Fake Antivirus Peddlers Outpacing Real AV Firms

An anonymous reader tips a writeup at KrebsOnSecurity.com detailing how purveyors of fake antivirus or 'scareware' programs have aggressively stepped up their game to evade detection. The posting is based on a report from Google's malware detection team (PDF). "Beginning in June 2009, Google charted a massive increase in the number of unique fake antivirus installer programs, a spike that Google security experts posit was a bid to overwhelm the ability of legitimate antivirus programs to detect the programs. Indeed, the company discovered that during that time frame, the number of unique installer programs increased from an average of 300 to 1,462 per day, causing the detection rate to plummet to below 20 percent. ... In addition, Google determined that the average lifetime of sites that redirect users to Web pages that try to install scareware decreased over time, with the median lifetime dropping below 100 hours around April 2009, below 10 hours around September 2009, and below one hour since January 2010."

Comments

Why use an unknown AV program?

[Kenja]

There are a number of well known AV software providers out there that have been around since the dawn of time (relatively speaking). F-Prot, Command, etc are all very good products and cost a few sandwiches a year.

Re:Why use an unknown AV program?

[charliezcc]

I don't think I have to point this out, but for the sake of clarity: the point is not that the vast majority of people are straying away from known AV software providers to unknown software providers; it is that the vast majority don't know any better and believe what the computer tells them!

Re:Why use an unknown AV program?

[fuzzyfuzzyfungus]

Because AntiVirus 2010 has just detected dozens or even hundreds of critical security threats that your existing AV has missed!

What upgrade could be more sensible?

Re:Why use an unknown AV program?

[0racle]

To be nice, the average user is very naive. If they see a popup saying they need this AV, they trust it.

Re:Why use an unknown AV program?

[Anonymous Coward]

An average user has no idea what has been around and for how long; in fact, many won't tell the difference between AV/anti-spyware, firewalls, etc :)

Re:Why use an unknown AV program?

[_Sprocket_]

There are a number of well known AV software providers out there that have been around since the dawn of time (relatively speaking). F-Prot, Command, etc are all very good products and cost a few sandwiches a year.

For the same reason that "the Internet" is IE (or at least the IE icon) to some people.

Re:Why use an unknown AV program?

[Altus]

Its shocking though, nobody would trust someone in the real world telling you that you need something they are providing without some kind of double check.

If someone showed up at your house and told you that your water could kill because of some microbe you have never heard of that they claim is getting into your pipes and the only way to make yourself safe is to install this helpful filter that they are selling would you believe them?

Re:Why use an unknown AV program?

[lukas84]

There are plenty of people making money of exactly this scheme.

Re:Why use an unknown AV program?

[Fred_A]

If someone showed up at your house and told you that your water could kill because of some microbe you have never heard of that they claim is getting into your pipes and the only way to make yourself safe is to install this helpful filter that they are selling would you believe them?

A /. reader probably not, but the general public ?

If there was any profit in it, you could easily create a scare campaign about DHMO which could turn very messy. People can be insanely gullible when you present things the right way.

Re:Why use an unknown AV program?

[Darkinspiration]

To be fair a lot of people would. It's just that in the real world the amount of complaint youd drive the cop after the scammer pretty quickely. On the web the police can't/won't run after the scammer.

Re:Why use an unknown AV program?

[Tryle]

Well just for your information, my filter is working quite well thank you!

I'm just not quite sure how it works when they never actually connected it to my water pipes but hey I'm still alive to post this thanks to my filter!

Re:Why use an unknown AV program?

[Anonymous Coward]

And sometimes the production values of the fake AV are pretty high. Never underestimate how a few nice gradients, some fancy fonts and a bunch of multi-syllabic techno-words can convince Grampa to keep clicking that "Press here to scan" button. Particularly when crappy pop-ups and fake websites that it pretends to defend you from are obviously scum.

The problem I usually see is that the person clicks a link in an email or instant message that is from a known friend that did the same thing. The user gets taken to a site and realizes that they've been duped and all of a sudden some antivirus thing (that sits in the background, they never see it actually working) is all of a sudden telling them what they already know - they're infected. The fake site used to induce fear is clearly shady and looks like crap, and the shiny antivirus has leapt to your rescue.

Re:Why use an unknown AV program?

[Anonymous Coward]

There are a number of well known AV software providers out there that have been around since the dawn of time (relatively speaking). F-Prot, Command, etc are all very good products and cost a few sandwiches a year.

Did you seriously just recommend Command? FAIL.

I cant count the number of times I had to use Symantec Corporate to remove infections that got by Command in the college I work at. About the only thing Command is good for is notifying you that it has allowed an infection in and cannot remove it. Great....

Re:Why use an unknown AV program?

[0racle]

Its shocking though, nobody would trust someone in the real world telling you that you need something they are providing without some kind of double check.

Many mechanics rely on this not being true all the time. Cars and computers are magical things to many people, things that normal people aren't expected to be able to understand. These 'normal people' are simply used to trusting anyone, or anything now, that claims to be an expert on the subject.

Re:Why use an unknown AV program?

[Anonymous Coward]

for our customers their browser is google. the internet is windows and their email doesn't work despite them typing their email address into google.

Re:Why use an unknown AV program?

[sharkey]

Does it scan "services.exe"?

Re:Why use an unknown AV program?

[skine]

It's not a scheme, it's marketing.

Re:Why use an unknown AV program?

[G00F]

Bad analogy for your angle, the water purification market uses that exact tactic and is alive and well.

That is exactly what the fake AV companies do (and some of the real ones)

But the real trick is most of the time people don't know they installed anything, their compare said it had problems click here to fix, and now they have more problems . . . but those can be fixed by buying full pro version.

Re:Why use an unknown AV program?

[natehoy]

Oh my God! Who do I make that check out to again? No, can't wait for it to clear, let me just give you my mattress and you can take how much it is, OK, I can't number very well.

OK, seriously...

Remember that many of the victims of scams like this don't know any better. These aren't random people showing up at their houses, they are ads showing up on websites. But many don't even know that.

They only know that their "computer person" has told them to make sure their AntiVirus is working correctly, and that the computer has just told them that their AntiVirus has stopped working correctly but the nice warning offered to fix it for them. Many of the newer ones look pretty legitimate, too, and have multiple URLs so when you Google them fake review sites come up and gush enthusiastically about how great the product is.

I have a co-worker who has been hit by this. I support 2 co-workers' home computers. They are otherwise intelligent people who use the preconfigured computers here at work every day. I give them lists of free antivirus packages they can load, and the one who had the problem came in and told me that her subscription to n0d ran out, but that the computer had warned her to replace it with "AntiVirus 2010" which had a free trial, but she noticed that once she installed it the computer slowed down.

She's not dumb, just on the low end of computer literacy. She knew that she needed to avoid popups and to run an Antivirus client, but this specific popup looked like a dialog box and she knew that her AV was running out, so she assumed it was like all the other warnings Windows Seven likes to send her about updates and such.

Re:Why use an unknown AV program?

[Hummdis]

You have have seen this about dihydrogen monoxide and how it's being put in everyone's water supply! :)

Get a few of these to circulate and people will be in a full-blown panic. Remember, a person is smart. People are dumb.

Re:Why use an unknown AV program?

[RobDude]

When a person shows up to the door, people are skeptical because they don't know that person and don't have a business relationship with them.

If you already buy an expensive product from a reputable company; you are going to be far less skeptical about things you are told about that product, by that company. If you buy a new car from Ford and the 'ABS' light comes on - provided you know nothing about cars, other than how to drive them, to believe that there is something wrong with your brakes; compared to how likely you are to believe there is something wrong with your car's brakes if a stranger knocks on your door and tells you.

When people see a pop-up on their computer; they assume it's coming from Microsoft or Dell or whatever. So, they trust it.

Re:Why use an unknown AV program?

[Anonymous Coward]

If only Madoff had you as a lawyer.

Re:Why use an unknown AV program?

[celibate for life]

I was once infected at my work computer, which runs Windows XP SP3, while visiting the website of a private porn torrent tracker, with lots of ads. I did not click any links or solicited the installation of the program, but somehow some sort of "Antispyware 2010" appeared there. It must have been a browser exploit or something like that. It wasn't too difficult to get rid of, I just needed Malwarebytes antimalware (the free version). Anyway, now I turn off Flash and JS before browsing porn at work.

Re:Why use an unknown AV program?

[Kjella]

Bad analogy because if you've never heard of the microbe there's something fishy, why hasn't there been any official alert? But everybody knows there are viruses on the Internet and that you have to protect yourself against them, it's a confirmed fact you should have anti-virus. If everybody had to filter their water and you offered the ultramagic superwhoopie cleanex filter 3000 for the low, low price of 199$ many people would buy it.

Re:Why use an unknown AV program?

[AaxelB]

Its shocking though, nobody would trust someone in the real world telling you that you need something they are providing without some kind of double check.

If someone showed up at your house and told you that your water could kill because of some microbe you have never heard of that they claim is getting into your pipes and the only way to make yourself safe is to install this helpful filter that they are selling would you believe them?

A big difference is that the fake antivirus pop-ups aren't usually trying to sell you anything, they just want you to click OK! It's easy to click OK, and, for the average [clueless] user, just clicking OK doesn't feel nearly as risky as letting a stranger into your home, or buying a mysterious product.

I think most people just do a naive, clueless sort of risk assessment. If the pop-up is telling the truth, they really need the software. If the pop-up is lying... well, they're not directly paying anything and have no idea what could go wrong, so they assume it's not a problem. Therefore, they decide to click OK to install the software. To them, it's more like some random person standing on the sidewalk telling them, "You should walk on the other side of the street; there's a dead skunk halfway up the block and you really don't want to get near it." Eventually people will learn... but it may take a few generations.

Re:Why use an unknown AV program?

[ElectricTurtle]

Actually there are some places where water purification is necessary. Go to Moline, IL and see how you like the tap water. Is it safe? Of course, but it's nasty. Water purification companies never say that the alternative isn't 'scary unsafe' just that the purified water tastes better, and compared to some places, it might.

Re:Why use an unknown AV program?

[Jurily]

Actually, that's a good point. Most viruses today are tested against the big brands before release.

Re:Why use an unknown AV program?

[ElectricTurtle]

Both mechanics and techs are wary that at some point they'll come across somebody who knows what they're doing but is just too lazy to do it themselves (which happens more with cars) who will out them (and potentially prosecuted them) if they try any charlatanry.

Re:Why use an unknown AV program?

[ElectricTurtle]

I believe you may have been looking to say "svchost.exe"

Re:Why use an unknown AV program?

[Anonymous Coward]

hundreds?

It sounds like what happens every time I install a microsoft product then get updates to it every week for a new critical security threat.

Or install a "service pack" that claims I had a billion critical security threat.

Re:Why use an unknown AV program?

[Nadaka]

I was once infected at my work computer, which runs Windows XP SP3, while visiting the website of a private porn torrent tracker, with lots of ads. I did not click any links or solicited the installation of the program, but somehow some sort of "Antispyware 2010" appeared there. It must have been a browser exploit or something like that. It wasn't too difficult to get rid of, I just needed Malwarebytes antimalware (the free version). Anyway, now I turn off Flash and JS before browsing porn at work.

Let me guess... You work at the SEC?

Re:Why use an unknown AV program?

[Anonymous Coward]

Sex is like oxygen, it is only a big deal if you are not getting any.

The fact that you username is a sexual reference and you openly post about browsing porn at work, I am going to have to say that you think about sex a lot and are probably not getting any.

Re:Why use an unknown AV program?

[Anonymous Coward]

OH - MY - GOSH!
I'm so glad you told me.
Can you install the filter today?
I have cash, here in my sofa, just help me move the diamonds and priceless artwork first.

Re:Why use an unknown AV program?

[celibate for life]

"celibate for life" should make that obvious, no need for long preambles.

Re:Why use an unknown AV program?

[Anonymous Coward]

There are a number of well known AV software providers out there that have been around since the dawn of time (relatively speaking). F-Prot, Command, etc are all very good products and cost a few sandwiches a year.

I've never heard of them and if somebody tried to tell me about them I would probably assume they're scams too. Are you sure those are well known? How certain are you that a random person with no interest in AV software would have heard of them?

Re:Why use an unknown AV program?

[Volante3192]

Yep. I can easily change brake pads, oil, oil filters...

But it's a pain in the ass with my 50 piece Craftsman set and could take hours. I'm more than happy to take it to someone with a pneumatic wrench and a lift.

Re:Why use an unknown AV program?

