Slashdot Mirror
Three Indicted In Scareware Scam That Netted $100M
alphadogg writes "Three men are facing federal fraud charges for allegedly raking in more than $100 million while running an illegal 'scareware' business called Innovative Marketing that tricked victims into installing bogus software. The company's products generated so many consumer complaints that in 2008 the FTC brought a civil action against Innovative Marketing and call center partner Byte Hosting, effectively putting them out of business. On Wednesday, a grand jury in Chicago handed down criminal charges, meaning the three men now face jail time if convicted." One of the men indicted is in Ohio and the others are believed to be in Ukraine and Sweden. Microsoft's Digital Crimes Unit helped out with the case.
These guys can kiss the baby.
LK
"Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
Is this the same group that created all of those XP Antivirus 200X programs? Christ all mighty! That's some serious malware that's almost impossible to remove! I can only imagine how much the developers got paid.
Life is not for the lazy.
...but hopefully only the beginning. Let's hope "Microsoft's Digital Crimes Unit" can help take down Symantec next.
I spent hours yesterday removing "AntiVirus Soft" from 2 computers at home yesterday. They are getting tougher now also by making it harder to run programs like AntiMalWareBytes and others even in "Safe Mode". This one also pops up porn sites once in a while. I have heard it lays dormant for a while.
According to the Department of Transportation, one human life is worth $2,600,000, meaning that the damage of this scam was approximately equal to that of 38 deaths. To put this in perspective, the Manson family almost earned death penalties for only 27. I hope the judge takes this into account when deciding sentencing.
If they would just wait for the free market to kick in, this would be solved once and for all!
Digital Crimes? Sheeeeeeeeeeeeeeiiiiit
I tell everyone, both at work and the few who know I work in the IT field, that whenever you are asked if you to install something, the answer is always no. I don't care if it tells you your computer will explode and burn your house down, the answer is no. I don't care if it tells you that 1 million babies will be killed if you don't install the software. The answer is still no.
No, no, no, no, no!
Of course not making them admin helps in this regard, but malware can still find a way to install itself so the answer is always no when asked if you want to install "Ultimate Web Cleaner Deluxe Plus!".
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
The law does something good for a change. Hope they get convicted.
"In prison you just have to shut your eyes and take it. Here you have to shut your eyes and give it."
You beat me to it. Symantec may have done some good stuff, but that was over twenty years ago. Same with Norton but, after they merged together, "scareware" seems the most appropriate name for what they have been doing.
I liked the "pink shirt" book, though, was of great use to me in the 1980s.
Did I scare ya? How much jail time is that worth? Sick
“He’s not deformed, he’s just drunk!”
On several occasions over the years, I have encountered scareware which said that viruses and spyware had been detected on my Linux computer. Each time that was while I was browsing the Internet while using Linux at home. I had never heard of any Linux viruses actually circulating in the wild, so I was skeptical that they had actually detected both viruses and spyware on my computer.
On each of those occasions, it offered to scan my hard drive for viruses and spyware. Despite trying to say no and/or close their web page the advertisement reappeared and pretended to start scanning my hard drive. It said that it was scanning my drive C, with a progress bar showing that a scan was supposedly in progress. That seemed bogus, because drive letters are not used in Linux for designating hard drives or partitons.
I had a firewall enabled in both my DSL router and on my computer, with all the incoming ports and most of outgoing ports closed. So, I doubted that it was actually quite that easy to effortlessly scan my hard drive, like that.
After about 60 seconds of scanning my hard drive, they announced that several several viruses and several types of spyware had been found on drive C and also in my registry. Linux does not have a drive C and also does not have a registry, so again that seemed bogus. They then recommended that I purchase their anti-virus product to solve the problem. Not having actually noticed that I was using a Linux instead of Windows, they did not offer me a Linux version.
On at least one of those encounters with scareware over the years, it even tried to download their antivirus program to my computer just after I again tried to close the tab (or possibly a pop-up). Firefox then asked me what program it should use to open a Windows executable file. It also gave me the alternative of choosing where to save the file, or canceling the download. Of course, I did not even consider trying to download the program and see if I could get it to run under WINE.
After the most recent scareware encounter, I immediately installed the NoScript and AdBlock plug-ins for Firefox. I did that on both my Linux computer and my Windows computer. I had finally had enough of scripts and advertisements. Now, when I encounter an occasional trusted web page which requires scripting enabled, I right-click on the icon in the lower right to either temporarily or permanently allow scripts for just that web page. I am not a computer expert, but my guess is that without scripting enabled, I would probably have less trouble closing the advertisement without it instantly reappearing again.
$100 Million split 3 ways? Now you're talking values that make a few years of jail time worth it. That or take the money and run to another country.
Only the State obtains its revenue by coercion. - Murray Rothbard
And this is how I #!" find out!!...
"Microsoft's Digital Crimes Unit helped out with the case."
Oh gawd. Just watch some guy at CBS start pushing a new series called "CSI: Microsoft". That's ALL we need.
I have successfully used this defense. When I was six, we put doggy doodoo in Fatty Postlebridge's coat pockets. It was the other two, they maked me done it, waaagh, 's not fair!
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
MicroSoft's Digital Crime Unit...
Isn't that kind of like putting a vampire in charge of the blood bank?
I have had to remove this malware from numerous systems in the past 3 years and bottom line is, the $29.95 to by the software is less money than my time is worth. I have never bought anything but I also have NEVER spent less than hour in the removal process....
I can't tell you how many times I have no paperwork in front of me alleging crimes, haven't presented any information or evidence, and am expected to answer for something I don't know anything about to an unruly "judge" and scared into some kind of plea agreement in which I pay mass amounts of money to someone outside because the repercussions of some kind of undisclosed dispute would prevail to bankrupt me if I otherwise didn't agree to what little the judge or adversary would say.
