New York Times Site Pop-Up Says Your Computer Is Infected

Zott writes "Apparently, 'some readers' of the New York Times site are getting a bit more with their news: an apparently syndicated adware popup with a faux virus scan of the user's computer indicating they are infected, and a link to go download a fix now. It's entertaining when a Mac user gets it, but clearly downloading an .exe file isn't a good way to keep your computer clean ..." Update: 09/14 03:20 GMT by T : Troy encountered this malware, "and did basic forensics. Summary: iframe ad then series of HTML/JS redirects, ending at a fake virus scanner page with a "Scan" link (made to look like a dialog box button) that downloaded malware." Nice explanation!

Comments

It's very entertaining.

[Anonymous Coward]

I think it's actually more entertaining when I don't get it at all on any platform, because I disabled javascript.

Re:It's very entertaining.

[PlusFiveTroll]

FF + Adblock is my way to avoid it (and still get the sites I need .js to run on).

This crap has been going on for a few years now with the 'AntiVirus XP' scam (http://www.theregister.co.uk/2008/08/22/anatomy_of_a_hack/) that seems to strike major sites every few months. Just goes to show the ad distributers have no control ( or don't want it) over what goes in to their distribution network.
 
 

Sad this is, people fall for it all the time :(

Re:It's very entertaining.

[Anonymous Coward]

The newest version of the "Antivirus 2010" software is a pain in the ass to get rid of. It rootkits the system and makes manual removal pretty much impossible without a WinPE boot disk of some kind, and even then it's difficult to find all the instances. There's one tool I found to remove it and most of its kin, and that is combofix. It successfully cleans Antivirus 2010 and a host of other rootkit-based malware in a process I can only describe as "magic". I'm just posting this to help out others that have spent way too much time trying to get rid of this crap off of friend/family computers.

Re:It's very entertaining.

[Z34107]

I completely agree with "combofix rocks." My job at the college I attend is pretty much removing that virus 24/7 from student laptops, and I've learned a few things:

1) McAfee sucks. We supply a copy of the Enterprise version to students, and a patched installation is required for internet access. Somehow, we're still inundated every semester with the latest flavor of AntiVirus ModelYear.

2) ComboFix is amazing. It's simple, but it automates a lot of tools that are a bit of a pain to use on their own. Ten minutes, and most malware is somewhat neutered.

3) MalwareBytes is amazing. ComboFix always misses stuff, but it lets us install MalwareBytes (also free) which finishes the job. I haven't seen any virus MB couldn't remove.

It's usually faster to run ComboFix + MalwareBytes (half hour between the tools in most cases) than it is to nuke it from orbit and reinstall Windows. Unless you're paranoid, two programs will take care of your end of your extended family's implied social support contract.

Re:It's very entertaining.

[capnkr]

Combofix does do a good job at catching and removing these things, but: rootkit.

Best to bite the bullet, and talk the client into a drive formatting and OS reinstall. Given that opportunity, you can also go ahead and do some system optimization, and with a vanilla-install source, get rid of manufacturer-installed bloatcrap. For about the same amount of time (and thus, price) that it would take to do whatever you can to ensure a clean system, they get a much better job. The system will probably be running better than when it was new, and you will be assured that the rootkit is gone.

Re:It's very entertaining.

[Pool_Noodle]

Don't forget the possibility of a carefully crafted PDF as a vector (have seen and had it happen) ... then there's the ever popular (and the numerous) Flash possibilities. Personally, I think its a lack of caring on the Ad distributors parts .. as long as the money keeps flowing they don't care what people distribute, much to the irritation of those who have to clean this junk up. My 2 cents.

Re:It's very entertaining.

[Zen_Sorcere]

The folks at Computerhope.com are a great resource for helping users fix their computers after something like this happens. They usually have the users asking for help run through a battery of programs, such as Avast!, SuperAntispyware, Malwarebytes, HijackThis, etc in order to catch most things.

Very helpful site for those pesky "antivirus" viruses.

Re:It's very entertaining.

[Hojima]

I personally use Comodo firewall, and it's one hell of delicate security guard. I have to turn it off when I install anything because I will be there all day clicking approve. It's not annoying when you know how to use it and change its settings (takes a nominal amount of time). I've had a lot of instances now when I even purposely download sketchy .exe files, and it alerts me right away about suspicious activity in the computer. Best of all it's free.

Re:It's very entertaining.

[davidphogan74]

You make people use McAfee to get online? That would be enough to make me transfer.

Re:It's very entertaining.

[Z34107]

In a perfect world, we would do that, but we get too many machines in and out to make that feasible. Then, there's all the normal luser problems: I don't know where my files are, I have no install media, I have no keys, I deleted my recover partition to save space, etc.

The foolproof way to remove the AntiVirus ModelYear rootkit is: Make a file-based image of the hard disk. By design, it hides from the file system, meaning it will not be included in a image made by a tool like ImageX from Microsoft's free WAIK. Gather an image and apply it to the same hard disk, and the rootkit's gone.

If you're adventurous, ImageX lets you mount the image file on a clean PC to do offline scans of its files and registry hives. You can clean a computer without ever booting it.

But, that's generally overkill. AntiVirus ModelYear rootkit isn't the nasty kind of hardware-hypervisor rootkit - it runs at kernel privileges. So does MalwareBytes. To be dangerous, it has to run at a higher privilege level than the removal tools.

For family members that promise me food, I go the extra mile and do the clean install for them. Staff machines we just re-image.

Re:It's very entertaining.

[hairyfeet]

Question-were you running NoScript as well? because while I have found that ABP does block a lot of attacks through ads, to really lock it down you really need NoScript as well. Why the browser manufacturers can't simply build in whitelisting for sites, instead of the current "all or nothing" approach, is beyond me. But until then it is Firefox+ABP+NoScript for me.

Re:It's very entertaining.

[Z34107]

I personally loathe McAfee - it interferes with ComboFix. But, I'm not IT, and you can technically remove it after your machine passes registration.

Re:It's very entertaining.

[davidphogan74]

It seems you can never fully remove a McAfee program without formatting and restarting. I'd probably just get a new hard drive, install Windows XP and McAfee on it, pass the system through, then swap in my normal drive. But, I am an IT nerd.

Re:It's very entertaining.

[killerdark]

I ran into this ad myself yesterday and thought it was very odd, because I am running FF and adblock plus, so I made a screen shot and did some searching on it.

Screen shot and info can be found here, it's clearly visible that I am running FF and you can see the Adblock logo on the top right:

http://www.winfreddekreij.com/all-tech-references/91-nyt-virus-alert-popups

Re:It's very entertaining.

[Z34107]

Their system registers MAC addresses, meaning you could also register a VM if you had its traffic going through the host's adapters or if you cloned the host's MAC addresses onto the virtual adapters.

Re:It's very entertaining.

[Nirac]

I'm gonna give a second thumbs up to the 'combofix + malwarebytes' errr...combo. Rarely do I have to go further than that to clean a users' machine at my job. I just wanted to add a tip I've picked up at work--
If a machine is infected with something that prevents you from installing a program (and also prevents Combofix from running), just change the name of Combofix. I usually just change the first letter, and that's enough to get it going. Like the guy above me said, Combofix won't solve all your problems by itself, but once it runs that will usually clean it up enough to let Malwarebytes install and finish the job.

Re:It's very entertaining.

[killerdark]

I was using the easylist subscription for adblock plus btw.

Re:It's very entertaining.

[capnkr]

That's interesting, and I'll be reading more on it. It doesn't look like it would work in my environment, though. Most of my business involving this sort of scenario deals with a broad range of consumer-level systems running XP, by and large. Using slip-streamed install media, my actual time 'at the keyboard' for reinstall, optimization, and cloning is generally under 2 hours, though it takes a little more than that total for the process to be done. Still, I wonder: How much time does it take you to create and then apply an image using that technique? Reading this WAIK page - there's no support for XP SP3? That seems odd. Has the page just not been updated, or is that for real?

Re:It's very entertaining.

[davidshewitt]

It successfully cleans Antivirus 2010 and a host of other rootkit-based malware in a process I can only describe as "magic".

How do you know that it successfully cleans it out? Most viruses are closed-source, so you have no idea what's in them. Some are very, very clever, and hide in ways that software cannot detect, especially the rootkits. My policy is that the only way to be SURE that the virus is gone is to format the drive and reinstall the OS. Especially so if you don't know what the cleanup software is doing (a.k.a. "magic").

Re:It's very entertaining.

[Orion Blastar]

Sorry after installing Combofix, my AV program Spysweeper reported three viruses just got installed, and Unhackme reported one rootkit got installed on my system from software from that link. Also it seems to have destroyed the control panel and I cannot Add/Remove programs anymore.

I think that anti-malware software needs to be peer reviewed by reliable sources before we decide to use it or not. This seems to be just as bad as a fake "infected" ad infecting your system.

Lucky for me that I was able to remove the threats by other AV software.

Re:It's very entertaining.

[Z34107]

Sorry after installing Combofix, my AV program Spysweeper reported three viruses just got installed

Combofix is pretty much a glorified batch file that automates the operation of programs like GMER. Some of these programs are considered "hacking tools" by AV vendors. Another reason I hate McAfee: it will automagically "clean" my flash drive of most of my antivirus tools.

If you downloaded ComboFix from bleepingcomputer.com, it's a false positive.

Re:It's very entertaining.

[lenski]

Yup, it was sortof cute to see all those official-looking Windows-themed widgets showing up on my Linux-hosted Firefox.

It pisses me off but in a somewhat abstract way to see asswipes like that try to take advantage of people.

It would piss me off in a direct and non-abstract way if I ended up with the job of fixing my wife's Windows system if it were infected by some bogus malware. My wife is stuck using a Windows system to support a few necessary programs, and though we have multiple layers of protections I fairly sure she (a psychologist) is not prepared to mitigate these risks independent of my help.

I get so tired of the extra effort it takes to keep her system running. Damnit, we paid *extra* for Microsoftt software, we paid *extra* for many of the programs she depends on. My workstations are so much less labor-intensive and get so much more work done...

Re:It's very entertaining.

[erroneus]

I have often wondered why they haven't followed the money trail to find the people behind the "Antivirus 20xx" nonsense. I know I would certainly like to read a news story about the untimely death of the people involved.

Re:It's very entertaining.

[Anonymous Coward]

Owning a Mac is like owning a car when you live on a tiny island. You can drive, but you can't actually go anywhere.

Re:It's very entertaining.

[Deathlizard]

We Use F-secure here. I wish we didn't, especially when they tell us not to go to known malware sites to test if their protection is working (even though a studest is going to do just that). Makes you feel really secure doesn't it? I really wish we were running either Avira Antivir or Microsoft Forefront, since they seem to have the highest detection rates against roges so far, but we decided to give F-secure a second chance. I don't know why.

Anyway, Since we have a laptop program at the college, our answer is simple. You're getting a new hard drive and we will move your favorites, My Documents and anything on your desktop. I know students don't like this option, but they REALLY won't like their credit card being stolen, or worse; their identity. Usually when I explain to them that this method is the safest option and that ID theft has happened to students (Guess what! if you pay for Antivirus 360 at 79.95, it still doesn't work AND they got your $79.95 AND they got your CC number and all the info they need to start swiping away your credit score!!) they agree with it, but some just don't care as long as they can download movies ("My Friends Hot Mom". "Milf Hunter", ETC) or music (from Gnutella, where the music is usually trojans or piggybacking some sort of virus) all day. Most will be back infected within the month as well.

The worst one so far is TDSS.F. It runs a rogue DCHP server across your network and tries to infect anyone that connects through it. It also adds autorun entries to infect across hard and flash drives and likes to install file fixer pro, which encrypts all your files. Luckily, Bradford Campus Manager detects the DHCP rogue and denies them access (That's why many campuses do this registration now.) but our virus scanner always misses it.

Re:It's very entertaining.

[Culture20]

It's usually faster to run ComboFix + MalwareBytes (half hour between the tools in most cases) than it is to nuke it from orbit and reinstall Windows. Unless you're paranoid, two programs will take care of your end of your extended family's implied social support contract.

It used to be A rocked, and then A and B rocked. Then B started to suck, so we used A & C, then malware defeated A, so we used D & C (C had to be used second), with a splash of E. A came back with a new version, and we'll call it F. F'n rocked! Then it sucked. etc.

I could never be bothered figuring out which version of what software _really_ cleans up this week's malware. I always would nuke from orbit (after judiciously backing up data using the drive as a neutered USB disk).

Re:It's very entertaining.

[erroneus]

That is generally my approach. Once a machine is compromised, I insist that they are reinstalled from absolute scratch. Following that, I take an image file of that machine in perfect working order. And during checkups, if the machine is still in good order, I take another snapshot.

All applications should be reinstallable and all data should be stored on servers that are backed up routinely.

If those basic rules are followed, an infected machine is something of an embarrassment to the user and an inconvenience to the IT person. At worst, cleaning up the collateral damage like getting your IP addresses off of block lists because the infected machine had been spewing spam. (Followed closely by better firewall rules at the gateway...)

Windows is just going to have these problems. Mac OS X is going to have these problems. And if Linux ever gets popular on the desktop, it will have these problems. While Windows certainly has its problems, the biggest weakness is the user, and no amount of software tools or other preventative measures will fix that. In the immortal words of Ron White, "You can't fix stupid."

Re:It's very entertaining.

[Bigjeff5]

Yes, Imagex supports XP SP3 just fine. It's the automated distribution tools that do not work, for XP to use an image with more than one PC you still need to use sysprep and a custom install setup. The automated tools work with Vista up.

Imagex.exe will make an image of any hard drive or subset of any hard drive that windows can read.

What the GP was talking about was building a WinPE disk (WAIK will help you do that much for XP, pretty easy too), booting into it, and using imagex to image the drive, then formatting the drive and applying the image you just made back to the drive. Depending on how big your hard drive is, the whole process should not take more than a half hour or less, imagex is surprisingly quick. Just be sure you don't try to store your image file on the same drive you format, or you will have erased your image in the process.

I'm also not 100% convinced this process will remove a rootkit either, as a rootkit simply ties into a critical system file, which would be copied by imagex. He may be right though, and it wouldn't hurt anything as long as you don't make the mistake I just warned you about.

Re:It's very entertaining.

[brucifer]

I find it odd that you are having to use a "patched installation" to allow internet access when the default settings allow internet access. Also, if you're deploying it, or any enterprise AV tool, without using the central management software you're just making your life more difficult.

Re:It's very entertaining.

[dummptyhummpty]

You might also want to try SuperAntiSpyware!. It catches a lot of things MalwareBytes doesn't.

Re:It's very entertaining.

[Orion Blastar]

Yes I downloaded Combofix from bleepingcomputer.

I am not sure why it would be flagged as a false positive. I am suspicious of any program that says I have to shut down my AV software in order for it to run.

Luckily both Unhackme and Spysweeper removed it, and was able to restore my control panel as well. I noticed that ComboFix was not in the Add/Remove programs and I tried the "Combofix /u" to uninstall it only to be greeted with a file not found error.

I looked in the program files directory and it was not there, but on the root directory of my system under c:\combofix\ hidden as a system file with copies of iexplore.exe and other files. Easy enough to delete, but the uninstall didn't seem to work. Maybe the combofix.exe file was deleted as a virus?

Spysweeper reported it as Mal/Pack-A, Virus/Test, and one other I forgot, and Unhackme said it was the FU Rootkit. Kapersky said it was Trojan.Win32.Inject.ph. I would think Combofix would have been whitelisted by now as a false positive and removed from the detections, but apparently it has not.

Users need to be warned about false positives if that is indeed the case. I did a web search and it turned up web sites suggesting using Combofix, so I suspect it may be indeed a false positive. I can recall the BartPE and Retrago WinPE boot tools had some of their automated programs got detected as hack tools and removed via AV software as well. Maybe those Hack tools are effective at removing stuff the non-Hack tools don't?