[0racle]

Are you suggesting that neither techs or mechanics suggest or try shady shit because of this mythical fear?

Just had a mechanic suggest I flush the break line on a 3 year old car, 'because it's something that should be done every 3 years.' Of course the dealership was willing to to do it to just $150 or so.

They ain't afraid of shit and heaven forbid you have a vagina but for some reason, by and large the general public believes you should just trust people calling themselves experts.

Re:Why use an unknown AV program?

[_Sprocket_]

Somehow, I don't think the phrase "the [internet] is the computer" was supposed to work out that way.

Re:Why use an unknown AV program?

[Altus]

But aren't these fake antivirus apps coming from random popups (mostly on porn sites :-).

I would think a popup ad would make people at least as skeptical as someone coming to their door unsolicited.

Re:Why use an unknown AV program?

[Altus]

My mechanic I already have a relationship with, he might be screwing me, but I already trust him to at least a certain extent; I let him fix my breaks after all.

I might trust my plumber who I hired to install a hot water heater when he tells me I need some doohickey (technical name) installed but not a guy who shows up at my door, and certainly not some popup from a web site.

Re:Why use an unknown AV program?

[Altus]

Yea, but I've heard of Britta.... just like I've heard of Macafee (especially now!). They may or may not do anything, but at least they are popular and if they were total garbage, or actually bad for you, I would probably have heard of it.

Its when Joe shows up at my house selling Joe's super duper water purifier (It gets the things that Britta misses!) that I start to get really skeptical.

Re:Why use an unknown AV program?

[Cro Magnon]

Actually there are some places where water purification is necessary. Go to Moline, IL and see how you like the tap water. Is it safe? Of course, but it's nasty. Water purification companies never say that the alternative isn't 'scary unsafe' just that the purified water tastes better, and compared to some places, it might.

My GF has family in some two-bit rural town in southern Missouri, and their water is TERRIBLE. I can say, even without tasting the "purified" water, that it HAS to be better than the local water.

Re:Why use an unknown AV program?

[shadow169]

Its shocking though, nobody would trust someone in the real world telling you that you need something they are providing without some kind of double check.

If someone showed up at your house and told you that your water could kill because of some microbe you have never heard of that they claim is getting into your pipes and the only way to make yourself safe is to install this helpful filter that they are selling would you believe them?

Have you even heard of infomercials?

Re:Why use an unknown AV program?

[bit01]

F-Prot, Command, etc are all very good products

No they're not. They're fraudulent.

Scanning a potentially compromised system from inside that potentially compromised system is snake oil and it's no surprise that most anti-virus "products" don't catch a whole swathe of different viruses, trojans and root kits. Such anti-virus products are little better than placebos.

It's about time there was a class action lawsuit to bring them to justice.

At a minimum they should be booting from known good media (e.g. CDROM) and cryptographically signed tripwire style verification of files. Anything less is just wishful thinking. BIOSes should be physically write protected also and motherboard makers who don't do this share some of the blame. M$ also for deliberately not providing bootable known good media with every OS copy sold and treating non-cryptographically signed software installation as if it is some sort of daily event. Ironic that bootable Linux based CDROM's may be the best way to fix the Windows virus epidemic.

tl;dr - Running anti-virus? You've probably been had.

---

"I know that most men, including those at ease with problems of the greatest complexity, can seldom accept even the simplest and most obvious truth if it be such as would oblige them to admit the falsity of conclusions which they have delighted in explaining to colleagues, which they have proudly taught to others, and which they have woven, thread by thread, into the fabric of their lives." --Leo Tolstoy

Re:Why use an unknown AV program?

[squallbsr]

Yeah, I had my car in for an oil change at the dealership (I have free lifetime oil changes), 1 year ago they said I only had 1mm of brake pads left, then 3 months ago they said I had between 2-3mm of brake pads left. I think I have the *only* car that actually GROWS brake pads instead of wearing them down.

Needless to say, I don't let them do anything to my vehicle beyond the oil change.

Re:Why use an unknown AV program?

[hairyfeet]

As someone who works PC repair I can tell you that many, if not most of these "fake AV" programs are getting installed via drive by. You see what most folks don't know is that ALL of the major OEMs cripple their PCs at the factory by installing them with automatic updates turned OFF. No why they do that stupid shit, who knows, but the result is a machine that is VERY badly out of date by the time the customer gets it. And of course since they don't know it has been crippled it will NEVER get updates until it gets hosed and comes to someone like me.

So they go to Walmart, Best Buy, whatever, and buy this machine that is as much as a year out of date with NO hope of getting updated, plug it in, and start using the "big blue E" which gets pwned within a couple of days to a month if they are lucky and only surf the major sites. The next thing they know when they turn on their PC there is this new "security tool" slapping them in the face and demanding money to go away. These things are seriously nasty and a royal PITA to kill, so they have to bring them to me.

But if you want someone to blame for the spread of this crap, it ain't the users this time. It would be like buying a new car and expecting to know that the shop rigged your brakes so a certain degree of incline will fail if they aren't re-calibrated. By the time the user gets a PC from the big chains often the 30 day crapware AV has run out, it is at least 6 months behind on security updates, and of course there is the fact that auto updates has been killed dead at the factory. You think if the government was worried about cyber-warfare and cyber-terrorism they would drop the hammer on those OEMs and make them have at least halfway sane security policies.

Re:Why use an unknown AV program?

[twentynine]

I prefer GreenAV as it also seems to protect the environment.

Re:Why use an unknown AV program?

[DigiShaman]

A big difference is that the fake antivirus pop-ups aren't usually trying to sell you anything

Not sure what fake AVs you've seen, but all the ones I've run across will say you're infected with X amount of viruses, but you must purchase the full version to have them removed. Two clients I know have pulled out their CC to make the purchase. Big mistake!!! Once I've informed them that they've been a victim of fraud, they agreed to contact their bank and have a new CC number issued. Obviously the original number had been now tainted.

Re:Why use an unknown AV program?

[Sheen]

Have you had any tiger problems since you installed it?

Re:Why use an unknown AV program?

[bit01]

There is nothing trollish about the above post, merely an ugly truth that certain scammers don't want widely known. They are making huge amounts of money selling what is little more than placebos and some of that money is being spent to manipulate the perception of their "products".

---

Don't be fooled, slashdot is not immune, like most social networking sites it is full of lying astroturfers dishonestly pretending to be objective third parties rather than paid company propaganda.

Re:Why use an unknown AV program?

[Anonymous Coward]

brake fluid should be changed every three years :S

Re:Why use an unknown AV program?

[VanGarrett]

No, none of the women of the house have developed an abrupt interest in professional golfers, but thank you, anyway.

Re:Why use an unknown AV program?

[CrashandDie]

If someone showed up at your house and told you that your water could kill because of some microbe you have never heard of that they claim is getting into your pipes and the only way to make yourself safe is to install this helpful filter that they are selling would you believe them?

Probably not, but then again you're not being very insightful by asking this on /., where readers are by essence critical than the average joe.

There still is something called social compliance, a term coined by scammers but which is quite close to what this link describes. Also read up on this. Social compliance means that people will very easily accept your position of authority provided that you are in the right place, with the right attitude, costume and speech. One quite famous example of this is by BBC show The Real Hustle, where one of the hosts pretends to be with the company that provides parking spaces, and sells "special day passes". If you pay for an hour it's 2 GBP, if you pay for a day it's 10 instead of 16 [1]. The "pass" that he gives to people is an extremely simple ticket, it doesn't even hold a magstripe. By the time people start using the cards, he's long gone, and suddenly people have to try and explain to the parking manager why they're using cards that have utterly no value. Why did people buy them? Because he's wearing a hi-vis jacket, has a clipboard and gives out pieces of paper.

What most of these frauds rely on are "the bait". It's an age old trick, but the snake-oil seller needs someone to start buying first (and usually a big amount). This makes the others believe a/ it's a bargain, b/ the sale was validated by one (so they think) legitimate buyer, c/ there is scarcity because 20 items were sold in one go -- they might lose out if they don't act fast.

The UK gov published ordered and published a report that tried to explain the psychology behind scams, and why they work (so well). These were the highlights:

• Appeals to trust and obbey authority: This is roughly what I explained above. People are inclined to believe anything that seems legit, and which does not give them any reason to doubt. If it looks real, smells real, feels real and sounds real, it must be real. Also, people want to be led, this dramatises the above. This sadly also explains why phishing actually works.

• Visceral triggers: Again, what I explained above, scammers will play the most basic instincts and feelings of people in order to fool them. Greed, fear, avoidance of pain, desire to be liked, etc. This causes instinctive, impulsive behaviour, which means people buy first, ask questions later.

• Scarcity cues: Same as explained in the example above, by making people feel as if the product may run out soon, they have instinctive pressure building up to make a decision fast. This can also work by making the offer seem highly personal. If you, and only you are in for a particular deal, you're not lucky: you just need to make sure no-one else gets it.

• Induction of commitment: By making people take small steps, individual steps that aren't very difficult to accomplish, the scammer push the victim into a guilt-trip for pulling out. The further they go, the harder it is for them to pull out. This also works if the victim already gave money. You're more inclined to give me 200 USD for "processing" if you've already given me $10, $20 and $50. (This BTW is used by casinos too, that's why the cheapest fruit machines are at the front, the big money losers are hidden in the back.)

• Pot odds: May sound stupid, but everyone makes those calculati

Re:Why use an unknown AV program?

[hairyfeet]

Hey morons, how exactly is this a troll? want proof, here you go-Walk into ANY Best Buy, walmart, Staples, Office Depot,click on action center and choose "Windows Updates", and look for yourself, it'll be under "update history". Just had to clean one today that was bought less than two weeks ago and was the RTM Windows 7, not a SINGLE update since then had been applied and auto updates was...drum roll...turned off!

Can they get infected other way? Sure they can, as another reader points out Adobe Flash leaves a hole you can drive a truck through, which is why I give my customers Firefox with Adblock and flashblock along with Filehippo update checker. But in case y'all ain't up on current events malware writers tend to go for the path of least resistance. ANYONE who has spent ANY time in the trenches knows a week after MSFT puts out updates malware writers reverse engineer them to make exploit code. This ain't exactly a trade secret folks.

So unless you can point to ONE source that says keeping Windows unpatched is a good thing I rest my case. Sure you get the grannies that get spooked by a pop up, or the kid that'll click on anything, but I have watched with my own two eyes as an unpatched IE got pwned by a malicious webpage. They loaded the page and BOOM...shit everywhere. Here is the definition at wikipedia in case you need a refresher. Please note #3, which is exactly what I described in my post.

Now considering I clean around 4-6 of these rogue AV programs every. damned. week. including finishing up a case of "Security Tool 2010" less than 3 hours ago, I think I may know a little bit more about it than the moron who wasted his points modding me down. For those that aren't as retarded, here is my findings on most to least ways folks get slammed with rogue AV---1.-drive by from unpatched IE...2.-drive by from unpatched Adobe Flash flaw..3.-Email link, usually exploits either 1,2, or Adobe Reader flaws...4.-User is fooled into thinking it is an update and installs it.

Re:Why use an unknown AV program?

[sharkey]

Whoops, damn. Killed the joke, didn't I?

Re:Why use an unknown AV program?

[Techman83]

Dealers are like that hear in Aus. I prefer to take vehicles to a smaller shop with a good reputation. One mob tried to tell my fiancée that she needed a new horn (at $260) as it was "off tone". Now it's the loudest thing you could ever hear (quite unexpected for a car that small) and gives a single continuous tone, which is all that is required to be considered roadworthy in Australia. General servicing used to cost her nearly $500 (Fluid/Filter Change), we recently had a timing belt and water pump replaced at the VW Specialist (which in that car is an insane job) which came in at $540. Dealers that rip people off are the scum of the earth.

Re:Why use an unknown AV program?

[Spatial]

Ordinary users have no idea about those things. They get sold products to alleviate the symptoms, not education to eliminate the cause. The ignorant are always easy pickings.

Re:Why use an unknown AV program?

[Anonymous Coward]

They're both dumb. Everybody is dumb. Everybody.

Some people know they're dumb, so they take extra precautions to alleviate the problem: learning critical thinking, checking facts, slowing down their decision making processes to give their slow minds a chance to reach the right answers.

Re:Why use an unknown AV program?

[Spatial]

+1 ironic username.

Re:Why use an unknown AV program?