$100M is petty money compared to organized crime in courts. Just last year I had to sit everyday for a week because they wouldn't give me a straight answer on when exactly to come to court on each day. I brought a spare writing-pad and wrote down what others around me were paying for various "tickets" that amounted to no damage to others but struck as some kind of violation of sorts. Theose God-damned courts are raking about $15k to $50k every day, each room, on those "tickets" alone. Absolute bastardry!
"Basically, you run Process Explorer to kill the thread in question, then use Autoruns to prune the malware from bootup and other places it has it's hooks into." - by DigiShaman (671371) on Friday May 28, @10:49PM (#32385810) Homepage
Why stop there? Once you have suspended the malware executable (or even library being called by another parent process, such as a bad .DLL being loaded into say, explorer.exe), you can delete it on disk to stop it from running ever again, in addition to stalling out their startup entries with tools like MSConfig OR autoruns (also by Dr. Mark Russinovich of Microsoft).
That is, assuming it's NOT part of another executable, say as a hidden resource contained INSIDE another program (and yes, you can store executables of any kind inside another executable to either hide them, I have done so with .avi files inside of screensavers I have written for example, &/or, to dynamically load them too (PnP driver programs do this & in fact, I am fairly certain Dr. Mark Russinovich does it in this very program & others he writes, to extract out & load drivers of Plug-N-Play nature inside his programs based on the platform they are running on, what's called "hybrid design" (combined 32 bit/64 bit apps that need drivers do this)).
I cover how (and why) that's done here:
----
HOW TO SECURE Windows 2000/XP/Server 2003, & even VISTA/Windows 7 (+ make it "fun-to-do" via CIS Tool Guidance & beyond):
http://forums.theplanet.com/index.php?s=a3272f47031ff9e8939bf662e3a7b7fe&showtopic=89123
----
In that security guide for Windows NT-based OS' "malware removal section"... & yes, it works!
APK
P.S.=> Thus, no antispyware/antivirus/antimalware-in-general (the part of your quote above I did not quote which followed directly after it) is even required really...
That is, once you spot an odd lib or exe running & sometimes you have to use Process Explorer's "DLL VIEW" lower pane (you have to turn this feature on manually, it's NOT on by default) to determine this first!
Then, you look up the potentially offending process or library on GOOGLE (or any search engine, & I'd suggest using a few sources to be sure of what you are deleting is in fact, a malware) & after determining it is indeed, a malware executable?
You can pull what I noted with Process Explorer (or, as an alternate method of doing it, recovery console (because it allows you to get to these things before they can even startup in usermode when you logon to your machine))... apk
"Instead of using kill process tree you can use suspend process. That way it won't relaunch itself or other related processes" - by Xoltri (1052470) on Friday May 28, @03:35PM (#32380382)
Why stop there?
See - Once you have suspended the malware executable (or even library being called by another parent process, such as a bad .DLL being loaded into say, explorer.exe), you can delete it on disk to stop it from running ever again, in addition to stalling out their startup entries with tools like MSConfig OR autoruns (also by Dr. Mark Russinovich of Microsoft).
That is, assuming it's NOT part of another executable, say as a hidden resource contained INSIDE another program!
(Yes, you can store executables (OR other types of data too) of any kind inside another executable to either hide them, I have done so with .avi files inside of screensavers I have written for example, &/or, to dynamically load them too (PnP driver programs do this & in fact, I am fairly certain Dr. Mark Russinovich does it in this very program & others he writes, to extract out & load drivers of Plug-N-Play nature inside his programs based on the platform they are running on, what's called "hybrid design" (combined 32 bit/64 bit apps that need drivers do this)).
NOW - IF the offending malware is instanced by being a library being called by another app (say Explorer.exe, I'll stick to that as an example because I've seen it actually happen & get used that way before), you sometimes also have to stall/suspend the calling parent process too (but, don't delete it, lol, especially IF it's a crucial process like explorer.exe, which IS your desktop shell) because it's maintaining a call handle to the malware lib being used too (in my example case here, explorer.exe), and then suspend the offending malware lib/dll too, and then delete it on disk (as well as any associated startup entries + registry or .ini file entries it uses too).
This is how/where Process Explorer's "DLL VIEW" lower pane view option can & IS extremely useful in fact (ferreting out "hidden" malwares that are running under another process' hWnd as a lib loaded by them - a bogus shell extension, for example, could be an example here of what I mean).
I cover how (and why) that's done here in this guide's "malware removal" section:
----
HOW TO SECURE Windows 2000/XP/Server 2003, & even VISTA/Windows 7 (+ make it "fun-to-do" via CIS Tool Guidance & beyond):
http://forums.theplanet.com/index.php?s=a3272f47031ff9e8939bf662e3a7b7fe&showtopic=89123
----
In that security guide for Windows NT-based OS' "malware removal section"... & yes, it works! Per my subject-line, I also noted this technique to DigiShaman here http://yro.slashdot.org/comments.pl?sid=1668142&cid=32388064 who was another user here commenting on the usage of Process Explorer as a tool vs. malware infestations.
NOW, additionally, IF the malware is instanced as a driver? Another tool by SysInternals/WinTernals/Microsoft that's useful is LoadOrder (it can show drivers loads) and regedit.exe also (drivers & services typically instance here -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services in those keys and their subkeys iirc) or RECOVERY CONSOLE's LISTSVC, & DISABLE commands work well here also (they list drivers AND SERVICES plus their startup states, which you can control this way).
APK
P.S.=> Thus, no antispyware/antivirus/antimalware-in-general (the part of DigiShaman's quote where I replied to he here in how to use PE, that I did not quote which followed directly after it in the URL above) is even required really...
Again - That is, once you spot an odd lib or exe running