Please enable javascript to view this page in its intended format.

Queen's University
 

Help and Support

LizaMoon Virus

 

ITServices began seeing a new virus, "LizaMoon" on campus on March 31, 2011.

 

LizaMoon operates on legitimate webpages and sends users to a fake antivirus alert site, warning them that their computer may be infected. Following the instructions for removal actually infects the user’s machine.

 

For more information:

 

http://www.eweek.com/c/a/Security/LizaMoon-Mass-SQL-Injection-Attack-Escalates-Out-of-Control-378108/?kc=EWKNLNAV04042011STR1

 

Sample Screen Shots

 

What you see may vary, but will look similar to the screen shots shown here. Some sample names we have seen used include: MS Security Center, MS Security Tool, Win 7 Internet Security 2011.

 

You will see the following message:

 

fraudulent warning message

If you choose, "OK", you will be directed to a fraudulent antivirus website. If you have seen either of these messages and followed the links, your machine is most likely infected.

 

fradulent security assessment image

 

screenshot of infection screen


Help & Support

 

If you believe you are infected, you can bring your computer to the ITServices MicroRepair Depot in the lower level of Stauffer Library. We will remove the virus for a $25 fee. Due to high volumes, there may be delays in our usual turnaround time.

 

ITServices strongly recommends that you back up any required data. We do not believe that the virus infects memory keys.

 


Copyright Queen's University

Kingston, Ontario, Canada K7L 3N6 613.533.2000