[Anamelech]

That's odd. I was one of the Resident Technicians at a Staples in Nova Scotia until the 16th. At least here in Canada, the OEM systems are configured to run the factory restore image on first boot. The user then sets up the Windows update settings, language, etc. May be different where all of our systems are multilingual. As far as looking on the shelf goes, that's just a bad idea. Any yahoo walking past the system can flick over to the windows update settings and change them, or do any other number of things. One of the reasons we do a factory restore on the sale of a demo here. That, and to reset those 30 day trials.

Re:Why use an unknown AV program?

[Anonymous Coward]

The owner of the IT subcontrator I work for used the company VISA to pay for "SecurityTool" to remove the virus on his machine then told our internal network tech....

Re:Why use an unknown AV program?

[Lil'wombat]

You know if you keep the blinker fluid topped off, you can avoid the brake fluid flush as the systems are linked. As a benefit, you won't have problem of a slow blinker. And the Zafren rockers - make sure those get lubed every 7,000 miles.

Re:Why use an unknown AV program?

[Anonymous Coward]

Your comment reminds me of the last time I took the car in for an annual maintenance inspection: They claimed to have checked parts of the car introduced in later model years!

I only caught it because I read the manual cover to cover (that is what suggested th inspection in the first place.

Re:Why use an unknown AV program?

[Anonymous Coward]

It's not just clicking on "OK". Even if one clicks on the "X" to close the pop-up, it still installs. No matter how many times I try to teach some folks to never click anywhere on these pop-ups and just use "alt + f4" to close the browser, they still just blindly click away.

Most people are just sheep and just do as they are told.

So sad...

Re:Why use an unknown AV program?

[infonography]

Whoops, damn. Killed the joke, didn't I?

Now my Slashdot Antivirus 2010 detected it as a unstable joke. Naturally my Craigslist Buyer Protection plan come in handy now.

Re:Why use an unknown AV program?

[TheLink]

Yeah, the general public are that gullible - just look at the sort of hoax emails they forward.

There are people who go around to people's homes and conning gullible people. But it is actually riskier and harder to go door to door (you can't con thousands at the same time).

And the popular perception is the cops don't bother catching you if you con people in the virtual world.

It's not all international or out of jurisdiction: follow the trail and there are plenty of US fraudsters conning US people (just look at the top spammers).

Re:Why use an unknown AV program?

[Anonymous Coward]

This has happened in the past. Some guys show up to your house, ask for a sample of your water, pour their packet of _whatever_ in the sample of water and stuff starts to appear. Simple chemistry = scaring the crap out of someone to buy your snake oil.

Re:Why use an unknown AV program?

[jonwil]

Why would an OEM do something as stupid as shipping a machine with automatic updates turned off?
Are they concerned about user complaints that their internet connection is slow due to it always downloading automatic updates?

Re:Why use an unknown AV program?

[the_womble]

It is not reasonable to expect non-geeks to know who the well known AV providers are.

It is one more reason why using a reactive system like AV means you have already lost.

Re:Why use an unknown AV program?

[hairyfeet]

Well if your store does that I congratulate you sir, because it certainly isn't that way in the states, at least from Walmart, Best Buy, or Office Depot (our local Staples is more corporate and make their money selling laser AIOs, not desktops/laptops so I haven't worked on any of theirs) as I have had to work on models sold by the above very recently and ALL had the auto updates turned OFF. And since we are talking about non technical working folks I kinda doubt they went in and turned off auto updates, since most non techs are afraid to even mess around anywhere near control panel.

As for the moron that keeps modding me down, hey guess what? Here is a link from Panda AV describing EXACTLY what I said, rogue AV being installed via drive by downloads! What are the odds, a guy with 15 years in the business actually knows what the hell he is talking about! Amazing!

Frankly everyone in the IT world needs to care about this, because the massive botnets created by these unpatched machines affect us all. The average number of infections of an unpatched PC that cross my desk is over 500, yet time after time after TIME I get machines from big box retailers crossing my desk with auto updates turned off. This is NOT a coincidence, or legions of people that couldn't find the control panel applet suddenly deciding that updates are bad, no this is just a really shitty image policy of some big box retailers. According to the above poster it doesn't happen at Staples, at least in his area, and since to my knowledge I haven't had any of their tech, take that back, I had one of their Black Friday POS "specials" (WTF? A Celeron DESKTOP chip in a laptop?) and it had the updates for XP turned off, but that was pre Windows 7 so maybe they have changed, or maybe it is just a local problem.

But I have had more Wally World and Worst Buy (Ugh Worst Buy...were POS is actually a compliment) "specials" cross my desk, and I can honestly say I have YET to see one, just one, with updates even turned to notify. Remember folks, this affects us all. When granny or sally clueless gets turned into a member of a botnet it is YOUR email servers that get buried in spam, it is YOUR websites that they hack or DDOS, and it is YOUR Internet that slows to a crawl when they crapflood the pipes with the latest worm. I think in this day and age of drive by downloads asking for sane policies OOTB for big box retail PCs isn't too much to ask for, and I applaud the Nova Scotia Staples for having sane IT policies. From those of us that don't have to clean up after your PCs, thanks.

Re:Why use an unknown AV program?

[daniorerio]

Good point, as long as you don't need to enter your credit card number, most people will reason what's the harm of clicking OK?

Re:Why use an unknown AV program?

[Anonymous Coward]

well I could deduce that from his username alone already...

Re:Why use an unknown AV program?

[English French Man]

When the PC has a problem, the average customer calls the OEM that selled it to him. So the customer comes back, and you can make money on support calls.

Re:Why use an unknown AV program?

[rant64]

It has nothing to do with "the average customer". The OEM is required to offer product support for OEM versions of Microsoft products which come pre-installed on hardware they sell. The OEM may also not charge for support in the first 90 days after purchase. You must be a) not aware of the OEM licensing terms or b) your shop is doing something really stupid/illegal.

Re:Why use an unknown AV program?

[English French Man]

The OEM may also not charge for support in the first 90 days after purchase.

So, after 90 days it is OK to charge?

You must be a) not aware of the OEM licensing terms or b) your shop is doing something really stupid/illegal.

a) guilty as charged, I was just speculating on what might be the reasons behind this reasoning. b) I don't buy OEM, I wouldn't know. And c) I don't live in the USA, so the laws might be different.

Re:Why use an unknown AV program?

[csartanis]

It's both?

Re:Why use an unknown AV program?

[hairyfeet]

Lord I wish I knew, as maybe we could get these brainiacs to stop doing it!!! The only thing I can figure is they install so damned much crapware on OEm PCs these days they are worried about confilcts with the buttload of garbage they put on these things. I just dealt with a Compaq laptop yesterday that had more than 45 damned startup entries, all OEM crapware!

They had "extra offers" for the printer that loaded, some sort of "helpful HP service" trying to push crap, crap for the Roxio burner, the picture software, you name it the damned thing had a startup entry for it. I know it wasn't installed by the user because the user had me wipe and reinstall from the OEM CD, since he wanted his Roxio (bleech!) back. Sure enough after a wipe and reinstall that thing was as slow as a 486Sx trying to run WinME! Luckily this user wasn't averse to learning new things, so I showed him how easy IMGBurn was to use and he let me kill the Roxio.

But if you or anybody else reading this finds out why OEMs kill auto updates dead, feel free to email me and let me know. I have been dealing with this since XP came out and it drives me nuts! I am just sooooo glad there is Autopatcher, as between it, the service packs for all the Windows versions on DVD, and Ninite that takes care of all the usual software like Flash, Java and Firefox (with NO TOOLBARS! Yay!) my life is a whole lot easier. Still I would be happy to lose a little business if the OEMs would quit turning the dang autoupdates off.

You get a PC from an OEM that is more than a year old with updates off? That thing has more viruses than a Bangkok whore pal. It ain't a pretty sight, and like the plumber that has to deal with the busted shitter i got to wade into that mess and clean it up.

Isn't this kind of expected?

[Behrooz]

Step 1: Create a better scareware vector with a higher infection rate.
Step 2: ?????
Step 3: Profit!!!!

Seriously. There are incredibly lucrative incentives inherent in this kind of scam. No surprise they're spreading and getting smarter.

This is why i love noscript and requestpolicy

[aekafan]

nt

Re:This is why i love noscript and requestpolicy

[MozeeToby]

Or you could, you know, not install programs from random websites that you've never heard of before today. Oh, and without doing even the most basic research to check if they're legitimate. Sadly, I know at least 2 people that have fallen for these scams. Scams which the non-online equivalent would be billboards along the highway that say "Let us into your home while you're at work so we can make sure no one's robbing it!".

Re:This is why i love noscript and requestpolicy

[Anonymous Coward]

If only wives would listen

Re:This is why i love noscript and requestpolicy

[plastiqueman]

I work for an IT helpdesk at a large public university and we see students come through all the time with these programs. Realistically though, the installation vector we see the most is not the installation of programs from random websites; the majority get them from clicking a link to watch a movie (still in theaters) online or even through certain ads in Facebook. These programs have simply gotten extremely clever at tricking the end user.

Re:This is why i love noscript and requestpolicy

[DigiShaman]

Our clients get these from ad pop-ups. Generally, the 3rd party ad servers get hacked to serve out these fake AVs. So, sites such as CNN, MSNBC, Fox News, and Drudge Report is often thought to be the vector. They are not, but their 3rd party ad subscriptions are! What's worse, is that these browser instances often look like legit program update windows (Java, Flash...etc). So a user goes to install the "update" and that's when the real fun begins.

At this point, you can't really blame the user (too much really). These fake AVs are very well targeted and masked to look like the real thing.

Re:This is why i love noscript and requestpolicy

[yuna49]

Pirated movies? Facebook? How about the New York Times?

In this case the software was distributed through one of the on-line advertising systems that feeds ads to the Times. The fact that serious, reputable publications like the New York Times don't automatically scan all third-party content like these advertisements and block those that contain scriping is just unconscionable to me. Ads with text, graphics, hell even animated GIFs, are okay in my book; scripts, no thank you.

Re:This is why i love noscript and requestpolicy

[Achromatic1978]

Our clients get these from ad pop-ups. Generally, the 3rd party ad servers get hacked to serve out these fake AVs. So, sites such as CNN, MSNBC, Fox News, and Drudge Report is often thought to be the vector. They are not, but their 3rd party ad subscriptions are!

Generally, no. Generally, the reason is that the advertisers and their site owners rarely truly care. Have you seen the utter shit, spam, fakes, frauds that masquerade as Facebook ads, however often you click "X" and report it as "misleading / deceptive". Seriously, go to apple.com/store. Look for the neon green MacBook Air. You know, the one you can "test/review then keep for free"...

It's lip service. They. Just. Don't. Care. The advertisers are paying the bills, not you.

Re:This is why i love noscript and requestpolicy

[speedlaw]

I've a ten year old that knows that a 'free video game' from a website is probably a Trojan. He's quite a history buff so this kind of attack made good sense to him.

There is a special place in hell for these people

[Capt.DrumkenBum]

I envision it as a desk with a computer and an infinite stack of virus infected floppies. :)

Re:There is a special place in hell for these peop

[Anonymous Coward]

I wouldn't go that far. I'd just give them a desktop with Windows.

We've had a couple of these

[IICV]

We've had a couple of these at work - not fake AVs, but some weird thing that seems to change the Active Desktop so that it looks like there's an antivirus window.

The funny thing is that they look a lot more like an anti-virus program than our actual antivirus. They have this really slick fake "scanning" window that looks like something Apple would come up with if they had to design an AV scanner, while our real AV software looks like a piece of junk some poor Russian hacker cobbled together. It's sad really; the fake AVs have Symantec beat in everything from total resource usage to looks.

Re:We've had a couple of these

[adh72]

It's sad really; the fake AVs have Symantec beat in everything from total resource usage to looks.

and the same great features as McAfee.

Re:We've had a couple of these

[Anonymous Coward]

Well, yeah. You are aware these fake AV programs are fake, right? If you don't have to actually protect the machine then you can use less resources not doing so. It is somewhat humorous that they often look much more professional than the real thing, though. Of course, when your product doesn't actually do anything and the intent is to defraud people you probably would focus most of your effort on the UI.

Re:We've had a couple of these

[hack slash]

They're like the face & fingerprint recognition software you see in movies & tv shows that display each and every face/fingerprint in its database to compare to the suspect image - looks great but completely impractical to waste CPU cycles by displaying the information it's searching through.

Re:We've had a couple of these

[phantomfive]

the fake AVs have Symantec beat in everything from total resource usage

I never thought I would defend Symantec after they got out of their compiler business and started pushing garbage, but it should be pointed out that the fake AVs aren't actually doing anything, and it is thus easy to win in total resource usage.

