Web-Users Fall For Fake Anti-Virus Scams

jhernik writes "Fearing their computers may be prone to viruses, many web-users download fake anti-virus software, only to find later that their bank details have been hacked. According to the latest research by GetSafeOnline.org, the UK's national internet security initiative, a rising nunber of organised criminal gangs are tricking security-conscious intenet-users into purchasing anti-virus software to access their bank details. Posing as legitimate IT helpdesks, these fraudsters target internet users concerned about protecting their computers. By offering free virus checks, they normally tell consumers that their machines are infected and offer fake security software protection – usually costing around £30 – which is actually malicious software in disguise." The fact that there is such a thriving market for fake AV scams really says something about the present state of the legitimate AV market.

Comments

PEBKAC

[piripiri]

Again. Next story please.

Re:PEBKAC

[oldspewey]

Nerds of the world, it is time to unite around a new cause. It is time to write, and release, a new virus that relies on a series of incredibly stupid attack vectors - the kinds of attack vectors that only a clueless dipshit would actually fall for. The virus has only one simple payload: it uninstalls all network drivers on the machine.

After several trips to get their machine "repaired," these folks will either wise up, or give up.

Who wants to join the crusade?

Re:PEBKAC

[PTBarnum]

So? Does the fact that the user made a mistake mean that this is not a problem worthy of attention? We need to find ways to make it easier to distinguish spyware that steals your personal information for criminal gangs from the legitimate software that steals your personal information for big businesses.

Re:PEBKAC

[symbolset]

Not only is there already such a virus, the PC usually comes with it preinstalled.

Re:PEBKAC

[EdZ]

It's already pretty damn easy to identify fake AV software. Just follow this simple flowchart:

Is it advertised through a popup or an unsolicited email? > Yes > It's a scam!

Simple! This works for all products, not just fake AV.

Re:PEBKAC

[Anrego]

The problem with that is, all the ways to do this are probably _really_ bad.

I know! How about we designate microsoft, erm I mean some independant authority to decide what software is safe, and have some hardware built into all PC motherboards that verifies a piece of software has been signed before letting it run!

The _real_ problem with the trusted computing solution is that is sounds good.. which creates that deep seated fear that it might one day become a reality :(

Pre-emptive response to: "well.. it could be opt-in.. this would let people who want to run unsigned software like.. Linux.. do so at their own risk:"

It wouldn't be opt-in for long. Every justification from prevention of crime to prevention of spam would be used combined with a good amount of lobbying would eventually make it manditory.

Re:PEBKAC

[Lunoria]

So? Does the fact that the user made a mistake mean that this is not a problem worthy of attention? We need to find ways to make it easier to distinguish spyware that steals your personal information for criminal gangs from the legitimate software that steals your personal information for big businesses.

Simple. Make javascript illegal. That'll slow those criminals down.

Re:PEBKAC

[windcask]

The people who really worry me are not the clueless dipshits, but the 50+ crowd who have never really used computers before, and through newly-acquired secondhand knowledge, now know just enough to be dangerous. I think they're probably the ones mostly in danger of falling for these scams. We need to keep our parents and grandparents educated and tell them just because a page shows up first in their Google search doesn't mean it's necessarily what they're looking for.

Re:PEBKAC

[piripiri]

It's the same old problem and the same solution which rise every time an issue like that appear. Someone will always be able to fool the users as long as their systems are insecure.

Re:PEBKAC

[oldspewey]

When javascript is outlawed, only outlaws will use javascript.

Re:PEBKAC

[Anonymous Coward]

Sounds to me like the definition of "clueless dipshit"

Re:PEBKAC

[Brucelet]

When javascript is outlawed, it won't be running in your browser so the outlaws using it can't do anything.

Re:PEBKAC

[windcask]

I'm sorry, I think you're confusing teh interwebs with Chicago...