Re:It's very entertaining.

[bigstrat2003]

I get so tired of the extra effort it takes to keep her system running. Damnit, we paid *extra* for Microsoftt software, we paid *extra* for many of the programs she depends on. My workstations are so much less labor-intensive and get so much more work done...

Let's be fair. The problem (no offense) is just as much your wife as it is her system, if not more. If you were using the same system, you would have few issues, if any, because you'd be more conscious of what you do on there. The many techies who successfully run clean Windows installs (of which I am one) are living proof of this. The biggest security flaw in every system is the user, and even in an OS with perfect security, there will still be virus-laden machines. We'll never see the day where all users care enough to learn to tell when something is a legit program, and when it's malware posing as a legit program.

Re:It's very entertaining.

[Z34107]

Yeah, it's a self-extracting archive of sorts, which explains some of the "pack" false positives. It wants you to disable your virus scanner, because most of them will try to delete ComboFix ^^. It is an amazing kludge of scripts, workarounds, and hacks (classical definition of "hack"), but you can't argue with what works.

Well, you can ^^. And if your tools keep your machine clean, do whatever works.

Re:It's very entertaining.

[onefriedrice]

Students have to have their machines pass registration? That would be more than enough to make me not even consider your college. Or maybe that's more typical than I realize... I hope not.

Re:It's very entertaining.

[Z34107]

No, we have no central management of the enterprise AV. Yes, it is painful. But, IT is a separate department - they make policy, we live with it, though they're all nice, smart people who are just hung up on McAfee for some reason.

Our DHCP server compares your MAC address against a list of "registered" machines. If there's no match, meaning your machine is unregistered, you get an IP address within a special "unregistered" subnet. The subnet is denied internet access, and any HTTP requests are redirected to the local registration website.

The registration website gives you a link to the McAfee installer. You then have to download and run a custom "validator" program that checks for the presence of McAfee, and then adds your MAC address to the approved list.

Yes, this can easily be circumvented, but how many people know how to do MAC sniffing/spoofing? Those that can probably aren't going to get viruses on their Winboxen.

Re:It's very entertaining.

[mysidia]

They need to take responsibility for what they publish on their own sites.

I'd like to see a class action suit against the NY Times or the ad network they use by users who were infected.

Based on NYT negligently allowing advertisers to inject code into their web site.

I can understand users getting hit with fake dialogs after clicking on an ad.

But I believe web sites have a duty to take standard precautions and avoid loading remote script code

I differentiate ad content from code. It's not rocket science -- when the advertiser uploads their ad unit, sanitize the input, so the upload cannot contain any javascript, SCRIPT, IFARME, FRAME, or other unexpected tags or tag attributes, for that matter, or any remote loading. Only approved 'safe' HTML tags such as IMG. And any images referred must be uploaded and served from the ad network (again, no remote loading).

Again, it's not rocket science to sanitize input. There's really no excuse for not doing it, other than negligently ignoring security issues, and possible harm malicious ads can do...

Re:It's very entertaining.

[Z34107]

This.

The discovery that it removed the rootkit was a happy accident. After a few unhappy incidents related to the aforementioned "luser problems," we've taken to making such a CYA image of every laptop that passes through our fingers, just in case.

After a scan found the TDSS rootkit on a laptop, I decided it would be easier to disinfect the backup image. I discovered none of the hidden TDSS* were even in the image, and concluded that the obfuscation techniques worked all too well.

Although the infected system files were indeed still in the image, the bulk of the rootkit hides in these hidden TDSS(garbage characters) files, which were not gathered, leaving the rootkit neutered.

Re:It's very entertaining.

[symbolset]

Well you should try Avira Professional then. They've got a Linux version and the FIRST 30 days are FREE. With on-access virus scanning you should have the most secure Linux ever.

Don't forget to get LGA as well. It will give you all the benefits of WGA, on Linux - with the added bonus that it's FOSS!

Re:It's very entertaining.

[brucifer]

Ah, so it's more of a Network Access Control and policy problem than a specific vendor problem.

This is one of those interesting things about the security/IT world. IT creates some wacky policy and whatever software they're pushing gets the blame. Not saying commercial software doesn't have problems, but I think the perceived problems are much larger than the actual ones.

Re:It's very entertaining.

[Machtyn]

Best of all Comodo's Internet Security package is completely free. This includes for business use. Something the other "free" offerings don't offer.

Re:It's very entertaining.

[hibiki_r]

I have: Some bonus form of malware that hides as a Firefox extension, and redirects 15% of google searches to some shopping site instead of the proper link. It was easy to remove with regedit once I knew what I was looking for, but malware bytes didn't hit it.

Re:It's very entertaining.

[arminw]

.....I get so tired of the extra effort it takes to keep her system running....

One way to fix this problem is to not have the Windows machine connected to the Internet if at all possible. I have some Windows only software which I run in a virtual machine (under OSX) which has no network connection. Only the Mac faces any kind of network. Of course, this does not work, if the software she is using on Windows requires the Internet for some reason. The Windows portion is never patched and has no kind of antivirus software on it whatsoever because it does not need it.

Re:It's very entertaining.

[Mr. Freeman]

"1) McAfee sucks. We supply a copy of the Enterprise version to students, and a patched installation is required for internet access."

It sucks and yet you require it on every student machine. Sounds to me like this isn't a student problem.

Re:It's very entertaining.

[iocat]

My gf got this. It does a neat job of blocking sites which have removal info. What's also awesome is that most of the purchased ads around malware bytes and spybot attempt to direct you to different malware sites. She won't buy a Mac. wtf.

Re:It's very entertaining.

[Undead Waffle]

It's fairly common these days... just to make sure people aren't connecting malware infested crap that hasn't been patched in years. Usually some form of anti-virus is required and sometimes they go a little overboard by requiring everyone turn on auto updates for windows machines. There was a slashdot discussion about it a little while back including quite a bit of discussion about Cisco Clean Access, the program some colleges are using for this authentication.

Re:It's very entertaining.

[sqrt(2)]

The last time I saw F-Secure was my high school. From what I could tell all it did was increase the boot time, they school still had virus and malware problems. Although maybe the problem would have been worse without it.

Re:It's very entertaining.

[LordLimecat]

Why has noone posted about just using an ubuntu boot disk? Simple removal process tends to be: Use sysinternals autoruns to find what needs to be removed, find them on ubuntu disk, move files to quarantine folder. Removal is generally done in 20 minutes, and all you need is a usb key with autoruns + an ubuntu disk. (or knoppix, doesnt particularly matter)

Re:It's very entertaining.

[rantingkitten]

The foolproof way to remove the AntiVirus ModelYear rootkit is: Make a file-based image of the hard disk. By design, it hides from the file system, meaning it will not be included in a image made by a tool like ImageX from Microsoft's free WAIK. Gather an image and apply it to the same hard disk, and the rootkit's gone.

I don't want to sound like "that guy", but really, that sounds like an awful lot of trouble to go through to protect an operating system that is, by design, vulnerable to such BS. The actual foolproof way to deal with these problems is to stop fixing them. Once users realise they can't just call someone to fix problems they caused themselves, they'll either wise up or use an OS that doesn't actively encourage this sort of behavior.

Yes, yes, that's a utopian ideal, it won't work in the real world, I know, I know. But really, by going through such enormous pains to protect users from not only their own stupidity but the shittiness of their operating system, you are empowering them to continue doing whatever stupid shit got them in trouble in the first place, because they'll think "support can always clean it up..."

In my company there comes a point when I just cut users off. They've inflicted whatever problem upon themselves, we've addressed it twice -- this is the third strike and they're out. It's not worth it to anyone to continue supporting people who insist on screwing themselves over, and the number one way they screw themselves over is by using an OS that allows them to screw themselves over so easily.

Okay, so I guess I do sound like "that guy". But how long are you going to continue mounting these Herculean efforts to rescue idiots from their own incompetence with a system that encourages their incompetence?

Re:It's very entertaining.

[oatworm]

I used to do this and, for a couple of years, it worked pretty well. Then I discovered a rootkit that installed itself as a system driver, which then led to me doing an eyeball check on the filenames in the %WINDOWS%\system32 folder. After discovering at least a few dozen "sydfh43423.sys"-esque files, I realized it was time to just give up on cleaning machines and go straight to wipe/reformat.

The other problem with the above method is that, unless you're really patient, you're not going to remove the hooks out of the registry (Offline Registry Editor is better than nothing, but still...). This means, at best, you'll end up with a bunch of "C:\WINDOWS\system32\asd438v95.exe missing" errors when you first boot up, and, at worst, you'll end up running that neat little .bin file hiding in your Local Settings file that started this mess in the first place. Honestly, your best bet these days is to just wipe and reload - it's the one cleaning method they haven't found a way to compromise... at least, not yet.

Re:It's very entertaining.

[Donkey_Hotey]

Er, you do know it has an "installation mode," right?

Re:It's very entertaining.

[Donkey_Hotey]

They'd just blamed it all on the bloggers...

Re:It's very entertaining.

[ohsmeguk]

At my uni, you have to run the "connect client" which checks that you have anti-virus, auto updates etc. if you are running windows.
Linux machines however, are fine on their own :)

Re:It's very entertaining.

[iknowcss]

To where? That's the story at every campus. Besides, if you run anything non-windows, your exempt. At least, that's the policy at my school.

Re:It's very entertaining.

[uglyduckling]

Any antivirus software will tell you that you need to disable other antivirus software in order for it to run.

Re:It's very entertaining.

[GNious]

'Sounds good - can you provide links to the OSX .dmg files for these programs?

Re:It's very entertaining.

[dougisfunny]

and if you use linux or OSX?

Re:It's very entertaining.

[Jeppe Salvesen]

This is one steaming pile of bull faesces.

Here's what works:

1. Think App Store. Applications must be signed and verified. This is painful, but will be done eventually for there is no realistic amount of user education that can prevent a sizeable portion from installing malware. This is fact is empirically verified every day in most IT departments.
2. Secure design. Making stuff both usable and secure is necessary.
3. Secure implementation. Better libraries, please!

Sorry buddy, think again about security. The room is chock full of pink elephants!

Re:It's very entertaining.

[cbhacking]

Ironically enough, IE has support for a form of whitelist-by-site. Basically, use the "Security Zones" feature (Security tab of Internet Options, or just double-click where it says "Internet | Protected Mode" in the status bar) and turn the permissions on the Internet zone way down. Like, no scripting, no plugins, no redirects, no downloads, etc. Disable unencrypted form submissions and turn on every signature check, or however you want to do it - just lock it down. No Flash or any other ActiveX (they're plugins), no .NET or Java (there might be a vulnerability), no JavaScript or VBScript, etc. In essence, make the Internet Zone act like the Restricted Sites Zone.

Then, go to the Trusted Sites Zone and put the settings where you want them to be (probably a little more secure than the default, depending on how paranoid you are about sites that you know) and put sites that you trust in that Zone. It's a bit more work, sure, but maintaining a whitelist always is. Besides, of the sites that you actually want to execute scripts and plugins, you probably have a handful that you visit regularly, and the rest can default to lock-down mode until you check them out. It might even be possible to use the Restricted Sites Zone as a "greylist" of sorts, if you set its security options similar to the default for Internet Zone. This would give you three tiers of trust, with the important point being that the default security Zone is the most-locked one.

As an extra benefit, this will function as a form of phishing protection - a URL that looks like it's legit (due to Unicode characters above 0x007F that have the same appearance as ASCII characters) will get thrown into the locked-down zone.

Re:It's very entertaining.

[TheLink]

So tell me which operating system isn't vulnerable to rootkits that can run the usual software that people want to run?

The popular Linux distros are vulnerable to rootkits too, and so far Macs are consistently the first to fall in the pwn2own contents.

Re:It's very entertaining.

[No Grand Plan]

If you turn it off when you install things, doesn't that kind of defeat the purpose of having it?

Not if you know exactly what you're installing.

Re:It's very entertaining.

[TheRaven64]

I run OpenVMS on a MicroVAX so I never have to worry about malware!

Re:It's very entertaining.

[hairyfeet]

Is it default allow or default deny? Because if it is default allow it is worthless, as by the time the page is rendered it is already too late security wise. Does it have an easy way to import blocklists like ABP? Because I really would hate to have to program site by site by site, especially if it is default allow, which would mean i'd have to go in and set preferences before I clicked on any links for every site I wished to visit.

Sounds like way too much work to me, kinda like how I have read about Opera users expecting someone to run privoxy just to get add blocking. Like I really want another program sucking up resources 24/7 just to block ads, and as I have seen with trying HOSTS files for ad blocking never seems to work as good as ABP and is a royal PITA to add new ad servers to. So while I appreciate that you like Opera, and am quite happy we all have plenty of choices when it comes to browsers now, after trying to use my oldest's Opera (he loves Opera and refuses to have FF installed) even with a fully loaded HOSTS file I found all the ads that got through quite irritating, so if I wanted a lighter browser I would probably just use Kmeleon CCF ME which has ABP built in.

Re:It's very entertaining.

[TheRaven64]

Only approved 'safe' HTML tags such as IMG.

...and hope that your clients aren't running a browser using one of the (many) versions of libpng that has had exploitable buffer overflow vulnerabilities.

Re:It's very entertaining.

[Z34107]

Not sure if you use Linux, but OSX gets a different "Oh, you're a Mac, click here to have a nice day" registration page without the AV check.

Us help desk people can always manually register a PC as well if you call us or bring your laptop in. It's there to enforce AV on Windows and have students agree to not pirate the internet for bandwidth and legal reasons.

Re:It's very entertaining.

[Z34107]

My annoyance with McAfee comes strictly from having to support it.

It seems to have a horrible detection rate, although I admit there's some heavy sampling bias. "By definition," every laptop on campus has the software installed, meaning I only see the infections McAfee misses. However, it seems to have a very narrow definition of "virus," ignoring most of the spyware and scareware stuff like Antivirus ModelYear. Most viruses also know how to disable McAfee and other AV - you might as well not have it.

On a significant percentage of student laptops, McAfee simply won't install. It installs partway, leaving you with unused by resource-intensive system services that you cannot remove or uninstall without some serious registry hacking or a reinstall of Windows.

On top of it all, it has a multi-process design. Normally, it's a (potential) hallmark of good software engineering, but all this does is defeat the normal Windows process scheduling mechanisms of capping each process at 50% CPU usage. McAfee can utilize 100% of your CPU, and will do so for up to a minute every time you boot your computer.

Definitely a wacky IT policy, but if they were pushing a good AV, it wouldn't be so bad. As far as the network access control stuff goes, what's pretty much a dhcpd script seems to work pretty well next to commercial products.

Re:It's very entertaining.

[Z34107]

Students generally learn pretty quickly. It costs them money to have our help desk fix their computer, even though a flat fee for however long it takes is cheap in the computer repair world.

Staff and faculty are another case. Lots of repeat infections, but they can't be cut off because half of them are Vice Deans, and the other half have a direct line to God Almighty anyways. Lots of politicking, and cutting off network access would pretty much mean they'd have to be fired anyways.

Not that I don't think we could use a 50% reduction-in-force, but that's a problem outside the realm of IT or technical support...

Re:It's very entertaining.

[ZouPrime]

"Think again about security"? After offering genious tips such as promoting "secure design" and "secure implementation"? Wow, you sure sound like someone who knows what he's talking about!

The parent is 100% right: almost all the time the weak link in security is the user, not the technology. Remove the user and most security issues are trivial to resolve.

Re:It's very entertaining.

[Dilpo]

Almost all anti-virus programs do not play well together. Nortan will yell at macafee while they're both yelling about AVG and all three of them will yell about combofix. Virus/Test is actually an industry wide standard string that if found will set off any anti-virus. In order for each of them to know what it is they have to have it stored someplace... which is one of the reasons why they'll yell and scream about eachother.