Re:We've had a couple of these

[IICV]

I never thought I would defend Symantec after they got out of their compiler business and started pushing garbage, but it should be pointed out that the fake AVs aren't actually doing anything, and it is thus easy to win in total resource usage.

And Symantec isn't doing anything practical either, or else this fake AV window wouldn't be showing up on my end user computers :)

Re:We've had a couple of these

[Palanthas]

It makes sense though... If you make it look better then the real thing then it MUST be better!

Re:We've had a couple of these

[Anonymous Coward]

I think that the GP's point was that "real" anti-virus programs don't actually protect the machine. They just use up CPU cycles and memory all while looking like shit.

Re:We've had a couple of these

[TheLink]

Lucky you aren't using McAfee ;).

Fake dope dealers

[oldhack]

So it's like fake dope dealers are outpacing true dope dealers.

Re:Fake dope dealers

[Anonymous Coward]

Duuuude! Your oregano is the best!

Re:Fake dope dealers

[Ohio Calvinist]

Except when fake dope dealers sell oregano to the wrong person they end up getting shot in the face. Fake AV companies just end up pissing off nerds on /. who get stuck fixing their mom's computer.

There is a difference?

[Anonymous Coward]

I know people who have two different malware scanners installed at the same time, plus a third-party firewall which also comes with malware protection. Needless to say, they're not happy with the performance of their computers.

Re:There is a special place in hell for these peop

[Low Ranked Craig]

and no lube...

They aren't all bad...

[boneclinkz]

I discovered Krusnikov's Virus No-Having 2007 over three years ago and it's been running in my system tray ever since, without issue.

Re:They aren't all bad...

[ElectricTurtle]

Someday it's going to say:

FLAGRANT SYSTEM ERROR

Computer over.

Virus = Very Yes.

Re:They aren't all bad...

[noidentity]

The really good viruses keep all the lame ones out, since they take valuable resources that could be used by the good virus.

McAfee

[LinuxIsGarbage]

Does this include McAfee? It seems to be a fake anti-virus, holding critical system files hostage.

Re:McAfee

[Anonymous Coward]

Does this include McAfee? It seems to be a fake anti-virus, holding critical system files hostage.

I was thinking norton.

Re:McAfee

[owlstead]

I've lost more data to McAfee than to malicious application ever. Of course, like most here, I'm not a prime target for these kind of scams.

Deleting backup2.zip because one file contained something malicious. I mean, if you can scan files in a zip archive, surely you can delete files from the archive?

Deleting a well known file from my Windows/system32 folder does not score very high on my list either.

Re:There is a special place in hell for these peop

[kiehlster]

And all the floppies have their write-protect switch set the wrong way and you just clipped your fingernails so you can't get your nail to catch on that stupidly annoying little slider.

Fake AV installs on piratebay!

[Anonymous Coward]

Can Some one please tell me how this installs automatically and runs on my computer just by visiting a site like the piratebay?
I know not to download/install unsafe stuff and I know not to click on pop ups and I always try to stay safe but by just visiting the piratebay on IE8 and not downloading any torrents or anything I get this fake AV.
Visiting the site on Chrome I dont get this fake AV.

Re:Fake AV installs on piratebay!

[hcmtnbiker]

Research a little bit on software security

Re:Fake AV installs on piratebay!

[assassinator42]

They simply exploit a vulnerability in your browser or plugins. I've encountered one that tries to install something using Java, presumably just requiring a user to click OK to infect them. That's something that seems like it could be done accidentally. I wouldn't be surprised if it were trying to exploit some vulnerability that would auto-install the malware on older versions of Java. They probably use exploits in Flash as well. The plugins have the advantage of not being run in the IE sandbox that's used by default on Vista/7.

Re:Fake AV installs on piratebay!

[RulerOf]

I got hit by that myself. To date, the only virus I've ever gotten.

I went to change window focus by clicking on what I had thought was some white space in an article that I was reading, but realized it would normally be an ad spot. Another browser window opened (with the annoying OnClose warning) and I closed it. I noticed that Java loaded, and then a few minutes later Security Center lets me know my AV is turned off and all hell starts breaking loose.

Process Explorer and a few hours later I was back to normal (protip: malware "watcher" processes usually aren't smart enough to realize when they've been suspended. Comes in handy.)

The app must have exploited some Java vulnerability, but at this point I'm not really sure what one. It used the AT command to get what it wanted in terms of privileges and so on, and went to town on my local security policy.

In the end, I was a little pissed at myself, as I try to keep software updated to avoid vulnerabilities like that, but alas I finally got hit by one. Made me feel a little more capable of believing the [usually bullshit] story of "I was just using it when all of a sudden these things started popping up!"

Fun fact: I was browsing with Chrome.

Re:Fake AV installs on piratebay!

[Anonymous Coward]

I know a few people that have experienced problems with Chrome. What updates vunerabilities does it have?

I read on slashdot there were issue with the Java web start but when I try and investigate my AV (avast) blocks the page from loading. I think this has been present since 2008, but has not been addressed by Sun or Oracle.

Re:Fake AV installs on piratebay!

[Anonymous Coward]

Fun fact: Your the one who did the clicking, not the browser.

Re:Fake AV installs on piratebay!

[imerso]

... And you were probably running Chrome with an user that had ADMIN privileges.

Re:Fake AV installs on piratebay!

[RulerOf]

... And you were probably running Chrome with an user that had ADMIN privileges.

Duh. I run as admin on my local desktop because I do way too many admin-level procedures to bother with RunAs every other minute. Further, I'd use UAC but quite frankly I think that for true administration it doesn't work right. For example, UAC demands elevation just to run MMC or RegEdit, irrespective of whether or not you want to perform tasks that don't need admin privileges. I shouldn't be prompted to elevate if all I want to do is edit HKCU.

As for security, being smart absent software vulnerabilities is generally enough in a home setting, which this was. I'm not getting paid to admin and harden my home machine; I just want to use the fuckin' thing.

Re:Fake AV installs on piratebay!

[Nesman64]

(protip: malware "watcher" processes usually aren't smart enough to realize when they've been suspended. Comes in handy.)

But who watches the watchers?

Impending doom... right on schedule

[ka9dgx]

We keep ignoring the lessons the past by using discretionary access controls instead of capability based security at our own peril. The users have no way of telling what the side effects of a program are going to be, nor do we have any way of limiting them. This is a spiral downward that will eventually force everyone to learn about capabilities and cabsec.

Re:Impending doom... right on schedule

[mlts]

As a company gets bigger, it becomes harder and harder to ensure that people are educated and don't run crapware. The only real alternative is to lock things down and pull admin rights for most users. This way, should something stupid happen, it would require another security vulnerability to escalate to root/administrator, rather than just handing the keys to the city to any malware that infects a user. Plus, it is easier for A/V software to clean up an infected user profile than a rootkitted machine.

In some cases, it might be even effective to use software like DeepFreeze on machines which are used often (call center PCs used for shifts, PCs used in educational settings, hotel PCs for business travelers, etc.) This way, if a user does install something malicious, a reboot (which can be also scheduled or forced between shifts) will take care of the damage, unless the malware is sophisticated enough to nail the low level driver and disable it.

Re:Impending doom... right on schedule

[Skuld-Chan]

Not really - we'll keep doing what we've always done. Triage and patch systems until they are working again.

Oblig...

[kiehlster]

xkcd #694 or #350.

Even easier than that.

[khasim]

The "scan" window pops up and tells them that they've been infected BUT IT IS OKAY because all they have to do is click here and the nice software from the friendly company will remove the nasty viruses for them.

Yay!!!

This is just a side effect of the "real" anti-virus/security businesses having no interest in reducing/mitigating the "virus" threat. It makes too much money for them.

Re:Even easier than that.

[Apathist]

This is just a side effect of the "real" anti-virus/security businesses having no interest in reducing/mitigating the "virus" threat. It makes too much money for them.

Said with all the arrogance and presumption of someone who knows exactly nothing of what they speak. Speaking as someone who spent over a decade as an anti-virus researcher and anti-virus engine developer, the truth is that it is infeasible for AV companies to keep up with the flood of (generated) malware that engulfs modern PCs... and, believe me, it's not for lack of trying. Have you ever seen how aggressively they complete over the VB100%* award?

* That award, like most AV testing is a sham (testing against a very small yet widely known sample of existing malware), but the point still holds: they really do want to catch the malware, if for no other reason than that the company that has the best detection rates can make the most sales.

Three Findings

[idiotnot]

1. Education that Windows users need AV software has been overwhelmingly successful.
2. People are too cheap to go buy a boxed copy, and like in-your-face downloads (many ISPs offer AV, but you have to go hunt for it)
3. Internet Explorer and Windows are still terminally broken out-of-the-box.

Re:Three Findings

[yuna49]

Concerning #3, most of these exploits use Javascript to open a phony "scanning" window. I got one of these while reading the New York Times on my Linux machine using Firefox.

Re:Three Findings

[TheP4st]

3. Internet Explorer and Windows are still terminally broken out-of-the-box.

Having cleaned Antivirus 2010/2009/2008 and more of the same ilk from countless XP machines running IE6 with no admin rights for the user I could not agree more. Yep, the majority of the users where I work do not have any admin rights yet these scam AV's cause me more annoyance than I can describe in words, an annoyance exponentially increased by the fact that the none of the tools I have at hand by the company are capable of dealing with them, leaving me to manually having to deal with the infection. I do have to say the latest iterations of this crap have really evolved in regards of making manual removal increasingly difficult, start task manager just to watch it choke and die a fraction of a second later, run a portable version of Ccleaner (non-approved), no luck it is reported as malware (by the real malware) and killed, msconfig nope that'l get killed too.

Re:Three Findings

[Anonymous Coward]

No, you didn't. These run as processes under windows and survive a reboot. They are malicious processes running on the OSl

Re:Three Findings

[Rick17JJ]

On several occasions, I have also encountered those fake anti-virus scanners while using Linux. In each case, a pop-up or webpage claimed that they had detected that my computer was infested with viruses and spyware.

In each case, the advertisement offered to do a free scan on my hard drive. Despite trying to say no or close the tab, it started to pretend to scan my drive C with a progress bar showing the progress. About a minute later, it had finished and announced that it had found several viruses and also spyware in my registry and on my drive C.

Linux does not have a registry and does not label partitions by drive letters, so what it was saying way clearly bogus. Their fake anti-virus program had not even noticed that I was not using a Windows computer. I later looked up the names of the viruses they mentioned elsewhere on the Internet and discovered that those were Windows only viruses.

It then recommended that I purchase their anti-virus problem to fix the problems. They did not mention having a Linux version of their program.

When I decided not to purchase their product, it tried to download a Windows type executable file to my computer anyway. Firefox then asked me which program should be used to open the file or where I wanted to save the file. It was a file that ended with the .exe extension, so it clearly was a Windows only program. I rejected the attempt to download their program. Needless to say, I did not want to see if their Windows only anti-virus program could be made to run under WINE.

After that last encounter with the fake anti-virus program, I started using the NoScript Add-on for Firefox. I now do that on both my Linux computer and my Windows computer. I now only enable scripting when it seems to be necessary for using websites that I trust. For most other websites, I keep scripting off by default.

Re:Three Findings

[Anonymous Coward]

If you are running no admin rights and you're still having issues, you might want to locking down IE itself. I've created a set of registry files that are based off the FDCC that strip alot of IE7 features (Most of these keys work in IE6, if IE6 doesn't understand the key, it ignores it). Be aware that these settings do break some sites, and you'll need to test them for your environment.

Anyway you can get the settings from here

Re:Three Findings

[swb]

I've found that the majority of fake AV programs I've run across are fairly easy to remove -- boot the system in safe mode and login as a different user and you can generally run something like Sysinternals Autoruns and delete all the startup hooks and the programs they point to. Afterwards I've found that a scan by Malwarebytes and a quick check of the infected user's personal "Startup" folder in their profile is enough to ensure the stuff is deleted.

A couple will bluescreen the machine if it is booted in safe mode, and these I just wipe and start over. But that's been a very small number.

What drives me batshit is like you, I've seen this end up on many machines not running admin, fully patched (at least MS-wise) and running good AV (different versions, too).

The users in question are also not the kind to visit BS sites or the kind to click on anything to get to porn or social networking bullshit.

I suspect banner ads exploiting third-party apps personally, but its been kind of a mystery.

Re:Three Findings

[Falconhell]

A useful trick when task manager will not work, copy the task manager .exe from a nother machine and rename it any other name.