Re:PEBKAC

[slim]

I think my dad fell for something like this. As far as I can ascertain, he searched for Malwarebytes, and whatever page he got to, the most conspicuous "download" link was to the scam product. So really, I can't blame him for being fooled.

The software identified some issues, but said there were more, that it would charge him for removing. Some time later, he received a phone call about it. I don't know how they got his phone number, but we do have an unusual surname.

Re:PEBKAC

[Tanktalus]

This is the reason I clicked on the story at all. Just two weeks ago, my mother (59) called in a panic about over 300 viruses that some program found, and was about to click on the "run this executable" popup that IE gave her (my father won't let her run Firefox? Not that FF is likely to have stopped this*) when she thought to call someone. She tried to get a hold of my father, but he wasn't available, so she called me. I told her it was a scam, and to abort immediately. Not knowing really what else to do, I asked her to ensure her legitimate virus scanner was run that very night just to be sure. I think the trouble was averted, but only barely. It's an effective social hack. The question that makes it worth discussing is what, if anything, can we do technically to stop these hacks, and, in the meantime, what can we do socially to educate?

(*) I've seen the scam on Firefox, too, although that was years ago. FF may be blocking it since, I guess I don't know. But I found it funny because, of course, it looked like a bunch of Windows windows, which looked really out of place on my KDE/Linux desktop. And I knew that even if I did download it, it would be unlikely to be able to do anything (not that I did download it).

Re:PEBKAC

[Yvan256]

And that's why the iPad is a wonderful device. Good enough to let people get on the Web, do email, instant messaging, some games. But it's not a regular computer where you can install new drivers, etc. The so-called "average users" are the target market.

Re:PEBKAC

[adonoman]

Someone will always be able to fool the users.

You're correct up to this point. Even with a mandatory hardware-based trusted computing platform, there will still be users out there being tricked into entering their banking details into a strange website (or even over the phone).

Re:PEBKAC

[eviljolly]

Agreed, this is not news for nerds; it's news for end users.

Re:PEBKAC

[windcask]

The question that makes it worth discussing is what, if anything, can we do technically to stop these hacks, and, in the meantime, what can we do socially to educate?

I think we need to show them we care by walking them through the tasks they perform day-to-day. For example, checking their email. Show them examples of what to watch out for and what file types can possibly contain viruses. For web searching, show them an example of an SEO bomb. If they have Facebook, show them examples of what to watch for in terms of malicious apps and such. And most of all...tell them to call us if they see something suspicious. And yes, though anti-virus is 99% smoke and mirrors, it's nice to have one last layer of defense in case they are tricked.

Oh, and tell them not to bank online. It's way too important to know what to look for, and if you don't, you have a much higher probability of getting owned. Nobody's going to click on their online banking notifications if they don't bank online in the first place.

Re:PEBKAC

[eepok]

Really? I thought the problem was the virus-writers and the scammers. "PEBKAC" here is blaming the victim who was innocent enough to trust.

Don't forget to blame the next car-jacking victim who pulls over to help out someone who, on the outside, seems to have broken down.

Re:PEBKAC

[Bert64]

These people are not the problem, the idea of giving such people full access to a full blown computer connected to a public network and running a fully fledged os designed to make such things trivial is the problem...

You don't let people drive cars, fly aircraft or do various other things unless they have received proper training, and using a computer should be no different. Such users don't need a full blown computer, they need a simplified appliance that is controlled by someone else (who knows what they're doing)... This is part of the appeal of apple's walled garden.

My grandparents have a linux box, it runs the apps they want (browser, manage photos and videos, im client, email client, music and video player) and if they want anything else they can acquire it from the ubuntu repository... They can install apps from the repositories, but can't add new repositories or execute anything they might download by hand. I configured the system and provide support and maintenance if necessary, so far it hasn't been. If they received a notice telling them their machine had malware installed and asked them to input card details, the first thing they would do is call me.
For people without technically literate grandkids, there should be paid services like this.