Re:It's very entertaining.

[Deathlizard]

although a lot of files still do the false extension stuff, that's not the case with the MP3's were seeing.

These are perfectly legitimate MP3 files. They are not rebadged WMP files. They will play music. they play on an mp3 player. How they work is that they usually have ID3 tag data which tries to exploit WMP or Winamp to execute code or connect to a malicious site. We also see the WMA's disguised as MP3's as well, but the ID3 MP3's have been getting more popular as of late.

as for hiding file extentions. There is a set of laws that I follow.

Laws of computer stupidity
1) 99% of computer users do not know what they are doing.
2) computer users do not read.
3) If a computer user can click on it, they will.

Disabling "hide file extensions" doesn't solve anything because of all of the above.

1) They don't know why that file has an .exe at the end or care for that matter. explaining it to them goes in one ear and out the other.

2) Since they dont read, I'd bet you can make a file called "brittany spears does the nasty dance while going down on her new chihuahua and this file will wipe your hard drive clean.exe" and people would open it because all they read is "brittany spears" and "nasty dance".

3) If it's something they downloaded, they will click on it regardless if the extension is real or fake. This happened to me while I was researching a file I absoletly knew was a virus solely on the icon displayed to me. (in my case, it was the folder icon and instinctively clicked on it to go into the folder. Yes I show file extensions. I also fooled four other techs with this simple test using this icon and it showed the file ext for them too.)

Re:It's very entertaining.

[hesaigo999ca]

Sometimes though you need javascript to run a page...ie- hotmail...
If you could just keep it off, it would be great, but we live in a REAL world,
and everyone uses jscript to load content nowadays.

Re:It's very entertaining.

[dnahelicase]

I thought it was hilarious when I got one of these messages right after I got my OLPC XO. I was showing it off to some friends, got one of these messages, and let it scan and tell me I had 211 viruses, rootkits, and registry problems. 40 bucks to fix them, and for an extra 20 they would keep my registry clean for good!

Re:It's very entertaining.

[Colonel Korn]

I completely agree with "combofix rocks." My job at the college I attend is pretty much removing that virus 24/7 from student laptops, and I've learned a few things:

1) McAfee sucks. We supply a copy of the Enterprise version to students, and a patched installation is required for internet access. Somehow, we're still inundated every semester with the latest flavor of AntiVirus ModelYear.

2) ComboFix is amazing. It's simple, but it automates a lot of tools that are a bit of a pain to use on their own. Ten minutes, and most malware is somewhat neutered.

3) MalwareBytes is amazing. ComboFix always misses stuff, but it lets us install MalwareBytes (also free) which finishes the job. I haven't seen any virus MB couldn't remove.

It's usually faster to run ComboFix + MalwareBytes (half hour between the tools in most cases) than it is to nuke it from orbit and reinstall Windows. Unless you're paranoid, two programs will take care of your end of your extended family's implied social support contract.

I removed infections from professors' computers every once in awhile in school. They always had problems that weren't even recognized by the big commercial virus scanner program given to everyone at the university. Combofix cleared the computers more than half the time, and I used MalwareBytes in the cases where it didn't. Why is it that infections known for years are still unrecognizable by Symantec and yet trivially cleanable by even old versions of free malware tools?

Adblock and FF are pretty solid infection preventions for even users who like to click on popup ads, since they block the display of those ads. Freeware tools fix infections. I haven't seen the major AV companies' software do either.

Re:It's very entertaining.

[Attila Dimedici]

In my company there comes a point when I just cut users off. They've inflicted whatever problem upon themselves, we've addressed it twice -- this is the third strike and they're out. It's not worth it to anyone to continue supporting people who insist on screwing themselves over, and the number one way they screw themselves over is by using an OS that allows them to screw themselves over so easily. Okay, so I guess I do sound like "that guy". But how long are you going to continue mounting these Herculean efforts to rescue idiots from their own incompetence with a system that encourages their incompetence?

As long as my boss pays me to keep those people as productive employees. The people I support use computers to provide our product (reports about stuff) to our clients. Now, if I have to spend too much time cleaning malware off of a computer I support, I will report it to my boss as it suggests that perhaps that particular user is spending too much time doing none work related things with their computer.
The people who I clean up computers for outside of my work environment pay me to do it as well, they can continue to screw up their computers as much as they want, I can use the money.

Re:It's very entertaining.

[rantingkitten]

I'm not suggesting Linux is somehow magically invulnerable, but rootkitting a Linux machine effectively requires a deliberate, targetted attack against that one machine. That's a hell of a far cry from the Windows system, where mindless, pointless alerts are considered the norm, and "download and install" is the expected method of getting new software and updates.

So, is it any wonder that people are suckered in by the "You have a virus! Click here to remove!" nonsense? To many people those "alerts" look exactly like every other Windows alert they've ever seen, and since Windows is always suggesting to download random garbage, they think this is normal. That's why I say Windows actively encourages this kind of stupidity.

We're talking about an OS where merely visiting a website can get your machine infected with some kind of malware, and botnets of Windows zombies are often million-plus strong. This is the OS that made possible Conficker, Nimbda, Code Red, and a huge number of others I can't remember because they all just blur together.

Rootkit a Linux box after specifically targetting it and taking advantage of bad passwords? Sure. But that doesn't even begin to compare to fifteen years of viruses, trojans, worms, adware, toolbars, and other malware that has marked the Windows experience.

Re:It's very entertaining.

[awpoopy]

I wonder what the CEO will say when I cut him off on the next (4th) incident.

Re:It's very entertaining.

[PitaBred]

though they're all nice, smart people who are just hung up on McAfee for some reason.

I'm betting educational kickbac^Wincentives.

Re:It's very entertaining.

[StuartHankins]

Mod parent up.

Although my job no longer involves troubleshooting virus incidents (and instead involves setting policy to avoid them in the first place), I feel bad for the people who have to deal with this mess. A few years back, our company was hit by Nimda, Melissa, and "I Love You" viruses when using Symantec AV. Since that time we've done 3 things that have prevented any infestations within the last 3 years:

• We centralized Trend Micro AV, which seems to do a good job for laptop / VPN users.
• We contracted an appliance, monitored by a security team, which does 24/7 blacklisting as well as stateful packet inspection. It's not that expensive when you have a few hundred employees.
• We went with Trend for the Exchange AV as well. Some days we have more than 100K spam/virus emails stopped by the combination of the appliance + Trend for Exchange.

Re:It's very entertaining.

[kalirion]

Not if you know exactly what you're installing.

So basically you turn off the firewall while you're installing something you know is clean, and in the meantime a dozen worms infect your PC. Well done.

Re:It's very entertaining.

[saltydogdesign]

I disabled my entire computer, so I don't have to worry about any malware at all.

Re:It's very entertaining.

[krull]

I can personally attest that adblock failed on this one (at least initially -- I haven't seen it in a few days now). I run adblock and keep it up to date (on latest version of firefox), but still got the redirection. The attack is annoying because there is no way to cancel out of the dialog boxes it pops up, you only get the option of clicking ok. So one has to manually kill the browser...

Re:It's very entertaining.

[trifish]

If you think you're protected by disabling JavaScript -- you're not. The same attack can be performed without JavaScript. You just compromise the iframe content (either on the nytimes server or on the ad server). Why they used JavaScript is beyond me. They didn't have to.

Re:It's very entertaining.

[jp10558]

I see MalwareBytes recommended a bunch, but it *isn't* free. Personal use according to the page from Google:
http://www.malwarebytes.org/mbam.php
is $24.95
and use in an organization like a school would be some undetermined price - they ask you to contact them for info / sales.

Unless I'm missing something, you couldn't use that in an IT department, or even a helpdesk run by the school without a license.

Re:It's very entertaining.

[TheQuantumShift]

Since most malware is spread by uneducated users making bad decisions, maybe require a short education class followed by an exam (randomly generated to prevent answer-lists) as a requirement for net access. First infection, you re-take the class and exam, second infection you take the class and exam again and are "quarantined" from the network for two weeks. Third infection you get no net access and no support.

Re:It's very entertaining.

[Khyber]

"I haven't seen any virus MB couldn't remove."

That's because they're not viruses at all. We haven't had a TRUE self-replicating computer virus in nearly decade.

Re:It's very entertaining.

[Khyber]

Umm, Hotmail and Gmail both offer alternative HTML rendering. I use it because Gmail's java consistently breaks when I log out of one email account and try to log into another, and hotmail's implementation of Java just sucks.

Re:It's very entertaining.

[CodeBuster]

To be fair to the browser manufacturers, NoScript is a fairly advanced tool which requires some user expertise to use effectively and knowledge of regular expressions to fully customize and get the maximum level of use. NoScript is great for geeks, but white listing is NOT a mass market solution to a problem which basically boils down to a combination of user ignorance and stupidity (and should not be viewed as such). NoScript is appropriate as a plugin for those who are able to make advantageous use of it, but it is not appropriate IMHO for default browser inclusion (NoScript updates frequently because the problems it attempts to address are moving targets which require specialty attention that most browser devs don't have time to give).

Re:It's very entertaining.

[Ironica]

Spybot S&D usually takes care of everything. I'll keep a watch out for this AntiVirus 2010.

I got "Anti-Virus Remover 2009" on Friday, probably through NYT, then clicking the wrong button because there's been stupid McCaffee stuff on our network server screwing things up for me all day long. (I can't think how else I would have gotten it; I haven't had a virus infection since Windows 98se.) Spybot S&D nuked it no problem, and using the Immunize tool prevented it from reinstalling itself afterward.

Re:It's very entertaining.

[Zenaku]

Isn't it quite telling that the pharmaceutical companies refuse to make a vaccine that can protect you from every pathogen that will ever emerge in the future? If they did that, they'd be out of business right?

Isn't it quite telling that the food companies refuse to make a magical pot pie that when you eat it you will live forever and never need to ingest calories again? If they did that they'd be out of business right?

Isn't it quite telling that the toilet paper companies refuse to make a bathroom tissue that will scotch-guard your ass-cheeks so you never have to wipe again? If they did that, they'd be out of business right?

Re:It's very entertaining.

[jp10558]

Well, there is the port of ezlist or whatever it's called (from ABP) that you can just drop in to a folder for Opera. I suppose occasionally dropping in a file is a bit of a pain, but then again, I use the same proxomitron filterset for months at a time without new ads getting through... I wonder how often you need to update an ad block list now adays...

Re:It's very entertaining.

[Archangel Michael]

Well, from an IT administrator that manages McAfee Enterprise, it does indeed suck royal balls at doing its primary job (catching virii).

However it does excel at pointy hair boss reporting, which is often key to getting funding for said product. It is also easy to manage and update via ePolicy Orchestrator (ePO).

The other "corporate" option is Norton/Symantec product which sucks balls and then licks colons.

And this weeks "AV" "best" choice which then "sucks" next week isn't really an option for TRUE enterprise management. I can't manage 5000 computers running twenty something versions AV, and expect any sanity.

But what is worse than McAfee, is NO AV at all. And trust me, plenty of windows boxes out there don't have ANY AV, because people don't know what to choose, and will end up clicking the first "you're infected" popup because it is "convenient".

Stupid should hurt, but it rarely does. McAfee only seems to be stupid, but it is much better than nothing. I know, I've seen those reports, and I would hate to run my network Naked (no AV), even as bad as McAfee is.

But that is my $.02 worth

Re:It's very entertaining.

[Ironica]

So, is it any wonder that people are suckered in by the "You have a virus! Click here to remove!" nonsense? To many people those "alerts" look exactly like every other Windows alert they've ever seen, and since Windows is always suggesting to download random garbage, they think this is normal. That's why I say Windows actively encourages this kind of stupidity.

This. I'm a pretty savvy user. My last virus was on Windows 98se. I apologize to my computer anytime I launch IE (which is only to run Windows Update or to access certain Federal Government grant application websites that ONLY work in IE). At home I run Ubuntu on my main machine.

And I got hit by the NYTimes thing, because I knew that our Exchange server was doing stupid McCaffee stuff, and I don't have full control of this machine or this network, so when this thing popped up, I hit the wrong button somewhat reflexively. I was hoping that this *might* have been triggered by the IT department's attempts to stop email attachments from getting randomly nuked as "corrupt content". I realized my mistake pretty quickly, but by then, my machine was all but unusable. Fortunately the malware only took down the browser I was using when it hit (Chrome) and I was able to download Spybot S&D from Firefox and get rid of the crap, but it was a mess.

And if I hadn't been dealing with the vagaries of stupid AV software someone else installed on the network, I would have been immediately suspicious of the popup and wouldn't have clicked anything until I felt like I knew what it was.

Re:It's very entertaining.

[hesaigo999ca]

I concur on this point, and think we should throw javascript out with the trash.

Re:It's very entertaining.

[Ironica]

Why the browser manufacturers can't simply build in whitelisting for sites, instead of the current "all or nothing" approach, is beyond me.

The problem isn't the browser, so much as the advertising companies. Why *they* aren't scanning every ad placed through them for legitimacy boggles my mind. Are they so short-sighted that they'd rather get the dough from the malware ads now, even though it will convert thousands of new users to blocking their ads in the future?

It's like if the newspaper didn't bother to *read* the classified ads before printing them, and ended up printing all kinds of obscene or libelous or otherwise inappropriate material.

Re:It's very entertaining.

[No Grand Plan]

Fair point - didn't think of that. How did you guess I'm not an IT professional?

Re:It's very entertaining.

[Khyber]

"I concur on this point, and think we should throw javascript out with Adobe Flash."

FTFY

Re:It's very entertaining.

[mysidia]

I suggested: And any images referred must be uploaded and served from the ad network (again, no remote loading).

Meaning software running on the server would parse the image file and verify that it is valid and not containing no exploits, prior to the ad being served.

Re:It's very entertaining.

[hairyfeet]

But I have actually spoken about this at length on previous posts, as I truly believe I have a way of making it "easy for the masses" while at the same time still having it geek friendly. You see, I've found most geeks have trouble thinking like "Joe User" but being a PC repairman and dealing with them constantly makes it easy for me to pop into their mindset. It is also why I am still selling boxes in a crappy economy, as word of mouth keeps me quite busy. You see I set it up so Joe don't have to think-everything is automatic, from the basics like Windows updates to the more complex like malware scans and codecs. All is done for them, so with my boxes they just "flip the switch and go. Anyway here is my brilliant idea-

When watching my users try to use Noscript, I have found that one thing always hangs them up-playing a video. They go to a site, want to play a video, and then have to click through a dozen or more links just to play a video, and of course this makes them frustrated. So why not have Noscript default to an "easy" mode, where instead of the complex lists we get when a site is completely blocked, we have the normal S! symbol, but right beside it a "play video" button which when clicked just brings up a list with the one or two elements on the page which are actually videos. You could probably refine it so it only offers the video at the center of the screen, or have it simply allow the element you click on, so that to play the video the user simply points his/her mouse at it and clicks.

So you see, my method would STILL keep the excellent security of NoScript, as it would still be default deny, but it would allow Joe User at the same time to get to the content he actually wants by simply clicking on it or choosing "play video". It would also still allow geeks all the control they have now, as a simple click on the Noscript symbol and choosing "expert mode" would default it back to its current state. I believe this would give us a much better NoScript, as it would be trivial for all of us to hand the security of NoScript to our customers, less technical friends and family, etc.

You see, it is all about balancing the needs of Joe average while at the same time not hamstringing the geeks. Sadly I am a repairman, not a coder, so I can't do this myself, but I think it would really help folks. It sucks that I can't write code, as I have a nice idea for a Linux website but I can't write HTML either, so I'm afraid my ideas will have to just stay ideas. But in this case a couple of tweaks/add ons to the GUI would do wonders for helping Joe average to use the item in question. There is no reason why NoScript CAN'T be useful for non geeks, it just needs a little tweaking to make it so.