It will then run and allow you in to start cleaning up the crap.

annoying

[Anonymous Coward]

My dad actually fell for it and bought one of these for $50! He has AVG on the computer and that is all he needs, but he freaked out and did this before asking me first.
That was $50 lost that he'll never see again.....as we as the credit card that was canceled.
I use Linux - the family never listens to me.

We have these all over the school I work for

[dawgs72]

I work at a fairly small university, and at least once a week we have a faculty member's PC get infected by a fake AV. The most recent the professor had paid for the "full" version, then a week later e-mailed the "company" because he was unsatisfied with the AV and couldn't uninstall it. The company then e-mailed him with a link for a program to uninstall the fake AV, which of course didn't work, and then he decided to call us; still not realizing that the AV was fake.

EXCUSE ME SIR!

[ElectricTurtle]

Pardon me, sir, but I would be remiss if I didn't inform you that you have clearly contracted a rare disease that will kill you painfully in short order UNLESS you pay me to inject this substance into you. You can trust me, I'm a doctor.

....

Why is it that virtually nobody would fall for that in meatspace, but innumerable people fall for it online? It's just like the 419 scams. What is it about THE INTARWEBS that makes people exponentially more gullible than they would be to a random person on the street?

Re:EXCUSE ME SIR!

[0100010001010011]

Pardon me sir, but this herb root extract can lower your blood pressure. Meaning that you can live a long and healthy life. It's not FDA approved but it's certified by these doctors.

It works just as well in meat space too.

Re:EXCUSE ME SIR!

[natehoy]

it's certified by these doctors.

grep/doctors/celebrities/

Re:EXCUSE ME SIR!

[pscottdv]

Why is it that virtually nobody would fall for that in meatspace, but innumerable people fall for it online?

Because it is not some stranger telling them they need it, it's their own, beloved computer!

Re:EXCUSE ME SIR!

[tibman]

I've noticed something similar about words in print. If someone reads something in a book, it is taken as fact.. why else would it be in a book? When i was younger, Michael Chrichton books did that to me. Now i see it happening to other people.

Maybe as humans we are too trusting of our tools?

Re:EXCUSE ME SIR!

[Machtyn]

Because many people believe what they read and watch on TV, too.

I Hope for Change! (umm, what kind of change was that again, exactly?)
This is the greatest nation on earth. Help me change it!

Re:EXCUSE ME SIR!

[ElectricTurtle]

This is what we get for portraying viruses in movies as LSD-trip-colored renditions of Leonardo da Vinci's Vitruvian Man spouting villainistic drivel. Too bad pop-up windows saying "Click here!" with flashing yellow warning icons just don't seem to connect with movie-goers the same way.

Re:EXCUSE ME SIR!

[fuzzyfuzzyfungus]

Apparently you aren't familiar with how the "alternative" (sometimes "complementary" or "holistic") medical industry operates...

Re:EXCUSE ME SIR!

[Anonymous Coward]

Who says they don't. Did you get your swine flu shot?

and after my rounds this past week.....

[Lumpy]

I have informed everyone I do family and friends tech support for... they must either switch to linux or a Mac with OSX. the new internet security 2010 is an evil bastard that even kills the safe mode so you have to use a Bart PE to run combifix first and then reinstall AV and run a clean.

Screw it, I'm done. Mac mini's are as cheap as a dirt cheap dell PC. and I'll install linux for them. I am done with windows support.

Re:and after my rounds this past week.....

[tepples]

I have informed everyone I do family and friends tech support for... they must either switch to linux or a Mac with OSX.

Then how do they play PC games afterward?

Mac mini's are as cheap as a dirt cheap dell PC.

I just went to apple.com and dell.com; what I found disagrees with you. Mac mini: $599. Dell Inspiron 560s with Pentium dual core and 4 GB RAM: $429.

and I'll install linux for them.

Does this include installing and configuring Wine for "that one must-have app"?

Re:and after my rounds this past week.....

[Machtyn]

Yeah, the AV2010 thing is extremely nasti. I've recovered 4 of these in one week-end. Fortunately, none of them required a complete reinstall of the OS. And then I had one hit by the MS update BSOD issue. I actually told them to leave their computer off, waited a couple of weeks for combofix to catch up and then fixed it.

Re:and after my rounds this past week.....

[fuzzyfuzzyfungus]

I'm with you on being done with supporting home users of Windows; but minis start at $700, with 2GB of RAM and no monitor. Dell will furnish you with a (big, ugly) box with triple the RAM, a 1TB HDD(rather than 160GB), and a 20 inch flat panel for the same money...(getting a 2.8GHz Phenom X4 instead of a 2.3GHz Core2 duo is just icing).

The mini is cuter, certainly, and if you have to have OSX you have to have OSX; but the pricing is hardly equivalent for anybody willing to run linux or shove their computer under their desk.

Re:and after my rounds this past week.....

[Anonymous Coward]

Then how do they play PC games afterward?
Does this include installing and configuring Wine for "that one must-have app"?

VMWare still has a free downloadable version of its VMWare Player which, IMHO, is much easier to configure than Wine and allows you to play at least as many games.

Re:and after my rounds this past week.....

[tepples]

VMWare Player still needs a copy of Windows for the emulated machine, operating system updates for the emulated machine, and antivirus for the emulated machine.

Re:and after my rounds this past week.....

[Mashiki]

You could simply switch them to a LUA, and solve all your problems right there.

Re:and after my rounds this past week.....

[Anonymous Coward]

Other than the programming language, what is LUA? Linux User Agreement?

Re:and after my rounds this past week.....

[Lumpy]

Yes because all of them dont play games they buy. they go online, do "word" and use facebook. all work perfectly under linux and OSX.

It's a fantasy world that most people go to best buy and buy the latest game for their PC or do advanced things at home with software. They dont. Most people use the pc as it is given to them for going online. Of the people I support only 4 of them buy software and use it on their PC. the rest use whatever junk was on that computer when they bought it from dell/HP/acer. This is what most people out there do.

And big Wah, it's my time and my life, I get to be king and hand down the law. They get no free Tech support from me for windows, they can either pay the highly experienced professionals at best buy to lose all their photos links and documents and charge them $280.00 or more cleaning up their pc or play by my rules. it's their choice. oh and that must have is usually an app that is already on linux.

    Picasa for uncle barry the photographer? Look on linux.

Linux is free for them on their current PC. I am giving them a free or buy this option to keep free tech support. That's incredibly generous.

Re:and after my rounds this past week.....

[Lumpy]

store.apple.com has them for $599.00 and you can score certified rebuilds off and on for $499 or less from the apple store.

Use your old monitor, everything is golden. As for Phenom versus Core2 duo.. none of them would notice a difference. in fact 5 of them would see it as the fastest computer in the world compared to what they have now.

Re:and after my rounds this past week.....

[speedlaw]

For the average websurfer, word processor and spreadsheet person, the time not wasted in driver conflicts and other run of the mill stupidities of Windows is more than covered by the slightly higher price of Apple. Apple is not perfect, but I don't have to run a bunch of utilities like CrapCleaner and Antispyware stuff to keep it going. New program installs don't automatically put themselves into the startup folder. etc. etc.. etc.... Time is money, and the time you spend getting a machine back to "normal" is time you don't get back. I've lost days of my life with routers and keeping cheap-ass PC s running. A two year old Apple with a family banging away at it has had no significant issues. An XP box in the same situation was a hobby to keep "up". It was a hobby I didn't need.

Re:and after my rounds this past week.....

[Mashiki]

Limited User Account aka LUA

Re:and after my rounds this past week.....

[Arrow^]

I have informed everyone I do family and friends tech support for... they must either switch to linux or a Mac with OSX. the new internet security 2010 is an evil bastard that even kills the safe mode so you have to use a Bart PE to run combifix first and then reinstall AV and run a clean.

Screw it, I'm done. Mac mini's are as cheap as a dirt cheap dell PC. and I'll install linux for them. I am done with windows support.

I've been doing this for a living for awhile now. As far as I can tell..when the FakeAV disables SafeMode you usually get to Directory Services Repair Mode and get Combofix started from there. After that I tend to run Malwarebytes as well because it checks and fixes registry keys that this s*$t tends to mess with like turning off Task Manager. If it's real bad I toss in a Ubuntu disk and sort /system32 and /system32/drivers by date.Sometimes a quick registry key swap from a system restore point gets the system back if it's be badly hosed. But is is a pain.

We got hit - XP Security

[swm]

My wife's machine got hit last week.
No idea where it came from.
Been running for years with no problem.
(NetGear router seems to keep the baddies out.)

All of a sudden there's a dozen dialogs flashing dire warnings about viruses and trojans and keyloggers and malware and insisting that we "register" our copy of XP security.

Pulled the network cable and started googling (from a linux box).
The thing is pretty nasty.
It scatters pieces of itself around the file system with random names.
Then it hooks the .exe registry keys so that it gets control each time any program is run, and takes the opportunity to spawn a new copy of itself, with new dialog boxes and systray icons.

After you delete the program files, nothing runs at all, because the .exe keys are still trying to redirect through the files you just deleted.
(Hint: right click -> run as).
Then I fixed all the .exe (and related) keys by hand.
There's quite a lot of them, because it is really important for each user on a windows box to have their own semantics for running a program.
(Removal instructions on the web don't generally find them all.)

Finally (should have done this long ago) created an admin account and knocked all the user accounts down to user privilege level.

Re:We got hit - XP Security

[Anonymous Coward]

My wife's machine got hit last week.
No idea where it came from.

Methinks I see a coincidence ;)

Re:We got hit - XP Security

[Glarimore]

I've had this same program find its way onto my machine at home, but I didn't have near the trouble removing it that you did. You should really do some research before you try to manually remove things, because someone else has had it before and it will save you a real headache to learn from someone else's experiences.

The problem is this particular piece of malware makes changes to your registry, like you mentioned. So, the first thing you have to do make a couple registry modifications. Then you'll have to find some type of dependable malware cleaner to remove all of the related files. This all very simply outlined here. All I did was Google "XP Security fix." Didn't seem so bad to me (MSBlast was SOOO much worse), but I can see where it would be a real pain for the inexperienced or naive user.

Re:We got hit - XP Security

[Anonymous Coward]

There has to be an easier way to remove it. I cannot find all the randomly named files, not even with a date modified search of the drive. And the registry entries that sites have directed me to do not exist, yet this thing is pervasive in my neighbors PC. How the heck does Symantec not have a fix? Am I going to have to wipe the PC. This has happened to two of neighbors in the past month, and wiped them both once. I don't wont to have to do it again. Is there a downloadable fix? it is "antivirus XP" maybe "antivirus XP 2010"

Re:We got hit - XP Security

[Anonymous Coward]

try rkill. If you can, I suggest getting a copy of Chrome on the infected PC. Seems to have much better luck downloading tools required for removal.
There is also a reg file out there that defaults the exefile key and many sub keys to "factory state" so you can run programs before the bug intercepts the call.
These things usually run in a very fast cycle when you terminate their process. You can actually watch it/see it if you play long enough. In-between this cycle fire off rkill. presto. clean with favorite cleaner.
This doesn't work every time but quite often in on remote systems.

Re:We got hit - XP Security

[Anonymous Coward]

BleepingComputer's ComboFix program is awesome for these sorts of scareware progs. Easy to use, just needs someone present to approve a couple dialogs before it gets to the 50+ step cleaner.

Re:We got hit - XP Security

[Anonymous Coward]

Try fixing a windows xp box that got infected with a virus that adds itself onto critical windows files, such as svchost.exe. Good luck removing or deleting that! The virus even showed up in safe mode.

Re:We got hit - XP Security

[El_Oscuro]

I got something about 10 years ago which did a similar trick with the .EXE hooks. To get around it, I renamed regedit.exe to regedit.com and then nuked it from orbit. They probably know about the .com trick these days, in which case your friend is a live CD or BartPE.

Re:We got hit - XP Security

[zippthorne]

Frankly, if you've set things up correctly, it should be a lot less effort to just wipe and re-image, and you're guaranteed as pristine an install as is possible from the media you have on hand.

