Device may be infected with malware

[Nadine5]

Hi

Received email & letter from Virgin Media that malware (nymaim) was detected on our system on 25 February.  We always use ESET anti virus on PCs, so ran scans as an extra check and nothing detected.

Now another email that we 'may' be infected with malware on 22 March (avalanche-andromeda)

No contact details provided for help from Virgin.  Could not access suggested 'Web Safe' software provided by Virgin.

Several questions, if a moderator could respond please:-

• Are there are ever 'false alarm' detections?
• Could this be detecting malware which is then also/at the same time picked up by ESET?
• Could a visitor's phone automatically trying to connect to our broadband be detected?
• Are these letters/emails anything to do with our recent switch to Virgin Media domestic supply - for years we were with Virgin Business on the same home PC network without any such warnings?

We are at a loss to know what we should do next as the correspondence from Virgin contains so few details.

Thanks very much.

[Gareth_L]

Hello Nadine5.

Thanks for your first post and welcome to our community.

Sorry to hear you have had a virus warning.

It may well have been passed on through a rogue email or like you said a visitor that has connected to your WIFI.

It can also be linked to firesticks etc. 

Do you have any devices barring your mobile, laptop, Pcs that are connected via Wifi.

It might be best to factory reset any of these.

Can you please check if you can access your Webmail as this may have been locked as a precaution.

If so it would be best to change the passwords to one you haven't used before.

Gareth_L

[Nadine5]

Thanks Gareth. Can’t think of any devices other than PCs & iPhones/iPads so doesn’t seem like much else we can do.

[John_GS]

Hi @Nadine5 

Thanks for coming back to the thread, were you able to follow the instructions on the letter, doing malware scans and also password changes?

Best wishes.

[Anankha]

Try running these programs:
MBAM free: https://www.malwarebytes.com/mwb-download/ ensure scan for rootkits is enabled.
Eset online scanner: http://www.eset.com/us/online-scanner/
Adwcleaner: https://www.malwarebytes.com/adwcleaner/
Also check the router to see if there are any unknown connections:
https://www.f-secure.com/gb-en/home/free-tools/router-checker

If these find one or more infections but do not fully remove them it will be wise to register with a malware removal site to receive dedicated malware removal instructions, an expert will remain with you throughout the process until confirmation that your PC is 100% clean.
Malwarebytes virus/malware removal forum:
https://forums.malwarebytes.com/forum/7-windows-malware-removal-help-support/
Bleeping computer malware/virus removal forum:
https://www.bleepingcomputer.com/forums/forum22.html

[Nadine5]

Thanks for the detailed response Anankha.  We already have a paid subscription to ESET, so I am not sure that any free scanning programs will be an improvement on this.  ESET already removes threats as they are detected and we have since run full scans that did not pick up anything.

I was really hoping for more detailed information from Virgin - eg a list/number of the devices logged in on the relevant dates so we can at least see if there was any unusual activity via the router.  Is f-secure which you mention below recommended by Virgin - we don't want to inadvertently download/cause more problems.

[Nadine5]

Hi John - as per my original post we have scanned all of our PCs using ESET, which is already constantly running anyway (subscription version as recommended by our IT support).

Also, as mentioned above, the only other advice in the letter(s), apart from coming onto this forum (no phone help for example) is to use Virgin's 'Web Safe' - the links to this on your website do not work, we just get an error message 'Sorry, changes not saved'.

Which password changes are you recommending, as we do not use Virgin Webmail (mentioned in your colleague's first post)?

Thanks very much

[Anankha]

I would still run those tools as no antivirus software is 100% effective. 
F-secure is Virgin Media recommended AV software. I am a volunteer moderator on the Microsoft Community & help people with infections amongst other PC problems. 

If you prefer not to follow my advice then that’s fine. 

[PeterB]

I've had the same letter/email. We did scan all our devices a week or so ago with Norton or Defender depending on computer, and I guess we'd better do it again.  However, it did occur to me that we have a number of other types of devices that connect to the internet - if not the wi-fi but it's not clear how we can run virus checkers on them.  For example, the car charger box is wifi connected as is the inverter for our solar system and I think the car itself.

Any ideas on that?

Ideally I'd like to be able to interrogate the hub and through that the attached devices in the same way as apparently the people who identified the potential problem presumably did. Just to try and identify the device to check.