Re:It's very entertaining.

[hesaigo999ca]

LMAO!

Re:It's very entertaining.

[cbiltcliffe]

How about the huge "Download free version" button?

The full version is $24.95 for personal use, but the free version is..well....free.

But it doesn't have real time scanning, scheduled scanning, or scheduled updates.

Well, when you're just cleaning a machine, that doesn't matter at all.

There's probably some restriction about using the free version in a commercial environment, but that may not include educational. Haven't actually looked into it.

Re:It's very entertaining.

[cbiltcliffe]

Yes we have.

Can't remember what it was called, but I had to clean up a machine with an old school .exe file infector a few months ago.

Completely hosed every executable on the machine, so it _was_ a matter of reinstalling from scratch.

Re:It's very entertaining.

[cbiltcliffe]

That means your imaging software has a bug^H^H^Hfeature that just happened to work in your favour.

Garbage, undisplayable characters in the filename doesn't make it a rootkit, although it could be a supplemental way to prevent removal. A true rootkit has some sort of a driver in kernel space or higher, that prevents the rootkit's files from being displayed in Windows, in any way at all.

A real rootkit only hides its files when it's own driver is running; which is only when running the infected system.
Therefore, your PE boot disk will show the files just fine, and copy the files just fine, as long as they don't have garbage characters in the name.

Provided you do a virus scan with something that _knows how to detect_ that rootkit before you reapply the image, you'll be fine. But we're here talking about how crappy the detection rate of virus scanners is, so I wouldn't want to count on that one.....

Re:It's very entertaining.

[jp10558]

And your legal counsel isn't worried about you following licensing and EULAs? I have to make sure that the license explicitly allows our use in a research lab / academic environment or get written (e-mail or public forum) releases when it is unclear.

Re:It's very entertaining.

[cbiltcliffe]

I don't use the free version in a commercial environment, and I'm not academic, either, so it's completely a moot point for me.

Re:It's very entertaining.

[Uzuri]

Wait... you expect advertising scum to actually do work? Your busted computer's no skin of their back.

Ouch

[kidblast]

Ouch for all those who are de facto family computer technical support.

Re:Ouch

[Pool_Noodle]

We who are about to pull our hair out (from our families not listening to the words "Don't go to this site") salute you ....

Re:Ouch

[lenski]

I installed a Linux distribution on a friend's laptop a few years ago, and have heard *nothing* from her, other than occasionally that it's working just fine. She uses my wife's office several times a week, which means that she has lots of opportunities to ask for help, or to complain if she sees something not working to her satisfaction.

Re:Ouch

[hazem]

What finally worked for me was to take the relative's computer, fix it, then just keep it for a few weeks before returning it. After doing that a few times nobody came to me any more to fix their computers any more. It helped that my mom would tell people that I've been working a lot lately and just haven't had time to do much else.

Re:Ouch

[Arcady13]

She had someone else put Windows back on, and doesn't want to hurt your feelings.

Re:Ouch

[Pool_Noodle]

Last time a friend asked me to work on his computer it got some mysterious scripts that shut down the computer ... randomly reset the homepage ... (not viruses - scheduled batch scripts) ... its coming very close to that with family now. You know - Live isn't fair, but having the root passwords helps ...

Re:Ouch

[StuartHankins]

BOO! (but funny though)

Re:Ouch

[AmberBlackCat]

What's she doing with the computer every day? Because I installed Linux on my daughters' laptop and they're doing fine too, but they're not trying to print anything and the laptop isn't connected wirelessly. And they're not using any sound at all. Because they don't need any of that for Facebook. If your friend is printing reports, downloading wirelessly, and listening to her mp3 collection on Linux, I think you should make a website explaining how you did it.

Re:Ouch

[Ironica]

We who are about to pull our hair out (from our families not listening to the words "Don't go to this site") salute you ....

Seriously? You already warned your family off of NYTimes.com?

That's the problem with this one... it's a very reputable site. Lots of people will get hit that wouldn't normally be at risk, because they DO listen to the warnings of their tech-savvy family and friends.

Re:Ouch

[Pool_Noodle]

No, I don't warn people off sites anymore, I've given up that. ESPECIALLY when good sites like NYTimes gets infected, I only warn people to avoid them for a day or so. Long enough for some overworked admin or Overpaid ad executive to realize that infected ad found its way into the stream.

I have seen these before,

[HazMat 79]

while using stumble upon, a pop up "scans my C drive" and informs me of multiple threats and then tells me to download XYZ software to get rid of it. One of them wouldn't even let me close the window. I had to open a terminal and killall to get rid of it.

Re:I have seen these before,

[PAjamian]

I always find it interesting how it can scan the "C" drive on my Linux box.

Re:I have seen these before,

[Robin47]

I saw it today on my Mac while visiting the NYT. I hit cancel and it went ahead and "scanned" anyway so I killed the tab and the son of a bitch still managed to open a sheet telling me I had to download such and such. Only option was okay. So I killed Firefox and restarted it. I had that one once before a few years ago on a Toshiba. Took me a week to get rid of it then. It was a nice facsimile of a Windows explorer page though. I had to laugh.

Re:I have seen these before,

[Robin47]

Anyway, I still can't believe people actually download and install these things.

They don't have a basement.

Re:I have seen these before,

[lorenlal]

I've seen this pop up before... On my roommate's computer. It appears a lot like a Windows Vista secure desktop warning by taking up the whole screen with a darkened border. The message follows a format that looks a lot like other Vista menus and messages. To the user, it doesn't look like it's a message from the website... But rather from Windows.

I could easily see how most people could click the screen (literally anywhere) where it asks to download a fix called "install.exe." Plus, if you are one of the poor users who uses the terrible AV solution, that seems to have an agreement with anyone with a large user base, you're totally screwed because this virus seems quite effective at knocking it dead out.

I'm more concerned with the fact that this is popping up in what are normally quite trustworthy sources. I was initially afraid that Yahoo had sold out, it just seems like they got the same treatment as the NYTimes. This speaks more to the vulnerabilities of the webservers that are hosting these sites to me. Does anyone know what platform they're sitting on? I'd like to know if there's a hole out there that I should concern my company with... I'm totally serious.

Re:I have seen these before,

[Techman83]

It's more of a problem with outsourced advertising that allows any sort of scripting then what they are running. Hell even the advertising company may not be aware of the issue, because they seem to allow this kind of stuff as well.

Re:I have seen these before,

[cbhacking]

An interesting note: you can configure UAC to require a Ctrl-Alt-Del before it shows you the prompt. Obviously this is a level of paranoia that most users don't want to deal with (similar to the way that in in XP they made it so home accounts don't need to press Ctrl-Alt-Del to reach the login screen anymore) which is why it's not the default, but it's intended to protect against exactly this situation. Ctrl-Alt-Del triggers a software interrupt, so unless your kernel has been tampered with (by which time you're already totally fucked) you know the next propmpt you see will be a real one.

Ironically, this option for UAC doesn't even add any security in the default UAC mode (where you only need to OK the elevation). It's for people who are either standard users or have UAC configured to ask their password even though they're members of the Administrators group. It just prevents a malicious program from presenting a false UAC dialog and getting you to reveal an Administrator's password.

Yes, slightly OT. The secure desktop is used by a couple other high-integrity components besides UAC, but I'd be highly suspicious of anything that displayed the SD unexpectedly. If I had this setting on, I wouldn't even wonder. That said, the kind of person who would make UAC more secure, never mind would actually know how, isn't the intended target of that kind of scam anyhow.

Re:I have seen these before,

[HazMat 79]

That made me laugh too, didn't fit in too well with gnome. lol.

I expected better.

[Quinapalus]

My AVG anti-virus caught this, but I would have thought the NY Times would have had better security.

Re:I expected better.

[Ron_Fitzgerald]

Unfortunately this has nothing to do with New York Times' security and that is the whole problem. New York Times hires an 'ad agency' which is quite a bullshit term in this case if you ask me. They embed some open ended script from said firm and then at that point have no idea what is being displayed. This 'firm' may even rent or sell the embedded space to yet another company so then even the firm has no idea what ad is being displayed. All these automated, unmonitored and unregulated ads on pages are a huge security hole but in the name of profit, who really cares?

Re:I expected better.

[nmb3000]

I would have thought the NY Times would have had better security.

As my sibling points out, this is what happens when you allow an unknown entity to inject arbitrary content into your page.

It actually makes me wonder what the contract for these ad agencies (DoubleClick, etc) looks like. When somebody like the New York Times signs up with them, does the ad company waive all potential liability? For example, if the NYT was sued for distributing malware by somebody who's computer was infected, would the NYT be responsible for the by-proxy content on their site, or would they be able to "pass the buck" to DoubleClick? Personally I tend to think both parties should be held liable.

I realize that "the Internet was built on free content paid for by advertising", but lately it seems like most of these "ad agencies" are little better than spammers.

Re:I expected better.

[Myen]

They actually appear to embed the ad code directly into the page (you can see which campaigns the ads are for; the one that hit me was for Vonyage, near the bottom of the page). In my case, it wrote a weakly obfuscated script that redirected the whole page to sex-and-the-city.cn (... err, yeah) which redirected to protection-check07.

Poor NYT, they now have a special rule in my ad filters.

Re:I expected better.

[Thinboy00]

They actually appear to embed the ad code directly into the page (you can see which campaigns the ads are for; the one that hit me was for Vonyage, near the bottom of the page). In my case, it wrote a weakly obfuscated script that redirected the whole page to sex-and-the-city.cn (... err, yeah) which redirected to protection-check07.

Poor NYT, they now have a special rule in my ad filters.

Probably inserted by some server-side scripting provided by said ad agency.

Re:I expected better.

[Bigjeff5]

No no, I'm pretty sure he inserted the rule himself.

Re:I expected better.

[LordLimecat]

This is a NYTimes issue just as rotten meat is the supermarkets problem--whether or not its because of a rotten vendor. If you go with your attitude, we can never blame anyone-- Honda may get some parts manufactured at a 3rd party foundry, so theyre not to blame for defects! Dell uses Foxconn for their power supplies, so you cant blame Dell for computers that crap out in 2 years! Sony outsources its battery manufacturing to Taiwan, its not THEIR fault the batteries can catch fire, honest!

Re:I expected better.

[glitch23]

Many media websites do this including MSNBC.com. Ironically, they just had a story posted a few days ago about the recent rise in prevalence of the teeth whitening and weight loss ads and on the page the article was posted they had a teeth whitening ad. Supposedly the rise in prevalence of those ads is due to the economy (cheaper ads). The web of companies running those ads, buying the ads and then using the ads on their sites is pretty complex.

Re:I expected better.

[TheRaven64]

Personally I tend to think both parties should be held liable.

The NYT distributed the malware to the users, so they should be liable for the first suit. They may, in turn, sue DoubleClick (or whoever) for distributing the malware to them. The ad provider can then sue the company that bought the ad, and so on. In an ideal world, the NYT would lose both times, which would make other companies very hesitant about signing up with ad suppliers who don't carefully vet their ads.

News? Where?

[SilverHatHacker]

What exactly makes this different from any of the other hundreds of sites with the same popup? Is it just because this is a large, well-known website like the New York Times?

Re:News? Where?

[bertoelcon]

I was thinking the same thing. The answer is probably yes.

Re:News? Where?

[petermgreen]

Not exactly news but nonetheless a sad indictment of the state of online advertising that even big sites with a reputation to uphold are using adverts from seedy advert networks who tolerate this shit.

Re:News? Where?

[Jahava]

What exactly makes this different from any of the other hundreds of sites with the same popup? Is it just because this is a large, well-known website like the New York Times?

That's my impression. I think the interesting thing here is that the presumption that reputable websites have reputable advertisements has been violated. NYT's advertising policies include the following paragraph:

The Times may decline to accept advertising that is misleading, inaccurate or fraudulent; that makes unfair competitive claims; or that fails to comply with its standards of decency and dignity.

Granted, they don't outright state that the content is prohibited, but they do imply a stance against this type of advertising. This is a clear violation of that intention, and they took the appropriate response. I'd be most interested in knowing if this particular advertisement was intentionally approved, "slipped through" accidentally, or was injected illicitly (e.g., their advertising server was hacked, etc.).

Re:News? Where?

[sjames]

Yes, a large website with high traffic and a reputation to maintain. Be assured, somewhere someone ate dinner standing up tonight.

Re:News? Where?

[rm999]

I think this case is semi-interesting because it conveniently parallels the slow death of the media as we know it. The idea is that people used to look to newspapers like the New York Times for trustworthy news; now, these sources mislead (lie?) to their users and mess up their expensive computers in the process.

Of course, I agree with you that it is misleading to accuse just the NYT - 1000s of sites run these misleading ads, and many probably don't mean to (including the NYT, I'm sure). I would call this a non-story - the obvious reaction from the NYT will be "we did not mean to run these ads, it's the online ad providers' fault, and we have made sure the ads won't be run again." And then no one will care anymore. Yawn.

Re:News? Where?

[Bruce Perens]

Let me guess. Your preferred news service is FOX, right?

Re:News? Where?

[Orion Blastar]

We don't expect that from the New York Times because they are more professional and you'd think their web staff would be computer savvy enough to avoid giving customers and readers the fake antivirus web popup that actually infects the computer with adware than remove actual malware.

But as usual they contracted the web ad service to contracted companies that usually subcontract it out to others, so it is hard to find the company that submitted the pop-up fake AV scan.

The NYT has hit hard times with a low reader rate in subscriptions, and had to move to an ads based model. They should have done what most liberal web sites do and use Google adsense or something that is text based ads that Google tends to filter out the malware ads. This is something you expect from Fox News, not The New York Times. But then Liberals can be just as careless as Neocons when it comes to earning money from advertising. IIRC Fox News' web site is going towards a paid business model and might end the advertising as all subscribers will be paying customers, unless that business plan fails. Will the New York Times web site follow Fox News in going paid only?

Re:News? Where?

[Sponge Bath]

Fox is great, but Limbaugh *really* gets to the teabaggery of it all.

Re:News? Where?

[Thinboy00]

We don't expect that from the New York Times because they are more professional and you'd think their web staff would be computer savvy enough to avoid giving customers and readers the fake antivirus web popup that actually infects the computer with adware than remove actual malware.

But as usual they contracted the web ad service to contracted companies that usually subcontract it out to others, so it is hard to find the company that submitted the pop-up fake AV scan.

The NYT has hit hard times with a low reader rate in subscriptions, and had to move to an ads based model. They should have done what most liberal web sites do and use Google adsense or something that is text based ads that Google tends to filter out the malware ads. This is something you expect from Fox News, not The New York Times. But then Liberals can be just as careless as Neocons when it comes to earning money from advertising. IIRC Fox News' web site is going towards a paid business model and might end the advertising as all subscribers will be paying customers, unless that business plan fails. Will the New York Times web site follow Fox News in going paid only?

No. Fox is a conservative news source and has relatively few actual competitors, at least in terms of the news market (as opposed to the advertising market). Most people who watch/read Fox are conservatives, and there's only one conservative news source in town. On the other hand, most news sources are liberal, so NYT can't afford to alienate its consumers unless most/all of its competitors do the same.

Re:News? Where?

[Bruce Perens]

If I could tag comments, this would get "livinginalternatereality".

Re:News? Where?

[Sponge Bath]

"livinginalternatereality"

All the better to observe the reactionary in its native habitat ;-).
Crikey! Observe the fear induced display of President Obama as Hitler!

Re:News? Where?

[Orion Blastar]

Too bad there are no neutral or independent news sources. Sometimes I have to go outside of US web sites to discover another point of view on the news. But then since I am not local to the foreign web site, I cannot be sure it isn't biased as well.

Ever since Reagan got rid of the fairness doctrine, all news has been is spun to the left or right.

I miss the old Saturday Night Live that used to parody the two sides of the news with "Point Counter-Point" with Jane Curtain with the liberal side and Dan Aykroyd on the conservative side.