Re:We got hit - XP Security

[Shadwhawk]

I've cleaned this particular virus type off several machines in the past couple months. They haven't caught on to .com files yet. They always hijack the exefile registry key, and sometimes specific executables like iexplore.exe. The worst ones hijack keys in Winlogon. They usually use this bit or even a driver to prevent removal tools from running--malwarebytes, combofix, hijackthis, spybot, adaware... The dumb ones just use filename checks, so you can rename mbam.exe to explorer.exe and run it or regedit.exe to regedit.com. The smart ones use some other method and will recognize the file you're trying to slip by them. By that point, a LiveCD is basically required.

license

[Anonymous Coward]

I still think there should be a course given for a Internet License. This way if you dont base your not aloud to go on the internet. Well atleast in large corperations/government facilitys. cough cough (where i am). These people just can't stop clicking on stuff. They never read just click

Re:license

[gyrogeerloose]

I still think there should be a course given for a Internet License. This way if you dont base your not aloud to go on the internet. Well atleast in large corperations/government facilitys. cough cough (where i am). These people just can't stop clicking on stuff. They never read just click

Such poor spelling, punctuation and grammar skills and you're working in a government facility? Man, I can only hope it's not my government you're working for.

Re:license

[tibman]

Give this place a shot man: http://www.onguardonline.gov/

We use http://iase.disa.mil/eta/index.html#onlinetraining and have to maintain the certs yearly.

Re:license

[knarfling]

A spelling or grammar course might also be advised.

I still think there should be a course given for an Internet License. This way if you don't base(pass?), you're not allowed to go on the internet. Well, at least in large corporations/government facilities.

What really scares me is that this might really reflect the "upper crust" of today's government employee.

Informed

[Anonymous Coward]

Hey I was just informed by Mr Naroob Jahoni (son of the former finance minister to Nigeria who was tragically killed in a car crash) that he has 14 Million dollars is a suitcase ready to transfer to my account. Thank goodness this popup came up and let me know there are TONS of viruses which are now being cleaned, totally free, by this awesome company. I would hate for anything to interrupt my communications with Mr Jahoni as he said I could have a rather large commission upon my submission

Re:Informed

[gyrogeerloose]

I'm sorry to tell you this, but you've been duped. Mr. Jahoni has already agreed to transfer that money to my account.

Re:There is a special place in hell for these peop

[gyrogeerloose]

and they're on fire.

Complete Fakes

[nexttech]

I always find it funny when I get a popup from my browser on Linux asking if I would like a anti-virus scan. Sometimes it will show me how my C: drive is corrupted and would I like to pay for a version of their anti virus software. One of these even offered to replace my system32.dll . This just shows how fake these scans really are

Re:Complete Fakes

[Cro Magnon]

Are you sure it's a fake? Maybe you really don't have a working system32.dll on your Linux system. You need to replace it ASAP!

Re:Complete Fakes

[Anonymous Coward]

Linux. It's like a condom for browsing porn.

White List Anyone?

[whitedsepdivine]

Instead of listing all the bad programs, why don't they list all the good programs? If a virus has a lifespan of a few hours, the only way to prevent it other than figuring out how they are changing, is to white list all the good programs.

Re:White List Anyone?

[fuzzyfuzzyfungus]

Who, exactly, is "they"?

Architecturally, whitelisting is a great solution. In closed environments with fairly static requirements(eg. corporate) you can do it Right Now, if you want. And, while it won't save you from truly subtle attacks on the kernel or services, it blocks a fair percentage of common stuff good and hard.

The trouble begins when you try to implement it in the real world. Being the "they" who gets to bless all good programs is both a gigantic pain in the ass(requiring a massive staff of analysts and sophisticated techniques to keep up with the stream of software being produced, not to mention the problem of in-house and bespoke/private stuff) and a truly ghastly temptation, with which no entity can easily be trusted. He who gets to bless "good" software is the gatekeeper, a position of incredible market power, from which most any agenda(financial, political, aesthetic, or moral) may easily be advanced.

Software whitelisting is to computer security what dictatorship is to governance. In principle, if you could find a benevolent and wise dictator, it'd beat the hell out of the chaos and inefficiency of other institutions. Obtaining such, though, is a bit of a trick.

Re:White List Anyone?

[dwinks616]

Perhaps you should try "Anti-Executable" by the same company that makes Deep-freeze and other security software, Faronics. Here's a link to it: http://www.faronics.com/en/Products/AntiExecutable/AntiExecutableCorporate.aspx It's not automatic though, I think you have to actually set up the list of programs that are allowed to run. Also note that a lot of stuff uses one .exe to spawn other .exe files, so you can't just whitelist the .exes linked to in your application shortcuts.

Or Microsoft

[Sycraft-fu]

They have a free scanner now. It's not the best AV, but it's good and no cost. I also recommend it because it is something users will trust. I mean after all, you pretty much have to trust your OS company, they could own your computer through any number of ways, they wouldn't need to use an AV program.

Doctors and celebrities

[tepples]

Doctors, celebrities, what's the difference in the consumer's mind? Case 1: Dr. Dre. Case 2: "Of course Hugh Laurie is a doctor. He plays one on House M.D." Case 3: People with a doctorate in something other than medicine or osteopathy.

Re:Doctors and celebrities

[natehoy]

Many people will trust the word of a paid celebrity endorsement from a golfer or football player over the advice of their practicing physician, or an actor even if the actor does not play Dr. House.

But, yeah, you could grep in "crystal healer", "energy medicine practitioner", or any one of a bunch of titles in place of either "doctor" or "celebrity".

This isn't anything new. I could have replaced "Dr. House" with "Quincy M.E." 20 years ago. 100 years before that, it would be some guy coming in with a few actors he mysteriously "heals" with his mystical elixir. 2000 years before that, it was enough to just claim to be the son of a mythical being.

We don't change, we just update the lingo.

Re:Doctors and celebrities

[Anonymous Coward]

Don't forget the Doctor of Journalism

Re:Doctors and celebrities

[zippthorne]

M.E.??

You're telling me people would take medical advice from a fake coroner??

I believe it, I just don't believe it!

complete wow

[joselita]

its not fair and i think you re really mean!

Real antivirus programs

[Anonymous Coward]

like Mcaffee are so much more reliable aren't they...

Re:There is a special place in hell for these peop

[ColdWetDog]

And a desk with an old Packard Bell Pentium II and a copy of Windows ME.

getting worse

[JackSpratts]

my mom's pc got one of these over the holidays while a teen cousin was surfing flash game sites. the pop-ups would not go away. at boot up pages wouldn't load because the warning box insisted on a click before progressing further. anti-malware had no effect, neither system restore nor anything else i could think of was successful.

even the computer shop was at a loss. after ten days the os required re-installation with a resultant loss of all data.

don't make the mistake of thinking this is merely an issue of rubes accepting come-ons from scareware vendors. it's beyond that now. these apps are injected instantly via poisoned sites and your pc is compromised well before you "accept" any blackmail terms. we found to our dismay nothing for sophisticated users nor technicians to fix.

thanksgiving was a real eye opener for me.

i surf exclusively with adblock and noscript now. no ads. no scripts. period.

until site owners deal with this i won't do otherwise.

-js.

Re:getting worse

[BKX]

Same story here on my grandparents' PC. They got the HaxDoor virus (nasty little devil), and it made the computer randomly issue stop errors, until one day it wouldn't boot at all (more stop errors). A quick boot into Knoppix to save their pics to a portable HD, and a reinstall of XP later, and they were good to go. (In the future, remember that very few current viruses wipe or corrupt a hard drive, and it's damn near impossible to infect media files (there've been a few viruses that can do that, but all the ones I've ever heard of are detected by recent AV/Anti-Malware software). Knoppix can generally access a non-bootable HD to move things to a portable before a reinstall. Just don't copy any executables, DLL's or other such nonsense, scan with Malwarebytes and AVG or Avast and you'll be fine).

Re:getting worse

[Carrot007]

> after ten days the os required re-installation with a resultant loss of all data.

  I really do't get people's attitudes these days.

It's windows, an OS re-instrallation is always the first choice.

For one it cleans up the system with the installed and never removed or not correctly removed programs.

And why would there be data loss, programs can be re-installed and your stuff can be saved unless it has been messed with, in which case it was lost anyway.

Try the sane method of windows pc restorration.

1. boot from usb or cd and dump the contents of the drive to a handy usb drive.
2. re-install windows and update and antivirus.
3. connect usb drive with old system dump.
4. restore user data.

Spending days trying to save a install is dumb and a waste of time. Only idiots would do it. (if you have spare drives handy then you can remove the old and install it in a usb caddy and skip part 1 and use a new drive in the machine.

Re:getting worse

[Skuld-Chan]

Loss of all data? Did the virus do that? I would have popped the drive into another PC - scanned it with a known working virus scanner and at the very least backed up the user profile.

Re:getting worse

[PlusFiveTroll]

Your computer shop sucks and should be fired (never returned to) for being incompetent. Boot a BartPE disk, backup all the user data, clean all the temp file locations. Remove any infections from the user profile, system directory, and program files. Reboot and run Combofix. Take about 2 hours on a badly infected machine.

A license isn't going to help

[gyrogeerloose]

I'm not convinced that licensing will help. Some people are just ripe for manipulation by marketing and scams.

Take some of my fellow amateur radio operators, for instance. These are supposed to be a bunch of hard-core techies who have to pass a test and be licensed before they can go on the air, yet a whole lot of them will pay out good bucks for fancy-looking antennas that are advertised to have a flat 1:1 SWR across the entirety of the amateur radio bands in a unit the size of a breadbox with "no lossy traps." Yeah, right, ain't gonna happen, the laws of physics prevents it and the small amount of antenna knowledge required to refute these ridiculous claims is on the test the ham had to pass to get his ticket. Still, a lot of them still fall prey to magical thinking.

I now tell people not to use anti-virus

[w0mprat]

Something like clamwin is sufficient for the periodic scan (infact ClamAV it's based on is rather good). Not clicking on dancing bunnies eliminates the need for on-access scanning.

Re:I now tell people not to use anti-virus

[v1]

Not clicking on dancing bunnies

But we can still click on the dancing puppies, right?

From the trenches...

[joetomato]

I'm a keyboard monkey at a three-man retail computer / repair shop. In the last week, literally every PC that's came in to get cleaned up has had a copy of "Security Tool" installed. The fix is quite easy - download process explorer, rename it to iexplore.exe, run it, kill 08732030.exe (Or whatever random number it's used this time), then install & Scan with Malwarebytes Anti-Malware, and a couple others. But it's obscure enough that nobody can do it, so we can charge our standard 1 hour to clean it up. I wish I could meet the guys who wrote this and buy them a drink. They've been paying my cheque for about 6 months now.

Ummm, okay.

[khasim]

Speaking as someone who spent over a decade as an anti-virus researcher and anti-virus engine developer, the truth is that it is infeasible for AV companies to keep up with the flood of (generated) malware that engulfs modern PCs... and, believe me, it's not for lack of trying.

Why spend 10 years trying to identify all the "bad" code when it should be far easier to identify the apps that you want to allow to run on your machine?

http://www.mcafee.com/us/about/corporate/mcafee_Solidcore.html

Re:Ummm, okay.

[jazman_777]

Because on Windows, it's hard to tell the difference?

PDF? Um, hello

[TrancePhreak]

Story about malware links to PDF? Nothx.jpg!

How are they getting PAID???

[Marrow]

They must want money at some point right? How are they expecting to get paid and why can't the cops at
least freeze their visa account?

The same with the online pharmacies.

Do I have to solve everything for you?

[CorporateSuit]

I use Linux - the family never listens to me.

Well, then stop using Linux!

is it so hard to look for "av.exe"?

[v1]

99%+ of scareware is from the same exact kit, and installs the same core exe program, (AV.EXE) in one of three fixed locations. (as super-hidden) This article itself is scareware. The av companies can detect every one of these every time they pop up, there's no "trying to keep up" with this. That's what happens when malware goes commercial as this has. Anyone happen to know offhand who's the source of this malware kit? (url?) I'd be curious to know how much such a kit sells for. Must be cheap if there's 1400 new customers a day.

Give us the meaningful number of unique, new scareware products a day. Or a week or a month. Betting somewhere under 10/month. And if they can't keep up with that, waaaaaah.

Re:is it so hard to look for "av.exe"?

[Slashcrap]

The av companies can detect every one of these every time they pop up, there's no "trying to keep up" with this.

LOL, you actually said this. Sorry for any reputation you may have built up - this comment's staying here for all eternitity. You may as well give up now. You've blown it, sorry.

The ads/targetting need scripts

[phorm]

I previously worked in a company that ran mostly on ad revenue. Ads are a lot more complicated than "show user a picture and/or text, wait for him to click and buy."

