. Experts on here can read the logs and tell you more.
    http://www.malwarebytes.org/
     
    MrBill,
    #5
  7. 2011/02/03
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    What I mean is, it gets installed on the machine, somehow, they are not sure, I'm guessing from some site they visit. Malwarebytes and Superantispyware are able to get rid of it, then after surfing for some time (not sure how long) they say it is there again. Apparently they go for days before it reappears.

    I was just curious if anyone has seen this before or have any idea where they may be picking it up, nothing I could find on it points to any particular point of origin.

    If they contact me again about it, I'm going to have them bring it to me so that I can post in the malware forum.
     
    BillB,
    #6
  8. 2011/02/03
    MrBill

    MrBill SuperGeek WindowsBBS Team Member

    Joined:
    2006/01/14
    Messages:
    4,328
    Likes Received:
    270
    That would be the best thing to do. I bet that it isn't really gone. Lurking someplace and pops back up when it wants to.
     
    MrBill,
    #7
  9. 2011/02/03
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    White Smoke is rather nasty trojan, so without seeing some logs there is no way to tell what's going on on that computer.
     
    broni,
    #8
  10. 2011/02/03
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    Ok, I'll send them an email and ask them to bring the machine to me. Thanks Broni.
     
    BillB,
    #9
  11. 2011/02/03
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Sure thing :)
     
    broni,
    #10

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...