Re:News? Where?

[lgw]

Crikey! Observe the fear induced display of President Obama as Hitler!

Wait, what? I mean sure, Limbaugh is what he is, whether you're laughing at him or with him, but the whole president-as-Hitler thing was pretty much the left's trademark for 8 years or so. I'm all for taking "president-as-Hitler" signs as the sign of a disturbed mind, but it's probably the wrong brush to try to paint Limbaugh listeners with.

Re:News? Where?

[lgw]

Talk about a reach to bash Reagan! There has never been such a thing as an unbiased news source. That's some sort of urban legend or somehting. For a while, some news sources tried to present you with the biased view for both sides of an issue, which at least counts as making an effort at being unbiased, but even that seems to have fallen out of fashion. What you can find is sites that are severely biased about stuff you don't care about, and so don't make any effort to spin stuff that you do.

Re:News? Where?

[geekboy642]

The correct spelling is O'falafel.

Re:News? Where?

[Anonymous Coward]

I presume what was meant is that someone got their arse whipped.

Re:News? Where?

[oatworm]

The Columbus Free Democrat wants you to Remember the Maine!

(We must defeat the Spanish menace!)

Re:News? Where?

[mpe]

There has never been such a thing as an unbiased news source. That's some sort of urban legend or somehting. For a while, some news sources tried to present you with the biased view for both sides of an issue,

Ignoring the false dichotomy (and related) fallacies.

Re:News? Where?

[Attila Dimedici]

Ever since Reagan got rid of the fairness doctrine, all news has been is spun to the left or right.

Yes, under the fairness doctrine, news sources would present you with both sides of an issue. On one side of the issue you would have the sensible, reasonable liberal and on the other side of the issue you would have the radical, wild-eyed "conservative" nut-job. I put the conservative in quotes because the news would often use somebody like Lyndon LaRouche and call them a conservative (Lyndon LaRouche is a complete nut-job whose ideas currently bear closer resemblance to liberals than to conservatives).

Re:News? Where?

[lgw]

An unbiased news source would present the facts in context, fact-check outspoken proponents of issues regardless of the issue and the proponent, and investigate those in power regardless of party. That would be a very cool thing. Letting spinners on both sides of the issue spin in the same room is hardly reporting, though if moderated poorly enough it can be made to appeal to those who like reality TV.

Re:News? Where?

[Sloppy]

You are distracted by their content and journalistic values, none of which is relevant. The reputation we're talking about is for size and power. Sure, maybe it's a false reputation: maybe NYT is actually as small as a weekly paper in podunk USA, and they only have 6 people in their office. But do you really think that?

Shills can still be powerful, but apparently that power does not extend to being in control of what's on their web page.

Re:News? Where?

[AF_Cheddar_Head]

Only conservative news source?? What are you smoking? MSNBC,CNN, Local news, two-thirds of the local newspapers in America. Oh I see you mean the only news source to the right of the John Birch Society.

Travel a little bit and see just how right-wing most of america really is.

Re:News? Where?

[dominious]

Is it just because this is a large, well-known website like the New York Times?

umm...yes?

Re:News? Where?

[Ironica]

What exactly makes this different from any of the other hundreds of sites with the same popup? Is it just because this is a large, well-known website like the New York Times?

More to the point, because it's a large, reputable, trusted site. The sort of site that people who don't go to certain sites for security reasons wouldn't think twice about hitting.

Re:News? Where?

[ConceptJunkie]

No, I don't watch Fox. I get my news from a number of diverse sources.

But feel free to stereotype me. It seems to make you happy. On the other hand, the NYT's credibility is shot and no one with any objectivity believes they still have objectivity.

I saw it

[HangingChad]

But when it starts telling me the C:\ drive on my Linux box is infected it's hard to stop laughing.

Still was a job to get rid of the circle jerk pop ups.

Re:I saw it

[BryanL]

Yeah. I have a Mac. The Windows interface is kind of a giveaway that it is probably not that my computer has a virus.

Re:I saw it

[sjames]

Still was a job to get rid of the circle jerk pop ups.

If not for that, I'd bookmark the ad!

Re:I saw it

[supernova_hq]

Are you arguing symatics (the \ not being part of the drive name) or did I just get whooshed?

Re:I saw it

[NitroWolf]

You just got wooshed, since there are no drive letters in Linux.

Re:I saw it

[DoofusOfDeath]

But when it starts telling me the C:\ drive on my Linux box is infected it's hard to stop laughing.

You moron, it was complaining about your .wine directory!

Re:I saw it

[Bigjeff5]

Yah, the "C" drive on a Linux box is \.

Boot partition is mounted to \boot, though you could change that if you wanted.

Linux maps to folders - actually Windows does too, they just came up with the special folder names of A-Z, which they called "drive letters", back in the DOS days, with the prompt being whatever you wanted, but the default was C:\>. C: designated the drive letter the media was mounted to, and \ designating the root of the drive. Linux just does \ and calls it good.

You can mount a drive to a folder in Windows too if you want, it's just not the default way of doing it (for Windows), and I don't think you'll get it to work for the boot partition. Drive letters are ingrained into Windows.

Re:I saw it

[Bigjeff5]

As an aside, if you were somewhat insane and thought the drive letter structure was just the bee's knees, you could easilly re-create it in Linux, or at least something that looks at it.

When installing linux, simply call the root partition C:\, or C\ if that is not kosher. Then in your terminal you can set up the -really- old school C\> prompt.

Re:I saw it

[Wolvenhaven]

Yea, I love the windows start menu and border and all that stuff, I downloaded it just for the hell of it and I got an unknown datatype error. There is also one going around which is a windows PDF vulnerability where it will try to automatically download a PDF to your computer which will cause the infection. I have PDFs automatically download on my linux machine and so I'll find 77634.pdf on my desktop and it's a blank document. You gotta love the windows malware which tries to target linux.

Re:I saw it

[IICV]

All of your slashes are backwards. Windows is basically the only modern operating system retarded enough to use backslash (\) as a path separator, while also keeping it as the escape character. This means that if you're, for instance, hard-coding a Windows path in C or some other language that doesn't support raw strings, you'll be stuck with some bullshit like "C:\\stuff\\more stuff\\even more stuff\\". On basically any other system you'll encounter, all paths will be delimited with forward slashes (/), which don't need escaping in a string. Seriously, out of all the options for a path delimiter, why would anyone choose one that has to do double duty?

Of course, the whole "C:" drive thing is retarded as well - after all, where does the C: drive exist? What does it mean to be in the C: drive, versus being in the D: drive? When you're looking at all of those drives in the My Computer (or nowadays, just Computer) view, where exactly are you in the filesystem? And what are you supposed to do after you have 26 drives? The abstraction just leaks all over the place like an incontinent puppy, I'm not even sure why they ever thought it was a good idea in the first place.

These are a few of the many small ways in which Windows is deficient.

Re:I saw it

[Announcer]

Same with my wife's laptop. I tried to explain to her that it is NOT running Windows, it was running LINUX (Ubuntu) so "Windows" errors were IMPOSSIBLE! She doesn't quite understand, so I just told her that if she sees anything like it again, to ONLY click the little [x] in the upper right.

Thankfully, no harm was actually done... but it did take forcing Firefox to close, then forcing another dialog to close to stop the loop!

The only thing she uses that computer for is Facebook, so there really is nothing of any value on it. That's why I installed Ubuntu on that machine... to keep it, and the rest of my LAN, safe! :)

Re:I saw it

[Lehk228]

it's C because your two floppy drives are A: and B:

Re:I saw it

[Rick17JJ]

I have run across several versions of those pop-up fake online virus scanners, over the last several years, while using Linux. In one case, a Microsoft Warning suddenly popped up saying that my computer was infected with a virus. What was a Microsoft warning doing on a Linux computer which had absolutely no Microsoft products installed on it?

In a couple of those instances, it pretended to scan my C: drive without my permission. It showed a progress bar, as it was supposedly scanning my C: drive. It then went on to say that it had found a couple of viruses and malware on drive C: and also in my registry. Linux does not have a registry, nor does Linux use drive letters.

A minor exception to not using drive letters, would be when trying to run a Windows program under WINE. There is a fake Drive C: in an obscure hidden directory, which Windows programs get to use when running under WINE. I doubt that was what they were talking about.

Another minor exception to not using drive letters occurs when running DOSBox. It temporarily mounts a partition as a fake drive C: when it is running. Old DOS games can then be run under DOSBox on the fake C: drive.

In each case, after supposedly finding the viruses, it suggested that I should purchase and download their anti-virus software to fix the problem (for something like $39.95).

Despite not choosing to purchase their anti-virus product, Firefox asked me what it should do with a Windows executable file which the website was trying to download. It wanted to know which program it should use to try to open the file, or if it should just save it to the hard disk instead. I found myself thinking, "what, do you think I actually might want to try to download run their Windows only malware under WINE or something?" I canceled the attempt to download the Windows executable file.

When using Firefox under Linux, I have recently selected to use both the NoScript and the Adblock Plus add-ons for Firefox. I definitely will not ever be adding the New York Times to my list of trusted sites which is allowed to run executable content. I realize that there have never been any Linux viruses successfully circulating in the wild, but I am not sure if Linux or the Linux version of Firefox might possibly still be vulnerable to some other types of malware or not. So, I decided to start using NoScript and Adblock Plus, as a precaution.

Re:I saw it

[LordLimecat]

wrong slash. Linux root is /, since we're nitpicking here, same as the slashes used for slashdot and the rest of the web.

Re:I saw it

[Technician]

Still was a job to get rid of the circle jerk pop ups.

The easiest way out I have found on Ubuntu is to simply logout. It closes all the pop up windows. Log back in and they are all gone.

Re:I saw it

[calidoscope]

On my first computer, c: was the left hand Qume DT-8 reading the bottom side of a double-sided single density disk (a: being the normal side and e: for a DSDD disk.

Re:I saw it

[AliasMarlowe]

But when it starts telling me the C:\ drive on my Linux box is infected it's hard to stop laughing.

You moron, it was complaining about your .wine directory!

It's an even bigger giggle for those who don't have wine installed, and still get that ludicrous C:\ drive is infected message. I got one a few weeks ago, and it even listed a bunch of Windows DLLs (which I obviously don't have) as being infected. It was potentially a nasty one also, since clicking anywhere on the pop-up - even cancel or close - would have downloaded the malware on a Windows box.

Re:I saw it

[Technician]

For a Noobuntu user, it's much easier to have my kids logoof instead of them trying to remember the syntax of the killall command.

Re:I saw it

[WillDraven]

You're basing this on the assumption that malware authors are going to use the syntactically correct terminology in their flash adverts.

Re:I saw it

[metaforest]

Lol had the same experience on my MacOS system....

The malware server didn't want to give me the Trojan. Had to shake it loose using wget. Guess it was noticing that I was running MacOS. I also couldn't get the Trojan to run on my "sandboxed" XPP VM... It seems to be checking for something that VMWare doesn't emulate.... The binary also came up totally clean when checked with McAfee. Not really surprised there.

Oh well I don't have a properly instrumented sandbox anyway...

Re:I saw it

[PitaBred]

Have you ever tried to run one of those malware things in wine? Do it from a console... the error messages are amusing. Watching it fail to find DLL after DLL and program after program...

Re:I saw it

[supernova_hq]

He was talking about a windows box...

It happens on Linux too

[steltho]

I was getting this message while using Linux. It would show me the pop up and then send me to a web page that looked just like Windows Explorer. I was surprised to see it on a site like the New York Times.

Re:It happens on Linux too

[sakdoctor]

Windows XP with luna theme by any chance?
I wonder when the scum will switch to aeroglass themed ads.

Re:It happens on Linux too

[cupantae]

Of course it happens on Linux. That's the point - it's not doing what it says it's doing. It would be interesting if it DIDN'T happen on Linux because that would mean it was actually checking something. [Well, I know it would just have to look at the user agent string]

Re:It happens on Linux too

[Darkness404]

I wonder when they will start searching user agent strings and making it look native (Classic on pre-XP, Luna on XP and Aero on Vista/7, and Aqua on OS X). A dialogue that looks like the Ubuntu install software window could fool a lot of users....

Re:It happens on Linux too

[eric31415927]

Two years ago, I got my 67-year-old mother online with a Debian (stable) box for web browsing, emailing, and printing.
At least twice in these two years, she has come across web pages warning that her operating system has been infected with a virus.
The web pages make it look like she has an infected Windows system - similar to the link from the NYT web page.

I reassure her each time that her computer has not been infected, and it is not likely to ever be infected so long as she is careful with her password.
I would like Firefox (or in her case IceWeasel) to have a plugin to avoid loading pages that look like Windows Explorer.
This would save people like my mother and businesses like the NYT from undue stress.

Re:It happens on Linux too

[ImYourVirus]

Does it really matter what it looks like? You know some dope is going to fall for it no matter what.

Re:It happens on Linux too

[Darkness404]

Yeah, but how many more Mac users or Linux users (who in general are "immune" to viruses and other malware due to their lower marketshare and in general better security) would be fooled into running a strange program if it looked exactly like something that they were running? An "update" to Firefox or Safari? No Mac user is going to download something that looks like XP, and a lot of Vista users would be suspicious if it looks like XP.

Re:It happens on Linux too

[Nerdfest]

It will start just slightly before many people start faking their agent strings. I frequently change the FF agent string to appear as Windows XP instead of Linux.

Re:It happens on Linux too

[jack2000]

It's Simple dear Watson. Have a simple grease monkey script match the word "virus" and/or "infected" and then have it:
window.location = "http://www.google.com/";

Re:It happens on Linux too

[ZorbaTHut]

I hope you're never in charge of any serious software package, because that would flatten some rather important webpages.

Re:It happens on Linux too

[LordLimecat]

and a lot of Vista users would be suspicious if it looks like XP.

You really think so?

Re:It happens on Linux too

[Rick17JJ]

There is the NoScript add-on and also the Adblock Plus add-on for Firefox. Perhaps, that might have stopped her from seeing those fake anti-virus scans (I am not totally sure). Those free add-ons are available for both the Linux version of Firefox and the Windows version of Firefox. To add those plug-ins, when using Firefox, just click Tools and then Add-ons and then click "Browse all add-ons" to find whatever add-ons you want.

With the NoScript add-on, I can left-click or right-click a small icon in the lower right corner of Firefox. Then if I want to, I can temporarily or permanently allow scripts to run on a particular web site. Obviously, I will never be allowing any scripts to be run from the New York Times website.

I am not sure if Linux or the Linux version of Firefox is actually vulnerable to any type of drive-by malware or not. But just to be extra safe, I have recently started using the NoScript and Adblock Plus add-ons. Of course I do not run as root, and I have heard that there have not yet been any Linux viruses sucessfully circulating in the wild. But, I am not sure about other types of drive-by malware. I am not an expert or a computer professional.

I have encountered those fake anti-virus scans about three times in recent years. Each time I noted what IP address or URL was being used by the advertisement. As an experiment, I then edited my Linux hosts file to divert that the attempt to connect to that location to the 127.0.0.1 loop back address, which every computer has. When I then went back to the website, I did not experience the fake anti-virus advertisement again. I am not sure if I could have used the hosts.deny file instead, for the same purpose, or not.

Re:It happens on Linux too

[Rick17JJ]

Now that I have finally gotten around to reading the linked articles, I see that it says this:

"The scan itself is a javascript that draws the progress bar. The file list that it iterates through when it performs the fake scan is a list of 1,100 names in a file called fileslist.js. That file also contains the 14 fake pieces of malware that it "discovers."

So it seems to me that NoScript would definitely block at least some of the fake anti-virus advertisement does.