Most of them do things like:

a) Track impressions: How many times a given ad is shown. Advertisors pay for a given number in a given period of time

b) Tracks clicks (of course), and track which impressions lead to clicks which lead to sales

c) Note the general location of the user. Some ads only target users of a certain region. It doesn't make much sense to advertise a product only available in the US to some dude in Australia. Advertisers also want to know what areas are more or less interested in their product

d) Lots, lots more

Now if a company is dealing with third-party adservers, many issues come up when you run into certain unsavory types. Where I previously worked, we were quick to track them down and cut off that advertiser. Often enough it was an advertiser who in turn carried ads for another network (and so on) until somewhere along the line somebody slipped a bad one in. Just as often ads were blamed when it was actually a user with an infected computer (and the virus was showing ITS ads) or somebody had slipped in a naughty link somewhere with some script that got past validation.

And how would NYT track the content of a third-party. The third-party is being used specifically because they know more about handling ads than NYT, and they control what goes out?

Obligatory

[Capt.DrumkenBum]

Take off and nuke it from orbit... It's the only way to be sure.

In All Seriousness....

[pandrijeczko]

...if you're a Windows user who never has the intention of being a Linux user, at least take some good advice from we Linux users:

1. Don't use any Internet applications that embed themselves too deeply within the OS - this means *DEFINITELY* avoiding Internet Explorer and getting rid of Outlook where possible.

2. Stop using your PC with full admin rights - create a restricted user account for normal day-to-day stuff like surfing the Internet. If you don't have the permission to make big changes to Windows then just about anything you run shouldn't be able to either.

3. Use Firefox and install the "NoScript" addon - fairly self-explanatory but at least you can limit Javascript to only the sites you trust.

Re:In All Seriousness....

[TrancePhreak]

4. Uninstall Firefox if you're using Vista/7 as it's actually more dangerous.

Common sense.

[svtdragon]

People lose all common sense when they're dealing with something they think they're incapable of understanding.

It's not true, by and large, that people would be incapable of understanding if they sat down to take the time to figure it out, but in the cases of such an unequal informational playing field (you and your doctor, you and your mechanic, grandma and her computer tech) people are paying not just for service but for expertise, and that makes them vulnerable to this kind of exploitation.

My wife got the AV 2010 virus

[Radical Moderate]

a few months ago. Did some googling but nothing really seemed to kill it. Fortunately it only infected her profile, so I just backed up her data and created a new account for her, and congratulated myself for not giving her admin rights.

Windows users run with admin privileges

[imerso]

This is the main problem we see under Windows: the users like to run with ADMIN privileges all the time. Unix users (which obviously include Linux users) are educated enough to run as ROOT only when needed, and that counts a lot to the overall security. People need to help the system to be secure, not running as ADMIN to browse the internet. And... stop downloading everything they find "for free".

"My Computer is the Most Secure Here"

[Anonymous Coward]

When I first got a my job where I work right now (how's that for vague), I performed a desktop and laptop fleet software audit among other things to find out the state of things. One particular user was exceptionally proud of how they had managed their system (long and another story why they allowed admin access locally for users). They proclaimed "my computer is the most secure here!". I asked them why they though that, and they made a point of telling me they were running 23 different anti-virus programs. So, aghast, I take a look. It was 23 different rogue AVs. They'd given their company Amex number when "registering" the software and a further audit of records showed over $3000 in unauthorized transactions had been made against the card.

But, wait, it gets better. I, for the sheer morbid curiosity, decide to do the rkill + MBAM route, and MBAM finds 26 THOUSAND infected registry keys/files on the system. We wiped and reinstalled, and returned the system to the user. They complained to management that they didn't have enough protection, they could tell because their system booted "too fast", that they hardly even had time to grab coffee.

"Never attribute to malice that which can be attributed to ignorance." -Some dude

I have to disagree

[pastafazou]

I deal with this stuff on a daily basis. I had a customer just the other day go home with a clean machine, with the latest version of Avira, AntiMalwarebytes, and SuperAntiSpyware installed and updated. All windows patches and updates installed. He was back two hours later. Surfing the web looking for UFC videos. Google served up a paid ad at the top of his search with his search terms. Of course he clicked it, and a with a bit of Adobe Flash magic, he had the Security Tools infection installed and his Avira broken.

Re:I have to disagree

[Anonymous Coward]

Ouch! Shoulda used firefox with Flash Block too! Am I going to get sued for mentioning Flash Block? You won't click on what you don't know is there... or well maybe he would have anyway.

Re:I have to disagree

[Anonymous Coward]

+1

At first i was with hairyfeet, thinking poorly maintained, badly run PCs that were to blame, but after seeing a hundred or so of these in the past couple of months, it simply isn't the case - i've had to make several visits to family and friends whose machines I setup myself, and they also got infected with "protected" PCs.

Oh and pastafazou - make sure you check for rootkits, cos I'm starting to get repeat offenders and there are rootkits on some machines - joy!

Re:I have to disagree

[AmiMoJo]

Thanks to the EU browser ballot we now install Chrome on users PCs after a repair and tell them to use that. Cut the return rate drastically.

Re:I have to disagree

[pastafazou]

yes, I see the rootkits quite often too now. And a new one I dealt with yesterday had a proxy configured to redirect any attempts to connect to google to a fake google site which would then serve up a bunch of fake links that lead to reinfection.

Re:I have to disagree

[Creepy]

sounds like all of them lately.

Antivirus 2010 is notorious for proxying or injecting into legitimate google results, and for a while it was using the "google proxy" which is a URL that used english-to-english translation (which is blocked by google now) - the last time I saw it it still was using google and I believe injecting results (it definitely didn't send me to another URL and directly entering the IP still got fake results, but it could have remapped the search). In the old days, proxy redirects were dumped into the /etc/hosts file (for Windows, usually Windows/System32/drivers/etc/hosts) but newer viruses usually store them in the registry or grab them from a compromised site.

Windows needs a positive file

[Animats]

The problem with anti-virus programs is that they're still "negative file" systems, using blacklists. We now need systems where nothing executable gets downloaded until some respectable services have checked it and determined that it's not hostile.

Anti-virus programs ought to work that way. If you try to download something, it goes into quarantine until the remote checking system has run it in a virtual machine for a while to see what it does, or its hash exactly matches previously approved software.

Re:Windows needs a positive file

[Anonymous Coward]

Anti-virus programs ought to work that way. If you try to download something, it goes into quarantine until the remote checking system has run it in a virtual machine for a while to see what it does

Sleep(A_WHILE + 1);
DoEvilStuff();

or its hash exactly matches previously approved software.

There is no organization in the world I would trust with the power to dictate what one can and can't run on one's computer, and frankly the very idea smacks of totalitarianism.

What we need are better-designed OSes that don't make it so damn easy for malware. It's ridiculous that, for example, on Windows, the typical program can't be used until you run its installer, which always requires Administrator privileges. The program may just be as minor a thing as a screensaver, but you're not running it until you give it permission to do absolutely anything, up to and including changing your BIOS.

Re:Windows needs a positive file

[schmiddy]

Check out "bit9" if you're interested in application whitelisting. Haven't used them myself, so I can't vouch for them, but seems like a good idea.

I come across these a lot at work...

[Anonymous Coward]

As a technician, I come across a lot these almost everyday since December 2009. At first, they were hard to figure out how to remove them, but eventually I figured it out.

If it weren't for these bad programs I would not know how to maneuver around Windows registry without fear of damaging something (of course I always make a clone-backup of the HDD before I mess with it).

I can effectively remove the major files these programs install all over the hard drive to the point where programs like MalwareBytes, and Avira, can effectively run and even download latest updates to remove any other infection.

I've come across a really bad one where Combofix, rkill, and all of these programs that a lot of other techs swear by simply do not work. So, I go to the registry and delete any entries that do not belong.

I've saved a lot of systems from having to be formatted/reinstalled and reconfigured.

Re:I come across these a lot at work...

[couchslug]

"I've saved a lot of systems from having to be formatted/reinstalled and reconfigured."

I don't save shit, just nuke-and-pave. Those who back up their stuff will have stuff, those who don't will learn.

Anything less is coddling. I'll do that too, but it's expensive.

iFrames and Javascript, eww

[ScottCooperDotNet]

The New York Times and Boston.com websites have been infected before. It's just a matter of time before these things become more like ransomware.

Earth to pastafazou:

[Anonymous Coward]

Clicking on a link and getting infected as a result IS an example of a drive-by infection. It doesn't matter whether it involves video and/or Flash; If viewing a web page can cause an infection then its a drive-by.

Also, your nick is misspelled.

Re:Falcondouche that is such a lame hack

[Falconhell]

Awww gee, poor widdle AC who spams is getting upset!

Oh no he even added Doche to part of my nick, my oh my how will I cope? (:

Fun fun fun on a rainy Adelaide day!

What are the lessons to learn here?

[Burz]

1. The Advertising Industry is greedily accepting money to push browser attacks on unsuspecting people.

2. They are out of control. When was the last time a website banned an ad service because of malware? Why are the suits in this product-propaganda chain so unresponsive?

3. Browsers and operating systems lack methods to reliably provide visual context cues for network objects (like web pages). Yes, the browser window is there with its untouchable bits (address bar etc), but a web page can contain an element that looks like another window.

3a. Even with that window-like appearance, they are limited to using either drive-by or trojan techniques and the user probably is already familiar with what download and run-program warning dialogs look like in the case of trojans. So we are probably not dealing so much with user naivete as with system shortcomings. For the record, most Windows techs I know periodically get malware on their own systems.

4. Cybercrime has become incredibly entrenched and resourceful.

FalconDOUCHE the "telecom tech"? NOT, lol!

[Anonymous Coward]

"I qualified as a Telecommunications tech in 1979" by FalconDOUCHE (1289630)
on Tuesday April 27, @11:42PM (#32008806)

LMAO -> http://slashdot.org/comments.pl?sid=1619750&cid=32008590 see subject above, read url, and rinse-lather-repeat, falconDOUCHE... how stupid can you be? LOL, I bet you did that MERE TECHIE job on lol, telegraphs. I mean based on your dimwit reply in the url above, where you called others names no less?? Please, falconDOUCHE - do you think ANYONE believes that which I quote of you above, after reading the URL below it? LOL, not.

Re:There is a special place in hell for these peop

[fineous fingers]

If you are still using floppies, you could always use your AARP card to move the slider....http://www.aarp.org/

Step in to "Prof. FalconDOUCHE's" email class, lol

[Anonymous Coward]

LMAO - you're right about 1 thing: I didn't HAVE to "land a blow" as you called it - YOU DID THE JOB FOR ME (lmao), read on to those reading... this is "vintage Professor 'FalconDOUCHE'" @ his finest below, lol:

"you do realise that there was no email in 1979 dont you? Oh of course being 10 you wouldnt" by Falconhell (1289630)
on Wednesday April 28, @12:35AM (#32009320)

Dimwit, there's been email systems since before ARPANET http://www.nethistory.info/History%20of%20the%20Internet/email.html ... utterly unbelievable: Here's a quote from said "HISTORY OF EMAIL":

***

Email is much older than ARPANet or the Internet. It was never invented; it evolved from very simple beginnings.

This is why Ray Tomlinson is credited with inventing email in 1972

***

LMAO, wait wait... it gets BETTER next, below (so "play it again, SAM"):

"I qualified as a Telecommunications tech in 1979" by FalconDOUCHE (1289630)
on Tuesday April 27, @11:42PM (#32008806)

LMAO -> http://slashdot.org/comments.pl?sid=1619750&cid=32008590 see subject above, read url, and rinse-lather-repeat, falconDOUCHE... how stupid can you be? LOL, I bet you did that MERE TECHIE job on lol, telegraphs.

I mean based on your dimwit reply in the url above, where you messed up on the fact that hotmail does give away your IP address, and where YOU called others names no less?? LMAO!

(Man - Please, falconDOUCHE - do you think ANYONE believes that which I quote of you above, after reading the URL below it? LOL, not! LMAO... you can't even get email right (see url to anyone reading, lol), so you're far from a "telecom tech").

Re:Step in to "Prof. FalconDOUCHE's" email class,

[Falconhell]

Just a trollin the troll.

If you dont know how to do it

I will show you how to troll the troll!

(To the tune of walking the dog)

Not a blow landed yet kindy boy, but you get more frustrated each slighjtly changed copy/pasta you post.

Fine, just don't tell ANYONE about email, ok? LOL

[Anonymous Coward]

"you do realise that there was no email in 1979 dont you? Oh of course being 10 you wouldnt" by FalconDOUCHE (1289630)
on Wednesday April 28, @12:35AM (#32009320)

Dimwit, there's been email systems since before ARPANET http://www.nethistory.info/History%20of%20the%20Internet/email.html ... utterly unbelievable: Here's a quote from said "HISTORY OF EMAIL":

***

Email is much older than ARPANet or the Internet. It was never invented; it evolved from very simple beginnings.