Re:PEBKAC

[Fallon]

I completely agree.... However I get these from Symantec, McAfee and other "good" vendors. Not that this discounts your theory about it being a scam, it's just not a flat out 100% scam, only a partial scam.

Re:PEBKAC

[windcask]

Yes, for now it's good enough. But the exploits are already coming around for iOS and Android. I'm afraid given a year or two they'll be just as dangerous...and the clueless will become even more clueless as a result.

Re:PEBKAC

[Bert64]

The walled garden approach (eg apple) works well for average users...
Linux distros with trusted repositories are a good idea too, the average user still receives the protection of getting all their software from a known trusted source while advanced users still have the flexibility available.

End users should not have root or equivalent access, they should only be able to install software from trusted sources and should defer to a third party (either someone they know, or a paid service etc) for anything more advanced.

Re:PEBKAC

[Petaris]

Not looking to cause a flame war but the answer is a Mac. The security on it makes sense and most of this malware just won't run (because its for Windows), and the stuff that could can't run by itself. You actually would have to install it and enter your password for it to work.

As someone who has switched their parents to a mac I can tell you that its much easier to support as well. And they can call apple support and get helped through lots of issues.

For the trolls:
*Please note, I have indicated that macs are good for this purpose, I didn't say that it was the be all end all better then anything else solution. Above all l am not suggesting that you stop using whatever you are using.

Re:PEBKAC

[Bert64]

It's a good idea, but only when combined with competition...

Putting everything in the hands of microsoft would be an absolutely terrible idea, but having multiple locked down devices catering to average users would be far better, and then you could still have other providers producing equipment for the geek niche market....

Look at android for a good example, the average consumer buys a locked down phone while people who understand and can take advantage of a rooted android device can either buy handsets like the nexus one or jump through hoops to unlock other devices. There are a whole host of devices available so you aren't forced to place your trust in a particular vendor.

Re:PEBKAC

[John Hasler]

The over fifties have lived long enough to have at least some chance of having acquired some wisdom about trust and overconfidence. They also sometimes know a hell of a lot more than you give them credit for and are often willing to listen to reason. More dangerous are the twenty-something know-it-alls who are utterly confident of their own abilities because, after all, they "grew up in the digital age" (that is, they were taught how to misuse Excel in school and have had a cellphone since they were four).

Re:PEBKAC

[Petaris]

Firefox can get them. I had a user get hit with this about a month ago. Luckily I had gone over fake anti-virus with them during in-service so they knew what they were looking at. The called me because even if the quit Firefox the next time they ran it the fake av came up again. Clearing the cache and re-setting the home page was the fix.

So yes, it can still happen unfortunately.

Re:PEBKAC

[windcask]

/to you and bert64:

I really think what you're doing is good, with one exception...if your parents are only using their computers at home, then that's fine, but what if they need it at work, or if they for whatever reason need to use a public terminal? They are going to have to possess some capability to use the Windows operating system safely. I'd much rather take the time to show them how to use their computer effectively in a way that may apply to other situations rather than just when they happen to be sitting down at their desk.

Re:PEBKAC

[Beardo the Bearded]

I've seen the same popup on Ubuntu.

Now, hah ha, I'm such an awesome user because I use Linux, but seriously, the thing we have to remember is these popups look good. Not "huh, 1997 emailed and said they wanted their msgbox back" but "holy shit Windows is flipping the fuck out! ...wait, I'm not running Windows on this box. What the fuck is going on here?" If you haven't seen it, it's an awesome piece of chicanery that uses open / save API to read your files -- I shit you not, even on Ubuntu since it only requires read access -- and tells you that your own files are at risk. Compound this with the MacAfee Heel: most OTS boxes come with MacAfee installed at least as a demo. The bad guys know this and know that they can dupe the users, or at least enough of the users to make some serious bank.

Personally, I would pocket the 30 Euro and call it a day, since its not a crime to write shitty software.