Re:It happens on Linux too

[TheRaven64]

Updates to Safari only come via the Software Update program, which has its own dock icon and different window borders to Safari, so is impossible to fake realistically from within a browser. Any executable downloaded by Safari (including Windows binaries) will be tagged with some extended attributes indicating where it came from and, when you run it, you will get a pop-up warning you that it came from the Internet and is probably unsafe; this never happens with Apple-supplied updates, or with program updates that were downloaded by an app-specific updater, so it is a big red flag for most users.

That's not to say there haven't been arbitrary-code execution vulnerabilities in Safari, but if you're using one of those you don't need the psychological tricks to make people run it. If you're relying on the user to download and run the executable, you need to try a lot harder on the Mac.

Re:It happens on Linux too

[99BottlesOfBeerInMyF]

Updates to Safari only come via the Software Update program, which has its own dock icon and different window borders to Safari, so is impossible to fake realistically from within a browser.

This is true, but sadly you don't need to realistically fake things much of the time. If you pop up a Safari window that looks just like the standard Software Update window, for example, many users won't notice that it did not come with the usual Software Update icon bouncing in the dock. A number of users will likewise click that it is okay to run it, simply because they do that to run new software a lot of the time and don't remember they didn't do so normally with the software update.

My point being, yes Apple is doing a better job with exposing trojans like this and they're probably doing a sufficient job given the current threat level to their average user, but there is a lot more they could do. For example, they could sandbox all new software by default and encourage software providers to sign and provide ACLs for those programs, which Apple verifies. Then, normal users wouldn't be being conditioned to click through and approve running arbitrary software, since most would be verified and not need any such end user verification. Further, any software the user installed which was not verified, but which did not need any potentially dangerous abilities would not need to show such a dialogue box since it would not try to exceed a fairly restrictive sandbox. In such a way false positive warnings could be almost eliminated and users would see warnings asking about running arbitrary software that could be much more potent. Ideally, a user only sees the dialogue a few times, ever, and it can say specific things like, "this is an untrusted application from the internet from an unverified source and it is trying to access the core of the system, would you like to (stop the software)(let the software have complete control of my computer forever)(see more detailed options)". That's actually where I see anti-trojan defenses heading.

Re:It happens on Linux too

[jack2000]

Does your "mom/grandmother/grandfather/almost-computer-illiterate related person" work for or needs to open cdc.gov ?

Have you seen the whitelist option that greasemonkey scripts have? You can set sites as exceptions to the script....

And they wonder...

[PC and Sony Fanboy]

And they wonder - Why is print media dying?

Because they can't adapt properly. Seriously guys, filter your ads!

Re:And they wonder...

[popo]

Wait...what?

Re:And they wonder...

[Aurisor]

The New York Times is one of the most respected publications in the world. It's not going anywhere.

Re:And they wonder...

[wampus]

Yeah, I was sitting over breakfast reading the Sunday Times and this popped up. Doomed.

Re:And they wonder...

[Anonymous Coward]

Well they just stopped being a respected publication after running these deceptive ads on their site. Seriously, it's the print equivalent of an ad announcing false tougher laws on car emissions with (conveniently) an address where you can get your car checked against the "new" limits.

When you take the readership that you slowing acquired over the years through hard work, and suddenly serve it on a platter to crooks to make a few bucks, it's sign that things are going downhill.

Re:And they wonder...

[Attila Dimedici]

The New York Times is one of the most respected publications in the world. It's not going anywhere.

You do know that the New York Times is bleeding red ink on a scale similar to GM and Chrysler, right? Do you expect the government to bail the NYT out as well?
I've never understood how the NYT is a "respected" publication. They have had a reputation for "reporting" stories of the way they would like things to be rather than how they actually are since the 1930's (Pulitzer prize for reporting that the Ukrainian famine wasn't happening, when in fact it was, more recently a star reporter reporting from West Virginia without ever leaving New York City).

Re:And they wonder...

[swilly]

Do you expect the government to bail the NYT out as well?

Yes I do. I also expect the phrase "too big to fail" to be used as justification.

Re:And they wonder...

[Anonymous Coward]

You do know that the New York Times is bleeding red ink on a scale similar to GM and Chrysler, right?

Well, they can just print in black ink!

Seriously, how is New York Times bleeding red ink like GM and Chrysler? I'm looking at their 2008 financial statements. The only reason it's showing net loss is because of impairment charges of goodwill.

Here's their 2009 2nd quarter result.

Re:And they wonder...

[Bigjeff5]

Yup, they're "too big to fail", while the rest of us are "too small to succeed".

Gotta love the government, creating oportunities (for the already super-rich) at every turn!

Re:And they wonder...

[Anonymous Coward]

As somone who used to review ads, this isn't as easy as it sounds. When you review the ad it points to one place, then once it goes live, they just redirect it to what they actually want to show.

Re:And they wonder...

[Bigjeff5]

Did you read those financial statements? The stockholder's equity is down almost $1 billion, or 60%, since 2005. They have more debt than their balance now (which was not so just a few years ago), they lost their ass in 2006 (net loss of $500+ million), gained a little in 2007, and lost most of what they gained in 2008. They had a net loss of $57 million in 2008. Contrast that with 2007 where they had a net profit of $200 million. That's pretty tight with revenues of over $3 billion.

Did you read that financial statemnet at all? It's downright depressing. Did you read where the $40 million 2Q profit came from? They are cutting nearly $500 million out of their budget this year, and yet that has produced only $40 million in profit. Analysts aren't impressed, because revenues are down by 20% of the already low number they were anticipating.

What happens when they run out of things to cut? They've got $1 billion in debt and are only making $20-40 million a quarter. The belt is tight and getting tighter, things are not exactly going well at NYT.

Bleeding is the right word, they only look ok right now because they were hemorraging a few years ago.

Re:And they wonder...

[bkpark]

Yes I do. I also expect the phrase "too big to fail" to be used as justification.

And expect them to extol the virtues of "free press"* in the workings of a democracy.

* for an "appropriate" definition of "free"

Re:And they wonder...

[z-j-y]

It has no chance against Huffington Post, DailyKos, Keith Olbermann et al.

More info on metafilter

[nstrom]

I was hit by this issue earlier today, more info with some malware URLs available on metafilter here.

Happened to my Parents

[QuantumG]

What really annoys me is that these things are most effective because they use javascript alerts to freeze the browser. If you could just browse away from the crap, I could teach my parents just to ignore it.

"Javascript alerts are not tab modal" has been a known bug in Firefox going on 9 years now. It's not just an annoyance, it's a security bug, fix it!

 

Re:Happened to my Parents

[Anonymous Coward]

Would that be this one? That's pretty darned old. Reminds me a bit of the title text display bug that used to hit XKCD et al.

Re:Happened to my Parents

[baegucb]

Firefox has not been around 9 years. More like 5 years under that name, and maybe 2 years before that as Phoenix/Firebird but it wasn't really very good in the early years. Perhaps you might want to install NoScript and Adblocker by default to any machine you may have to clean up.

Re:Happened to my Parents

[QuantumG]

A rose by any other name....

Re:Happened to my Parents

[Ilgaz]

If you used the evil closed source Opera browser, you would have "stop executing scripts from this page" option right below that javascript popup.

It is interesting since nobody really cares who takes what from other browsers, no "patent" or anything, especially from Opera side. It must be very easy to implement, why don't they do it? It is not some high tech JIT compiler either, a basic checkbox.

Re:Happened to my Parents

[QuantumG]

As I write this I'm trying to figure out how to do that in Firefox.. ya know, that whole "fix it yourself" open source thing. Nicest thing I can say about Firefox: at least the code is better than Open Office.

Re:Happened to my Parents

[QuantumG]

Dude, the ticket was filed in 2000.. so it was around for at least that long.. the bug most likely goes back to the Netscape days.

Re:Happened to my Parents

[Thinboy00]

Firefox has not been around 9 years. More like 5 years under that name, and maybe 2 years before that as Phoenix/Firebird but it wasn't really very good in the early years. Perhaps you might want to install NoScript and Adblocker by default to any machine you may have to clean up.

It's called "Mozilla Suite".

Re:Happened to my Parents

[Thinboy00]

If you do fix it, they may want it (see link by 1st AC child of OP). Comma is intentionally wrong.

Re:Happened to my Parents

[QuantumG]

That's the idea, but don't get your hopes up. Although I currently have the perseverance to get through the code, I doubt I'll have the perseverance to get through the politics.

Re:Happened to my Parents

[QuantumG]

What part of "parents" don't you understand?

Re:Happened to my Parents

[Bigjeff5]

You've never heard of Mozilla or Netscape, have you?

Netscape > Mozilla > Phoenix/Firebird > Firefox.

Mozilla was an offshoot of Netscape, which eventually folded leaving the Mozilla Organization behind, and the Mozilla browser became Firebird and then Firefox. Developement on the Mozilla browser itself began in 1998, which is when Netscape created the Mozilla Organization.

History man, history.

BTW, Netscape rocked until it sucked, Mozilla was the re-write (which was a stupid decision, if they had just fixed what was wrong with Netscape it would still be around, and probably be better and have a higher market share than FF), and it all went from there.

Re:Happened to my Parents

[shird]

It's a bit more involved than that. That's a custom window, not the standard Win32 supplied one.

You'd have to write your own specialised window handler and your code would have to handle treating the window it as "modal over tabs but not quite modal over the entire application, but modal enough to stop executing scripts". It's not a trivial task, and certainly not as trivial as just "adding a checkbox".

Re:Happened to my Parents

[QuantumG]

patch is attached to the defect now, if you care.

Re:Happened to my Parents

[QuantumG]

There's a wide range of solutions.. some are elegant, some are politically correct, some are nice big hacks that get the job done and stop people from using this crap to attack my parents online. Guess what I care about?

Re:Happened to my Parents

[Ilgaz]

As I am not a developer, it seemed very easy to me sorry for that.

Considering Firefox is a massively multi platform browser, number 1 concern would be how would that work on all platforms Firefox support. That baffles me since Operais massively multi platform too and somehow they do these things. For example, I see that window popup under OS X, it has nothing to do with Windows at all and Linux people see the same Window.

Oh BTW, here is the window I talk about for people won't install Opera just to see it.
http://img6.imageshack.us/img6/8444/jstemp.png

Re:Happened to my Parents

[Trogre]

Though take a look at the recent attention that bug has been receiving. I think you've had a positive effect there!

Damn right

[Anonymous Coward]

but clearly downloading an .exe file isn't a good way to keep your computer clean ..."

Absolutely, .com, .bat and .scr are the only way to go!

Re:Damn right

[hitmark]

thanks for reminding me, i have seen some clever ones over IM using .com and a odd url to trigger a download...

So...

[Skizmo]

So thats why my Ubuntu is acting weird lately.

Funny

[bryan.copeland]

I get these occasionally as well me being a mac user it's humorous to see my "c:" drive being scanned ...

Re:Funny

[Yvan256]

I've renamed my "Macintosh HD" to "C:" to accommodate the viruses, but they still won't run!

Re:Funny

[NiteShaed]

Apple is never going to get significant market share until OSX versions of these popular applications are available.

In my day ...

[PPH]

... if we wanted to catch a virus from the New York Times, we had to read a copy that some hobo had used for a blanket.

Now you kids stay off my lawn!

it has been happening all weekend

[fermion]

It really is a good social attack, reminiscent of the days when advertisers put 'click ok to continue' buttons to trick users to a promotional web site.

In this case, it runs a mock scan, states the computer is infected, and then pretends to offer help. The exe file sometimes gets downloaded. From the way I have seen IE work lately, I would not think the file would download without user intervention, but, the page does a good job of scaring users, so I suspect some might download the files.

The malware site is protection-check07com

malwareurl.com has the owner listed as Elton John, perhaps on can think that this is pseudonym. Kind of lends credence to rules that require valid information on domain name registrations.

In any case, this is where the address is listed. Looks residential, so maybe that is fake as well. I hope the protection-check people are not setting up some poor sod. Ha, protection check.

Of course this does bring up two issues. Everyone is afraid of viruses, so it easy to translate that fear into irrational action. It might make us think about some activities that went on this past weekend. Second, such attacks work on mimicking the theme of certain systems, so perhaps one countermeasure is to allow users to vary they theme. This might be very good for corporate machines, as firms might like custom themes. On Macs and *nix, of course, the attack did not work because the web page did not integrate into the background, an elephant is going to look quite conspicuous in a field of leopards.

Re:it has been happening all weekend

[Luke Wilson]

Everyone is afraid of viruses, so it easy to translate that fear into irrational action.

Exactly. Even if AV companies aren't making the viruses to keep themselves in business, their PR guys are doing a great pumping out a ton of fud to keep their sales up, and apparently the click throughs of any malware that looks enough like them.

Re:it has been happening all weekend

[davidshewitt]

In any case, this is where the address is listed [google.com]. Looks residential...

The only way to get rid of a virus: nuke it from orbit! (we have the coordinates)

Re:it has been happening all weekend

[onefriedrice]

Is the NYT hurting that badly for advertisers? ...

Re:it has been happening all weekend

[Sarius64]

A person in California can go to jail for life for stealing a slice of pizza. But the government cannot seemingly develop a law enforcement group to track down these ad creators/placers that seem to be doing this in large part to subvert connections into bot resources. I vote for spam and malware being capital crimes -- all forcibly tried in the state of Texas.

I Applaud

[Anonymous Coward]

I really have to thank the N.Y. times for going far above and beyond the call of duty and notifying their readers of virus infected computers.
Best 40 bucks I ever spent, I can now browse the web with confidence with my shiny new AntiVirus 2010 Enterprise.

Ads and proxy placement

[bsandersen]

The concern I have over the long term is that sites like the NYT may not know what advertisements will appear because they are placed by bulk-buying proxies that dispense them at page-load time, probably based on evil-cookie trails or other demographic markers. So, the question becomes: how should a presumably high-integrity site such as a major news outlet ensure quality when they've outsourced advertisement delivery?

Review of each possible advertisement would be onerous, but failure to have some standards in place will eventually lead to malware (or worse) injected into unsuspecting reader's machines. I just chuckled when it popped up. I run Macs at home. But, when things like this happen to family members running PCs (and we get the phone call) it stops being funny pretty quickly.

Is there a business case for reviewing advertisements (and the associated mobile code whether it be FLASH, etc.) for a 21st century "Good Housekeeping Seal of Approval"? After all, the NYT and others are just one virus (or porn advertisement) away from a PR nightmare.

Re:Ads and proxy placement

[PCM2]

Review of each possible advertisement would be onerous

Seriously? So we're OK with major newspapers having absolutely no standards at all these days? What do you suppose people did back in the days before you could get ads via RSS feed?

Re:Ads and proxy placement

[bsandersen]

So we're OK with major newspapers having absolutely no standards at all these days?

I believe I said the opposite; I said a failure to have standards will cause problems.

What do you suppose people did back in the days before you could get ads via RSS feed?

They reviewed the advertisements with their clients directly. There were a few hundred per day and it was a manageable problem. Now, advertisements may be served by proxies and selected from among tens of thousands of potential ads, designed to be targeted to readers in specific geographic regions, income levels, purchasing habits, interests, age categories, gender, education level, or other factors.

The point of my post was that the combinatorial explosion of possible advertisement choices to be served-up on my specific page load may not be easily reviewable by NYT staff a priori.

Re:Ads and proxy placement

[ConceptJunkie]

I don't know. Having low standards for ads seems consistent with their low standards for objectivity and truth.

Frankly, I can't see a moral argument for _not_ blocking ads any more. This crap is worse than the "Punch the Monkey" crap we used to be bombarded with*, only the poor non-technical users get pwned on top of it.

Advertising as a viable business model won't last another decade, and the biggest reason is the advertisers themselves. Look at network TV, which went from 5 minutes per half hour in the 60s to about 7 minutes per half hour in the 80s and are now breaking the 10-minute mark. I turned off the satellite subscription years ago. Hulu shows plenty of good TV (and a lot of crap, granted), but their commercial quantities are on par with the 1960s when they were quite reasonable... and they don't usually have commercials that are 10 times louder than the show itself (although that is changing recently). I can't imagine Hulu will last long, but it's great for now.

