Premier Opinion (adware)

[Cazale]

Anyone any experience in removing (and preferably, preventing) Premier Opinion? For some reason Sophos doesn't remove it, or even detect it as malware.

 

It is installing itself over and over and in a number of different ways (service, executable, browser extensions, etc, etc). I'll remove it, clean the PCs, stop the service from starting, remove the browser extension, delete the folders, but come back a week later and its all over the shop again!

 

Really not sure why Sophos isn't identifying this as a virus, it is, to all intents and purposes, a virus in how it behaves. It isn't something I've installed, and they're doing something really snide to keep reinfecting the entire network!

[liveman2]

You could use applocker. This could prevent unspecified applications from running, although you would need to create a whitelist. It's also not guaranteed to protect against every single kind of virus.

 

https://technet.microsoft.com/en-GB/library/hh831440.aspx

[Cazale]

Thanks, that is something I've looked into previously, and definitely something I'd like to implement in the future. For now I'm looking for a quick fix and hoping someone might have come across this before/knows a way to prevent it from reinfecting PCs.

[liveman2]

Is it infecting an entire machine or just profiles, are are the profiles linked in any way i.e. Staff or Students? Also is it the same couple of people?

[Cazale]

I think it is spreading through profiles (although, it does seem to install into program files). I'm fairly sure this is the issue, I clean, everything is fine for a short time, an infected profile logs in and boom, infected PC again.

 

I've created a script that runs at logon that stops and disables the service and looks for all the files/folder, and deletes them all, and I also installed the Chrome ADM and turned on domain wide white-listing for extensions (it returning to Chrome constantly seems to be the issue, or at least, the most visible issue).

 

Unfortunately I didn't get time to test yesterday (so haven't implemented it yet), but I'm hoping attacking it on all fronts should wipe it from the network pretty quickly (touch wood!).

[liveman2]

Have you checked the appdata folder? The program files folder can be virtualised to this location on win Vista+ and this would explain why it is able to install without admin privileges, and replicate itself.

 

Specifically: C:\Users\%USERNAME%\AppData\Local\VirtualStore\Program Files (x86)\ P R O G R A M N A M E

Edited December 10, 2015 by liveman2