This is why Ray Tomlinson is credited with inventing email in 1972

***

LMAO, wait wait... it gets BETTER next, below (so "play it again, SAM"):

"I qualified as a Telecommunications tech in 1979" by FalconDOUCHE (1289630)
on Tuesday April 27, @11:42PM (#32008806)

LMAO -> http://slashdot.org/comments.pl?sid=1619750&cid=32008590 see subject above, read url, and rinse-lather-repeat, falconDOUCHE... how stupid can you be? LOL, I bet you did that MERE TECHIE job on lol, telegraphs.

I mean based on your dimwit reply in the url above, where you messed up on the fact that hotmail does give away your IP address, and where YOU called others names no less?? LMAO!

(Man - Please, falconDOUCHE - do you think ANYONE believes that which I quote of you above, after reading the URL below it? LOL, not! LMAO... you can't even get email right (see url to anyone reading, lol), so you're far from a "telecom tech").

About "landing a blow"? Hell, I didn't even HAVE TO TAKE A SWING, lol... you KNOCKED YOURSELF RIGHT OUT with what's above, lmao!

Rated interesting for what? He's using known tech

[Anonymous Coward]

"Process Explorer and a few hours later I was back to normal (protip: malware "watcher" processes usually aren't smart enough to realize when they've been suspended. Comes in handy.)" - by RulerOf (975607)
on Tuesday April 27, @05:03PM (#32004704)

This bloke obviously only read what was written in this guide for securing Windows, and its virus removal section in post point #20 http://www.tcmagazine.com/forums/index.php?s=610624dd0ca744a1833203a79296f8ee&showtopic=2662&st=0 or in the other forums where it's posted. The bloke who posted it did it all over the bloody web and though that's rather gauche, it's good he did. I say that because others are starting to realize the value of its points, such as the usage of Process Explorer for hunting and killing off malware. Use that guide, and Bob's your Uncle.

(This is not new news on that guide though, it is many years old now, and others are learning by it in how to use Process Explorer for malware removals. Nothing interesting whatsoever in what RulerOf did or used, because the information's been out there on it for years now).

Bloody hell, the way RulerOf's using Process Explorer could be done with taskmgr.exe instead (killing first level executables).

The true value of Process Explorer in these cases is to use it to find processes that hide themselves under other running processes (such as libs/dlls loaded in other apps like Explorer.exe, which taskmgr.exe will not show) or underneath services (like svchost.exe, which does not expose what its running beneath itself in taskmgr.exe in Windows 2000, XP, Server 2003 at least).

"It used the AT command to get what it wanted in terms of privileges and so on, and went to town on my local security policy." - by RulerOf (975607)
on Tuesday April 27, @05:03PM (#32004704)

Bloody hell, perhaps you did not read that guide in that url above for how to secure windows after all. It covers securing the AT command, by its usage of the CIS Tool (this damn tool's incredible in that capacity and many more). Then again, once a bloke knows what CIS Tool covers, it's cake to put it into your regedit.exe favorites or to make custom MMC.exe for policy settings and again, Bob's your Uncle.

Earth to Coward:

[pastafazou]

the post I was replying to was blaming it on out of date, poorly maintained PCs. I'm telling you that a completely up to date and well protected machine can get hit just as easily! And it was a google sponsored advert that infected him!

Windows popups annoy Users

[u64]

There's plenty of popups in Windows, people are annoyed and dont
bother reading anything, they click just to get rid of it.
They assume they're safe bacause they have AntiVirus and Firewall.

In fairness, last week i accidently infected my test-machine
by running a setup.exe. Avira scan didnt find anything. But a second
after i ran the exe it found virus and promptly deleted the setup.exe.
But obviously i was already infected. And moments later it Disabled
Avira.
I later scanned another copy of the same setup.exe on virustotal.com
and none(!) of the scanners found anything.

(This will be a fond memory to look back on. After i've switched to Linux)

Not just naive users

[Anonymous Coward]

I have had to deal with a lot of rogue security software at work. A lot of the cases were driveby installations on up-to-date computers protected by antivirus. Often, the users were infected by googling a legitimate topic and clicking on one of the resulting links.

So, you can't blame the problem solely on naive users. You can get infected by clicking cancel or even closing a popup from a malicious site. The best thing to do is to use task manager to kill the browsing session. These attacks are getting extremely sophisticated. They typically include rootkits, backdoors, and other components beyond the annoying fake antivirus warnings.

Re:Rated interesting for what? He's using known te

[RulerOf]

The true value of Process Explorer in these cases is to use it to find processes that hide themselves under other running processes (such as libs/dlls loaded in other apps like Explorer.exe, which taskmgr.exe will not show) or underneath services (like svchost.exe, which does not expose what its running beneath itself in taskmgr.exe in Windows 2000, XP, Server 2003 at least).

Indeed, and I used it in such fashion.
I find that Process Explorer's best feature in these situations is it's signature verification. Suspending processes that don't pass signature verification, irrespective of whether or not they're malicious, is a great place to start when rooting out malware.

Bloody hell, perhaps you did not read that guide in that url above for how to secure windows after all. It covers securing the AT command

I know that the AT command grants SYSTEM by default. Funny thing is that the task scheduler in Vista and later has a little link "control usage of the AT command" or some such. It prompts for an account to use and when I first saw that I said, "Oh, that's convenient" and of course, never did anything with it. Oh well.

Thanks for the links, though, I've never read any of those guides, just had a lot of experience dealing with this kind of bullshit on behalf of others. Though I have read plenty of articles by the great Russinovich himself. Now those are some good reads.

Re:license for Americans

[aqk]

I still think there should be a course given for a Internet License. This way if you dont base your not aloud to go on the internet. Well atleast in large corperations/government facilitys. cough cough (where i am). These people just can't stop clicking on stuff. They never read just click

Such poor spelling, punctuation and grammar skills and you're working in a government facility? Man, I can only hope it's not my government you're working for.

Dude, he's working for a RUSSIAN government facility. But he had sufficient knowledge to answer here in English. After all, it's not his first language. Oh yes- he also speaks Polish, French, and German. So how many languages do YOU speak, besides 'merican? Do you even know of many foreign countries? Say isn't Korea near France?

Re:license for Americans

[gyrogeerloose]

Dude, he's working for a RUSSIAN government facility

Okay, that's what was saying--I hope he wasn't working for my government. Slashdot is an American-oriented site, after all.

So how many languages do YOU speak, besides 'merican?

English, Spanish and a bit of Italian. You?

Do you even know of many foreign countries? Say isn't Korea near France?

Don't be silly. Korea is one of those islands out in the ocean somewhere, isn't it? ;-)

No Clicking Required

[Anonymous Coward]

An infected website will infect use your browser add-on and infect you without authorization. My customers commonly say they did not click a thing. They did not click run or accept. Most of the customers are not current on patches, adobe reader version, java etc. Most tend to run with local administrator rights. None of the above is best practice but these are random customers who call when they have trouble, not when they want patches installed. One customer even had their ftp password sniffed from contribute and had their website html updated remotely from some robot with an obfuscated javascript embed request.

sounds vaguely familiar...

[airdrummer]

it'll come 2 me...some kinda fruit store...

Bloke who wrote that guide helped Dr, Russinovich

[Anonymous Coward]

Thanks for the links, though, I've never read any of those guides, just had a lot of experience dealing with this kind of bullshit on behalf of others. Though I have read plenty of articles by the great Russinovich himself. Now those are some good reads.

The bloke who wrote the guide used to work alongside Dr. Mark Russinovich for the same company (Sunbelt) in the same period in the 1990's and the bloke even actually corrected 'the great Russinovich himself' in code, believe it or not http://www.pcmech.com/article/defragging-the-windows-page-file/ when he found that Dr. Russinovich had actually hardcoded the path to C: drive in pagedefrag.exe for the location of the pagefile.sys and to the eventlogs and registry hives (all can be moved to other drives to lessen the work C drive does, provided a user has multiple disks) and from what I read at Windows IT Pro, Dr. Russinovich even thanked him in email for it. That bloke posts here as anonymous coward, and signs his posts as 'APK'. His guide (cut from his post I found and bookmarked it here as) for securing Windows turns up results like this for users (quoted):

HOW TO SECURE Windows 2000/XP/Server 2003, & even VISTA/Windows 7 (+ make it "fun-to-do" via CIS Tool Guidance & beyond):

http://www.tcmagazine.com/forums/index.php?s=568d95985ad83ef4add94de09f6026d3&showtopic=2662

----

It works, & is based on the concept of what many computer security folks the past few years have been calling "LAYERED SECURITY"...

PROOFS/EXAMPLES OF ITS EFFICACY? Ok, below:

----

http://forums.theplanet.com/index.php?s=80bbbffc22d358de6b01b8450d596746&showtopic=89123&st=60&start=60

"the use of the hosts file has worked for me in many ways. for one it stops ad banners, it helps speed up your computer as well. if you need more proof i am writing to you on a 400 hertz computer and i run with ease. i do not get 200++ viruses and spy ware a month as i use to. now i am lucky if i get 1 or 2 viruses a month. if you want my opinion if you stick to what APK says in his article about securing your computer then you will be safe and should not get any viruses or spy ware, but if you do get hit with viruses and spy ware then it will your own fault. keep up the good fight APK." - Kings Joker, user of my guide @ THE PLANET

AND

http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=2

"I recently, months ago when you finally got this guide done, had authorization to try this on simple work station for kids. My client, who paid me an ungodly amount of money to do this, has been PROBLEM FREE FOR MONTHS! I haven't even had a follow up call which is unusual." - THRONKA, user of my guide @ XTremePcCentral

AND

"APK, thanks for such a great guide. This would, and should, be an inspiration to such security measures. Also, the pc that has "tweaks": IS STILL GOING! NO PROBLEMS!" - THRONKA, user of my guide @ XTremePcCentral

AND

http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=3

"Its 2009 - still trouble free! I was told last week by a co worker who does active directory administration, and he said I was doing overkill. I told him yes, but I just eliminated the half life in windows that you usually get. He said good point. So from 2008 till 2009. No speed decre

Re:Bloke who wrote that guide helped Dr, Russinovi

[RulerOf]

Very neat stuff.

Reading stuff like this (and understanding it so well) has often made me consider learning more and specializing in security administration, because it's just so damned intriguing. Alas, though, I find implementation to be my strongest suit (a-la infrastructure admin/management) and what I prefer to deal with that it's where I'm pointing my career. Nonetheless, I still like to have a healthy knowledge of security principles, in spite of the fact that I'm waaaay too lazy to implement them at home ;-).

For what it's worth though, my own desktop has been running on the same Vista install for over two years now. No slowdown there without this guide either. I am going to bookmark it though, and, time permitting, likely implement it.

I'm not a fan of hosts file blocking though, I prefer to do things on my local DNS server.

Again, great links! Also, you seem to know a lot of blokes.

Sprocket "PERFECTLY" blown the hell away

[Anonymous Coward]

#1. Don't pay sprocket any mind, he is a bullshit artist. #2. http://slashdot.org/comments.pl?sid=1293667&cid=28621185 where sprocket was totally "perfectly" (the word he refused to define along with his evading all questions put to he) blown away by his own dyslexic mind due to -> #3. Sprocket also likes to put words in others mouths they never even said and tries to state they "implied it" when his dull brain obviously cannot interpret written english properly because when asked by the person replying if sprocket could find where said person supposedly stated what sprocket said he did? Sprocket ran or evaded all questions there. I bookmarked that for everyone's reference so this no mind Sprocket could see it again and regret his stupidity in being a wanna be computer expert (not). He certainly got his ass handed to him there. Read it yourselves, and decide how "expert" sprocket really is.

Sprocket "PERFECTLY" blown the hell away

[Anonymous Coward]

#1. Don't pay sprocket any mind, he is a bullshit artist. #2. http://slashdot.org/comments.pl?sid=1293667&cid=28621185 where sprocket was totally "perfectly" (the word he refused to define along with his evading all questions put to he) blown away by his own dyslexic mind due to -> #3. Sprocket also likes to put words in others mouths they never even said and tries to state they "implied it" when his dull brain obviously cannot interpret written english properly because when asked by the person replying if sprocket could find where said person supposedly stated what sprocket said he did? Sprocket ran or evaded all questions there. I bookmarked that for everyone's reference so this no mind Sprocket could see it again and regret his stupidity in being a wanna be computer expert (not). He certainly got his ass handed to him there. Read it yourselves, and decide how "expert" sprocket really is.