It used to gall me that the Washington Post, a supposedly respectable newspaper, would run page after page of bra and panty ads every day. Now we're getting malware from the NYT. Pretty soon we'll start seeing this crap on respectable sites like /.

* Since I haven't regularly seen ads on most sites in about 5 years, I can only assume those ads (and the people who made them) died the grisly death they deserved.

Re:Ads and proxy placement

[PCM2]

They reviewed the advertisements with their clients directly. There were a few hundred per day and it was a manageable problem. Now, advertisements may be served by proxies and selected from among tens of thousands of potential ads, designed to be targeted to readers in specific geographic regions, income levels, purchasing habits, interests, age categories, gender, education level, or other factors.

Surely a good ad proxy works something like an online dating service? If they're just throwing anything and everything at you, why use a middleman in the first place? So what criteria made them think these particular ads were acceptable for a major newspaper? Personally, I don't consider them acceptable for any site (and yes, I've seen the ads in question on the Times -- my reaction when I saw them was to immediately run a spyware scan, which turned up negative).

And God help us if the New York Times is so desperate for cash that it can't rap its ad partners' knuckles when they screw up. How would you like to be the ad-serving agency that has to tell its clients, "We just lost the New York Times?" If you won't give a client of that stature the full red-carpet treatment, you deserve to go out of business. But by the same token, if the Times won't exercise its clout as a customer, then it deserves all the blame we can heap on it.

Hopefully the paper will run a statement addressing this issue on Monday and it won't be an issue any longer.

Re:Ads and proxy placement

[bidule]

Have the proxies pay the NYT 2-3 month in advance. Cancel the contract and keep the money whenever this shit happens. They'll learn pretty fast to check before releasing it.

Re:Ads and proxy placement

[Thinboy00]

[...]

It used to gall me that the Washington Post, a supposedly respectable newspaper, would run page after page of bra and panty ads every day. Now we're getting malware from the NYT. Pretty soon we'll start seeing this crap on respectable sites like /. Now get off my lawn!

* Since I haven't regularly seen ads on most sites in about 5 years, I can only assume those ads (and the people who made them) died the grisly death they deserved.

There, fixed that for you.

Re:Ads and proxy placement

[biobogonics]

Is there a business case for reviewing advertisements (and the associated mobile code whether it be FLASH, etc.) for a 21st century "Good Housekeeping Seal of Approval"? After all, the NYT and others are just one virus (or porn advertisement) away from a PR nightmare.

IMO the mass media don't care as long as it brings in revenue. You should see the crap that gets advertised on local TV here, particularly late at night. Various make money fast schemes and "natural male enhancement".

Local newspapes are somewhat different. Well we STILL have a local paper, unlike two neighboring cities that don't. If I found something objectionable in the newspaper's ads, I would write a letter to the editor - and it would most likely be printed. As an advertiser in that same paper I could express my displeasure to the representative who handles my account OR withdraw my ads from the paper altogether. If I felt particularly steamed, I could drive downtown and in a few minutes walk into the offices of the newspaper and express my opinion.

This is a small city. The editor and publisher are personally resopnsible for the contents of the newspaper.

Re:Ads and proxy placement

[LordLimecat]

Um, they tell their current ad network that things are unacceptable and find a new provider? How does a supermarket deal with a meat seller that provides bad meat? Do they ignore the issue or find another vendor?

This IS a free market society, one of the hallmarks is being able to ditch a vendor that costs you money or PR. Its NOT difficult, and NYTimes shouldnt get a pass just cause its not their ad. Its their adspace, its their problem.

Re:Ads and proxy placement

[kindbud]

So, the question becomes: how should a presumably high-integrity site such as a major news outlet ensure quality when they've outsourced advertisement delivery?

Maybe they don't give a shit.

Re:Ads and proxy placement

[Archangel Michael]

This may be part of the reason why NYT is in trouble. Think about it, they are desperate for cash, sneak in a little malware here and there into web ads, real Advertisers get wind of it, and pull their ads from the Dead Tree version.

If I were an advertiser in the NYT, I wouldn't be happy being associated with malware distribution center.

F-U New York Times!

[Morris Thorpe]

I had the popup (despite FF w/adblock enabled) while reading a story this morning.
I never even considered that the Times would be running something like this so I launched into cleansing mode. I wasted an hour hunting for malware or a virus that was not there. Thanks a lot!

Re:F-U New York Times!

[bkpark]

If you can't trust the stories they run, what makes you trust their ads?

I, for one, take anything on NYT with a huge grain of salt. (Oh, and remember all the stories they aren't covering because they can't find a way to spin it the way they want.)

Wrong, PFT...

[spywhere]

I have FF 3.5.3 and AdBlock, the latest Flash and Java, AND the latest MVPS Hosts file, and it came up anyway. Three hours after I added the two sites involved to my Hosts file, the redirect happened again... but this time, it stalled.

Bottom line: Signature- and site-based detection can always be defeated.

Not even a News Corp paper!

[richardkelleher]

I could understand this if it were a News Corp paper like the WSJ, but a lie intended to induce fear and take money from people on the NY Times, seems out of place.

Re:Not even a News Corp paper!

[onefriedrice]

Nowadays, the Wall Street Journal is looking considerably more respectable compared to the unfortunate rag which the New York Times has turned into.

Seen in a google search

[MarcAuslander]

A few days ago, my wife hit the same thing following a link in a perfectly benign google search result! she would have had no idea how to untangle this by herself, since I had failed to turn off firefox restore on error so killing and restarting firefox got right back to the problem.

some macs can run that exe

[Ilgaz]

Believe or not, some high end virtual machines, even including MS unmaintained Virtual PC does assign themselves to .exe files and conveniently run them!

Apple knows this possibility and that is why your Safari alerts you when you download an .exe file, not like they don't know their own OS. :)

BTW, if the virus mentioned is the one I saw, don't play around with these guys since it was one of the rare times Kaspersky online scanner missed the virus (trojan) offered, I submitted it to them and they included hours later as some variant. That means we aren't dealing with some complete idiots here, they know how to morph their code so a high end AV like Kaspersky can miss it. (Mine was from Haaretz, IL English newspaper)

Re:some macs can run that exe

[TheRaven64]

It always amused me that, after installing VirtualPC (even though I didn't have a Windows image in it) on my PowerPC Mac, all of the virus attachments I got by email got a Windows logo icon. Now I have WINE installed on my Intel Mac, so they can run, but I removed the Z: drive from my partition map, so they can't easily escape from my ~/.wine directory. WINE doesn't prevent them from issuing system calls directly, so it would be relatively easy to write some malware that tried issuing a Mac system call from a Windows program and jumped to a segment containing a Mac version of the malware if it succeeded, but I don't know if anyone's bothered trying this yet, and you can always run WINE with sandbox-exec if you are really paranoid about those Windows programs...

Use NoScript, not just AdBlockPlus

[billstewart]

NYtimes.com is usually on my exceptions list, but not today...

Anybody know what the malware sites are, either by DNS name or IP address?

Re:Use NoScript, not just AdBlockPlus

[yuna49]

I just installed NoScript after getting redirected to the phony page. I reviewed all my browsing this morning and didn't see any particularly "dangerous" sites. One of them was, of course, nytimes.com. Little did I know....

As a user of Firefox on Linux, having my computer display a Windows-styled desktop folder and informing me that it was scanning my dll collection was both amusing and alarming.

For the curious, the browser is hijacked with Javascript and redirected to the phony scanning page which suggests using "Personal Viruscan." A bit of research this morning suggested it has been making the circuit this year but not on mainstream sites like the Times. However this site reports encountering the malware on a NY Times page as early as Septamber 7th. That person found it on a page about Jay-Z; I was reading the editorial columnists.

I grepped my Firefox _CACHE_ files for "virus," found the Javascript code there, but couldn't seem to attach it to a URL using "about:cache". Any hints?

Now I'm running noscript and pushing all requests through a Squid proxy on my firewall. At least I'll have a log to see what requests I've made. I'm guessing this came through the Times's ad syndication system, but I couldn't track down the source. I already run Adblock Plus and have a number of custom rules to block sites like brightcove.com and revsci.net.

Re:Use NoScript, not just AdBlockPlus

[hitmark]

i think i have seen the same one, only it hit a relative of mine that was accessing a facebook "app"...

full window hijack that looked like "my computer" with a embedded scanner, and a floating window on top of that sporting the windows firewall icon and a image link made to look like a dialog box warning the user about a virus.

social engineering at its "finest".

funny thing is that the "security package of the computer warned the user, but was not set to auto-block such pages (could be a tweak i had done on request, dont recall)...

I got this a few other places

[istartedi]

It seems to be back with a vengeance. Of course, I knew better than to click on it. I was really concerned that they already had my computer; but apparently they didn't.

You can't "view source" on their code, because it changes windows too fast. Ethereal, and its "follow stream" feature solve that problem. I was able to examine the code. I didn't really delve into it; but it looks like they've found some weaknesses in the scripts that allow you to somehow fake out the pop-up blocker.

Viewing the source allowed me to see the site they pull the JS from, and I simply redirect it to localhost now. That's a short-term fix of course. They really need to close the loophole that this code exploits.

CNN...

[CryptoJones]

has also been doing this for the past two days.

HOSTS file and noscript

[davidshewitt]

...seem to do the trick for me. I put this huge list of malicious sites into my HOSTS file, so most ads never even show up. http://www.grc.com/sn/hosts_mvps_org.txt

Re:HOSTS file and noscript

[eggman9713]

oooooh, I forgot about this. I heard about it on Security Now but never implemented it. Thanks for the reminder. I would mod you up if I had points.

Re:HOSTS file and noscript

[networkzombie]

You linked to Steve Gibson's site instead of the MVPs site! Why would you do that? His revision is from 6/14/2006.
http://www.mvps.org/winhelp2002/hosts.txt

Re:HOSTS file and noscript

[Rick17JJ]

I have been using the latest version of the MVPS modified hosts file on both my Linux computer and on my Windows XP computer. However,instead of using the 06-14-06 version which davidshewitt linked to, I have been using the much newer Sept-02-2009 version instead. One link is for, what at the moment, is the latest version of the modified hosts file and the other link is to the installation instructions and general information.

http://www.mvps.org/winhelp2002/hosts.htm
http://www.mvps.org/winhelp2002/hosts.txt

I recently also started using the NoScript add-on and also the Adblock Plus add-on for Firefox on both my Linux computer and on my Windows XP computer. But, perhaps using both the ad blocking host file, plus Adbock Plus, is redundant and unnecessary. With the NoScript ad-on, I occasionally click on the icon, which has now been added to the lower right corner of Firefox. After clicking on that, I can choose whether to temporarily or permanently allow a particular web site scripts.

I do nearly all of my Internet browsing from my Linux box. But, when I occasionally actually dare to use my Windows XP computer to browse the Internet, I use Sandboxie to sandbox my default browser, which in my case happens to be Firefox. I am not an expert on any of this, and am not a regular Security Now listener, but here are a couple of episodes that are about Sandboxie.

http://www.grc.com/sn/sn-172.htm
http://www.grc.com/sn/sn-174.htm

Re:HOSTS file and noscript

[davidshewitt]

oops! Thanks for the fix!

Re:HOSTS file and noscript

[hacker]

"One link is for, what at the moment, is the latest version of the modified hosts file and the other link is to the installation instructions and general information."

Why not just use "Hosts Man"?

red x

[JackSpratts]

i got it this morning using opera. oh the humanity. didn't click on it though. i was reminded of this: http://www.p2p-zone.com/underground/showthread.php?t=24701

You think this is bad

[Centurix]

I opened the local paper rag yesterday and my local physician was telling me I had swine flu.

Stupidity

[Gruff1002]

What more needs to be said.
This is not news worthy.

Questions and comments, please

[fcarolo]

I like the way TFA ends with "Questions and comments can be sent to adtraffic@nytimes.com.can be sent to adtraffic@nytimes.com."

In other words: the folks at advertising gave us, editorial staff, a hard time. Now please flood their mail boxes and we'll call it even.

Re:Questions and comments, please

[fcarolo]

Actually, it ends with "Questions and comments can be sent to adtraffic@nytimes.com." Damn you, ^V.

Mod parent up

[Thinboy00]

Would that be this one? That's pretty darned old. Reminds me a bit of the title text display bug that used to hit XKCD et al.

link is highly germane to the discussion

Comment removed

[account_deleted]

Comment removed based on user account deletion

I confirm this - it happened to me

[peaceful_bill]

I was shocked this happened. I use a Mac, so it didn't catch me - but I'd like to learn how this happened.

HuffPost Story

[GoinEasy9]

LOL...I read this article first on the Huffington Post. When I clicked on the story, it brought up this web site: http://mediamemo.allthingsd.com/20090913/home-delivery-the-new-york-times-serves-up-some-malware/ Lo and behold 3/4 of the way down on the right side under sponsored Links was this ad: Fix Hard Driveâ Fix Hard Drive in 3 Mins. Download Repair Tool (Recommended) ScanErrors.com Well, I don't know if this is a good or bad site, but from the looks of the comments, one wonders. Would anyone in their right minds download a program that supposedly scans their hard disk without knowing who their getting the app from? Oh...Wait a minute...Sorry...Dumb Question.

Re:modr uP

[Thinboy00]

Isn't it sad how the parent misspelled the wrong goatse URL (it's .fr now)?

on Firefox, install NoScript

[vaporland]

it will block this kind of crap - I never see it...

http://noscript.net/

For even better browsing, install Privoxy, and see no advertising, for free!

http://www.privoxy.org/

Re:on Firefox, install NoScript

[QuantumG]

my parents needs javascript.. they are not capable of turning it on and off on demand.

Not all "solutions" for geeks work for normal people.

Re:on Firefox, install NoScript

[vaporland]

You are correct - and it is a shame that NoScript doesn't have a more friendly version for novices. What I do is install NoScript and Privoxy on Firefox and leave the default OS browser (IE, Safari) untouched.

Then, if I see something that isn't "right" on Firefox I can paste the URL into the other browser and examine unscathed.

This is less technical, and I do enjoy browsing much more without ads or other noise candy...

nothing to see here, step away from your computer

[MooPi]

happened to me this morning and I called NY Times immediately. Got screenshots and saved the .exe for kicks Warned friends to stay away after that. The executable didn't seem to include a payload though, dummy file. http://s559.photobucket.com/albums/ss36/MooPii/PAV_driveby/?albumview=slideshow

Happens with Adblock Plus too

[philbert2.71828]

I've gotten this ad twice in the last two days, using Firefox with Adblock Plus and pop-up blocking. This is the line in the nytimes.com article that was responsible the second time:

<div id="adxBigAd" class="columnGroup"><!-- ADXINFO classification="bigad" campaign="Vonage01_1163613_nyt12"--><iframe src="http://tradenton.com/?id=21610438" width="300" height="250" scrolling="no" hspace="0" frameborder="0"></iframe></div></code>

That loads a page from tradeon.com, which loads a javascript file from harlingens.com which uses a JavaScript redirect to sex-and-the-city.cn. That page sets a cookie and does an HTTP 302 redirect to protection-check07. (Last time it was best-antivirus07.com)

Apparently Adblock isn't blocking the particular iframe that's responsible. I have the particular files I received in this series of redirects, if anyone is interested. I got all this information using the HttpFox plugin.

Once again with the "nofix"

[symbolset]

If you can confirm that there was malware on the system there is no cure except to start with a clean image - preferably one you stored with an imaging tool like the free Clonezilla prior to accessing any network at all or any untrusted media. Putting a clean image on can take 5-30 minutes, and is certain to remove all traces of infestation. It's actually quicker than scanning. Once you've got a confirmed hit your only business using a compromised machine is an inspection of the features that got the user into trouble so you can turn those off after you image, and capture for them a more suitable image.

There's a tired old nag about no software being secure but really one thing is for certain: once an app has been running that's known to be infested it got there because the maker knew something the user didn't. Among the other things the user doesn't know are how many other applications the malware infested, how many running services were leveraged with local privilege escalation, how many rootkits of various sorts were installed. Most modern malware immediately upon installation scans the local system and sniffs the network. They look up components and download a cocktail of toxic code that's both tailored to the specific machine and randomly generated so as to be unique. There's a management system that auto-permutes millions of vile code variants every day, and uses a genetic algorithm to determine which of the little beasties is the most efficient. This is not your dad's malware ecosystem.

Pretending to remove malware is nothing short of malpractice. All you're doing is helping the bad guys by pointing out which modules survive a cursory attempt at cleaning.

Re:Once again with the "nofix"

[Z34107]

Download the Microsoft WAIK and install it. Use ImageX to create a file-based .WIM image of your system and files.

Then, download dd for Windows. Use it to copy the first 512 bytes or the first cluster of Partition0 on the hard disk Windows is installed on. This will capture your boot sector.

If you're trying to use this for daily backups, ImageX won't work... You could always schedule robocopy to run daily/weekly instead. (It's included with Vista and up, but you can download it for XP.)

If you're not using it for daily backups, ImageX still requires "mucking about with special image files," but you can use ImageX to mount .WIM files into a directory, meaning you can use Windows Explorer or whatever tool browse and modify the file system.

Instead of DD, you could always use a Vista and above install disc or make a Windows PE disc with the WAIK and run bootsect. "Bootsect /nt52 all mbr" will get you a clean NTLDR boot sector, and "bootsect /n560 all mbr" will get you a Vista BCD-based bootsector. Of course, that only works if you're using either of those as your bootloader, but if you are, you don't even need DD.

Re:Once again with the "nofix"

[Zaphod-AVA]

While this advice works in a business environment, it simply isn't feasible for many home users. A knowledgeable technician with a PE disk has a reasonable chance to disable the hostile software, and then use up to date scan engines to remove remnants. If this approach is failing, at that point backing up personal data and reinstalling is wise, but it is still invasive and time consuming, so it is worth spending some time to try and avoid it.

Re:Once again with the "nofix"

[IWantMoreSpamPlease]

Just because *you* don't know how to clean out a system properly, doesn't mean the *rest* of us don't.

Don't assume the tools you have at your disposal are the same tools I have at my disposal.

Paid Content?

[MarkvW]

If I paid for a website and I got crap like this, I'd be mighty angry. The New York Times is now officially a malware vector.

Re:How dumb are these people?

[Anonymous Coward]

A computer compromised can be a lot of cash for a botnet organization. They buy and sell clients by the thousands, and there are a lot of things a botnet computer can do for revenue for a bot-herder. A couple:

ID theft, scan victim's machine, grab saved passwords.

Blackmail, especially if a machine is on a business network and there are business assets available via shares that a blackhat can manually get into.

Keyloggers and screenshot takers can mean good cash in compromised MMO accounts. WoW account theft is an economy in itself.

DDoS attacks and protection rackets are lucrative, and the only person that gets punished is the computer's owner.

Distributed use for cracking keys. There are still a lot of RSA keys out that are 512-768 bits that would prove to be highly sought after by black hats. Even if they don't crack the key, the keyspace exhausted allows a bigger botnet a larger chance.

A compromised machine means big cash for the person who does it, and major pain for the victim. To boot, usually the people doing it are in countries with governments indifferent or hostile to the US, so there is no way they will get anything other than a high five from their local government.

Of course, the cash from these things above is easily laundered, then used to make ads. I've seen a lot of top named sites get stung by a malware ad on a third party rotater. Perhaps its time for people to reconsider letting a third party put what it wants on their site without prior approval?

AVG Free...

[oljanx]

...started complaining about pop ups from the NYTimes website at least two days ago. You don't often see things like that on high-profile websites, so it caught me by surprise. I initially thought some form of malware was responsible for the popup.

Following the money trail?

[Cheesetrap]

I have often wondered why they haven't followed the money trail to find the people behind the "Antivirus 20xx" nonsense. I know I would certainly like to read a news story about the untimely death of the people involved.

They (FBI, and their equivalents in the dozen other countries widely affected) know exactly where it's coming from, it's just not in their jurisdiction.

Code from within the 2009 version:
"00420214 - Don`t install on Rus:; 00420234 - Russian or Ukrainian Windows detected. Exiting ..." - http://sunbeltblog.blogspot.com/2009/01/russian-don-infect-themselves.html

"In the early and mid-1990s, criminal groups provided protection to businesses and enforced contracts when the state was too weak and corrupt to do so. In the process, they actually helped sustain private enterprise, albeit at a high cost to business. The emergence of an economic market for private protectionâ"in which criminal groups compete among themselves as well as with other newly formed private security agentsâ"has stabilized the business-criminal relationship. Recently, criminal networks have taken a more businesslike approach to maximizing profit" - http://www.worldpolicy.org/journal/articles/wpj04-1/sokolov.htm

The following article is the best writeup I've seen thus far on this threat, and provides some insight on the financials:

"If these stats are to be believed, one affiliate was able to install 154,825 copies of AV XP 08 in ten days' time, and 2,772 of those copies were actually purchased by the victims. This only represents a one to two percent conversion rate, but with the generous commission structure, was enough to earn the affiliate $146,525.25 for that time period. At that rate, the affiliate could be expected to earn over 5 million U.S. dollars a year, simply by maintaining a large botnet and forcing AV XP 08 installs on 10,000 to 20,000 computers a day." - http://www.secureworks.com/research/threats/rogue-antivirus-part-2/

Kinda makes a guy reconsider his chosen career... Until you consider the mortality rate of Mafiya members, and the hordes of angry noobs wherever you go ;)

Microsoft's model is to blame.

[rantingkitten]

but clearly downloading an .exe file isn't a good way to keep your computer clean ...

Then how else are Windows users supposed to get new software? Downloading and installing random executables from god-knows-where is the expected method in Windows. Then people wonder why Windows users get infected with all kinds of crap.

The lack of any managed repository of vetted and verified software is, to me, the number one reason Windows sucks so hard, A plain vanilla Windows install does absolutely nothing on its own -- you're expected to go find all the software you need, and this trains users to believe that downloading and installing random crap is just fine.

Combine that with Windows' propensity for getting up in your face about every little detail -- THIS SOFTWARE NEEDS UPDATING! YOUR FIREWALL SETTINGS AREN'T CORRECT SOME OTHER SOFTWARE NEEDS UPDATING! CLICK HERE TO GET NEW VIRUS DEFINITIONS! CLICK ME! CLICK ME! CLICK ME! -- and it's easy to understand how this happens.

The entire Windows model is built around mindless, unnecessary alerts and "download and install now" crap. How are you supposed to teach users which are legitimate and which are not, and what's okay to download and what isn't, when the culture of the OS itself encourages you to do all the wrong things?

Re:Microsoft's model is to blame.

[dkf]

The lack of any managed repository of vetted and verified software is, to me, the number one reason Windows sucks so hard.

So you're advocating the iPhone-style app store, with obscure fascist rules determining who is blessed and who is not? I'm assuming you're not suggesting that Microsoft should be the only source of all possible software for running on Windows; that most definitely won't work due to the diversity of things that people do with computers. Well, thinking about it you might actually be advocating that, in the misguided belief that the Linux Distributor model works well; it only does if you want OSS - not always a great option, alas - and if you're content with being stuck with old versions. In short, if you need commercial software then you're still downloading executables (or other packages).

There are 4 models possible:

1. Central distributor of only code done by distributor
2. Central distributor of third-party code
3. Distributed distribution with digital signatures
4. Distributed distribution without signatures

The central model doesn't scale too well, especially when apps get really big, so the real choice for me is between whether you require signatures or not. Ho hum.

Re:Microsoft's model is to blame.

[lordandmaker]

No thanks, I am quite capable myself of deciding what I do or don't want to run on my machine. I don't need some stupid organization deciding that the executable is "safe" enough for me to run.

The idea isn't to restrict you to that software. That's certainly not how it's implemented on other platforms. You have somewhere you can go and get 'known safe'[1] applications, if and when you want them. For many users who apparently are not capable of making the distinction, and who would likely rather not have to trawl the internet for tools, this would be quite useful.

Personally, I feel this is a much greater contributor to the 'safety' of Linux than any inherent system design (especially since the user's files are more valuable than the OS's generally). The fact that the user is less likely to feel the need to install malicious software, because they've got somewhere safe to go and get it.

Re:Microsoft's model is to blame.

[lordandmaker]

I've no idea what footnote I was going to put at [1]...

Re:Microsoft's model is to blame.

[lordandmaker]

it only does if you want OSS - not always a great option, alas - and if you're content with being stuck with old versions. In short, if you need commercial software then you're still downloading executables (or other packages).

Why is the repository model only suitable for open source software? This is a genuine question, I've always assumed it'd be workable.

Re:Microsoft's model is to blame.

[Rick17JJ]

Users of Debian Linux, or a Debian derived distro such as Ubuntu Linux, have always had a safe official place to download free software from. We can use the apt-get command to quickly and easily download whatever free software we want from the more than 25,000 free software packages available in the official Debian repositories.

Synaptic is an easy to use point-and-click GUI front end for apt-get. Synaptic can easily download and install, upgrade, or uninstall various programs from the official repositories, while reliably taking care of all dependencies automatically.

Windows users do not have a similar place to go to, or built-in tools to use, to easily download and upgrade reputable, safe, non-Microsoft software. However, for installing an occasional commercial paid for software program on a Linux computer, that would still be downloaded from a companies website. As far as I know, it is just the free open source software programs that are available in the main official Debian repositories.

That is my rough understanding, of how the Debian repositories work. As a desktop Linux user, I am glad that I do not have to download software from god knows where, in response to some pop-up. If I did suddenly decide that I needed new software or an upgrade, I would generally stick to using Synaptic or apt-get to download the software for me from the official repositories, instead of using an advertising script on a script enabled web page to download whatever it is from who knows where.

There are also a few reputable, reasonably well known, commercial software companies, with Linux software, that I have bought software from, for my home computer.

The lack of something like Synaptic and apt-get, and the Debian repositories, is a severe shortcoming of Windows.

http://en.wikipedia.org/wiki/Debian

Re:Microsoft's model is to blame.

[donak]

I've tried to teach the friends & colleagues I look after to be suspicious of such messages, along with a healthy dose of cynicism about anything that tells them to PANIC!!!.

Such teaching takes time and patience, but it does sink in eventually ... I've hardly had to rescue any PCs lately.

I also teach them to believe in the Internet Security / Anti-virus product they've paid for. If they have that installed and up to date, they don't need some crap that pops up and throws a million exclamation points at them.

I'm also trying to convince them to use Linux ... but that one is going to take time :-)

Funniest waste of time message I ever saw correctly identified I was using Linux and offered to download their "fix" anyway.
I seem to recall it was on my ISPs website. Don't know what would have happened, but I ignored it.

not very entertaining

[siloko]

you do know it has an "installation mode," right?

I bloody hope so, any internet 'security' software which requires you to turn it off when you install software is a bit like a car's brakes which fail under load i.e. when they are required the most!

Re:not very entertaining

[Donkey_Hotey]

Note to self:

Don't buy neighbor's year-old Honda Odyssey...

Combofix is indeed awesome

[__aailob1448]

The people responsible for combofix have done the lot of us a great big favor. Combofix saved my ass a couple of times.

NYT Reacts to adds with story

[dk90406]

The story is somewhat weak. It suggests running Avast and MS Malicious Software Removal Tool.

from the horse's mouth

[metafoo]

http://gadgetwise.blogs.nytimes.com/2009/09/14/what-to-do-if-you-saw-an-antivirus-pop-up-ad/?hp

Re:Indeed.

[berashith]

This is what happened to me. At first I didnt know if I was running something I didnt want through wine, but then a page popped up with the scan tool that looked just like the explorer window and windows search fields.

False dichotomy

[sean.peters]

So you're advocating the iPhone-style app store, with obscure fascist rules determining who is blessed and who is not?

Of course, "absolute free-for-all" and "Apple-style App Store" are not the only two choices. You sort of get it this later in the post, but of course the main concept left out here is the Linux repository concept. You can be reasonably sure that apps in the repository have been vetted for viruses, etc (at least you can with Debian)... and yet, if you really want to get software somewhere else, you can... but it's buyer beware.

Well, thinking about it you might actually be advocating that, in the misguided belief that the Linux Distributor model works well; it only does if you want OSS - not always a great option, alas -

It's not even true that Linux repositories are all OSS (Deb certainly has a "non-free" repository), and even if it were, the OSS-ness of the repository is certainly not an essential feature. Microsoft could certainly come up with a repository of software for Windows that was all closed-source, yet still vetted for malware.

I got this

[trevor328]

I got this popup yesterday and I was worried because the only thing I had open was the NY Times website. I figured I had some kind of adware launching browser windows. I wouldn't have expected something like this from a venerable website like the Times.

Ads? What ads?

[Doug52392]

I don't see any ads on the NYT pages. I do, however, use NoScript and AdBlockPlus. And incidents like this show all the more reason to use them.

It's news that NYT is as helpless as everyone else

[Sloppy]

Is it just because this is a large, well-known website like the New York Times?

Yes.

I think some of us (hey, I was one of them) were hoping NYT had the clout to get away with Just Saying No to such bullshit. The ad business really sucks right now, because of the standard practice is the webmasters allow the advertisers to do anything to the page. You script src="somewhere" and there's just no telling what it's going to do. And the only way this can ever change, if if people say Fuck That to the standard practice. I am far too small to say no to that and still get paid to run ads (the advertisers' response would be "see ya"), but I hoped NYT wasn't. Looks like my hopes were in vain. We're fucked. Everyone is fucked.

If NYT is not allowed to prevent this problem, then who is?

Actually, there's an answer to that, but it's the answer no one wants to hear. The only people who are allowed to prevent these problems, are the users. The so-called fanatics (who aren't really fanatics) are correct: turn off javascript. You can't trust any website that runs ads, because the websites aren't in charge of what's on their pages.

Graphics, grammar and social engineering

[geek2k5]

It is amazing what decent graphics, adequate grammar and well designed social engineering can get people to do.

This is yet another variation of a series of malware packages I've seen over the last few years. You get to them through compromised websites or links. They attempt to scare you into downloading and paying for a package to 'solve' the problem. Because the graphics look 'real' and the grammar/spelling is decent, some people wonder if there machine IS infected.

I ran into one of these when a coworker on a MAC called to say that his machine was infected. They had been doing a Google search and found a link that brought up a very scary 'You are infected' screen, complete with 'scan' results. I made a lot of screen prints of the warning messages that popped up when I tried to close the screen using 'normal' means of ending the program. Somebody had a lot of 'fun' coming up with a web page that opened windows when you tried closing them.

Every few days I go to the Symantec site and look under the ThreatCon section for 'Misleading Applications' to get an idea of the current threats. They usually have screen prints of the windows.

me too, with screenshot

[mathfeel]

By some accident I disabled noscript and got this error too.

I have never seen one of these since I have been running exclusively Linux for the last few years. I thought it's so funny that I couldn't resist the chance of a screen shot: http://i4.photobucket.com/albums/y103/mathfield/my_virus_problem.png

Of course, turning on NOSCRIPT and it goes away.

MS managed to do it, in theory

[Ilgaz]

Virtual PC Mac, last shipped version (7.0.3) release notes:

"This update fixes a vulnerability that an attacker can use to overwrite the contents of your computer's memory with malicious code."

Most amazing thing is, it is actually an emulator/hypervisor ,not really something like VirtualBox. Respect to MS really. :)