Re:PEBKAC

[oldspewey]

I think it's the tweens & teens who are the biggest problem. They appear not to give a fuck at all. When asked why they install and run every single facebook app on the planet, and why they need so many idiotic cursors and smileys, the response generally goes something like "check it out, it's so cool though. What's the problem?"

Re:PEBKAC

[NaughtyNimitz]

Or even better: my father (+65 and founder of a medium business) took his new MacBook to the office and showed it to the IT guy: "Hey , look how safe this thing is: and it even works with the printer without installing anything...".
Now 4 years later there is no sight of Windows...

Again, this is of course only applicable to this situation. Stick to Windows in your environment if it works of course!

Re:PEBKAC

[peragrin]

For your parents, during your next visit, theme firefox to look like IE, move bookmarks over, and then replace the IE icon on the desktop, start menu, etc with new links that all point to firefox. they probably won't be able to tell the difference, and then you can use popup blocker.

IE 8 isn't to bad, if they won't go for the previous suggestion. IE 8 at least has pop blockers. I have to keep IE 8 around at work, as Chrome lacks certain features, and renders some websites unusable.(damn IE only sites)

(before I get flamed Chrome lacks basic features like the ability to add margins to printed pages. it is tough to print some pages(like UPS labels) if you can't push the margins correctly.)

Re:PEBKAC

[windcask]

At least you can throw parental controls at that problem. 50+ers need unfettered access to the internet if they want to get anything done.

Re:PEBKAC

[imakemusic]

Maybe he searched for "Malware" and found what he was looking for...

Re:PEBKAC

[websitebroke]

As opposed to the teenage dipshits who are attacked by glittery "plugins" for their MySpace page. Most people are completely clueless about how they get attacked - It's got nothing to do with age at all.

Re:PEBKAC

[DurendalMac]

Um, yeah, the big difference between surfing the internet and driving on the interstate is that nobody dies when the computer crashes.

Re:PEBKAC

[DurendalMac]

My father-in-law is a fifty something and he's utterly retarded when it comes to computers. He's fallen for this crap before, which is why I got his family to throw in for a Mac MIni last Christmas. Now, instead of him calling for help when some virus wrecks his shit, he calls for help with burning a CD from iTunes. I'll take the latter, thanks.

Then again, the guy is pretty dumb all around, not just with computers...

Re:PEBKAC

[Anonymous Coward]

Most users can't tell if a pop-up came from IE or from the real AV program begging you to renew your subscription. If the colors are close enough and the message scary enough, they will click.

Re:PEBKAC

[WraithCube]

That's a slightly different problem. A quick google search for "Malwarebytes" shows legitimate results for at least the first 3 pages (I can't even find download links on any of those pages for scam products... though adblock plus may be interferring slightly). The problem I've seen with quite a few of the recent virii is that they redirect all the pages you can download malwarebytes from (and other legitimate anti-virus product pages) to fake pages offering an anti-virus scam. I can't really blame somebody for being fooled by that despite the URL change and the fact that the page is for a completely different product than the link, but that is still less than the average user will recognize. Regardless, if the malwarebytes pages are showing scam products it probably means the computer is already compromised.

Re:PEBKAC

[LocalH]

Ah, but you forget - to others, who have more power and wealth, [b]you[/b] may be considered an "end user".

Re:PEBKAC

[QuantumBeep]

For your parents, during your next visit, theme firefox to look like IE, move bookmarks over, and then replace the IE icon on the desktop, start menu, etc with new links that all point to firefox. they probably won't be able to tell the difference

And this is the difference between a geek and an insufferable dick. Respect.

Re:PEBKAC

[NatasRevol]

So, you're going to train everyone, every time a new attack vector/ad/clickbomb comes around?

Rather than tell them not to bank online (Are you fucking kidding me?!?!), try telling them if they want to be secure and not have their bank info stolen/cleaned out, then don't use Windows/IE. Since that is what EVERY scam uses. You can argue that using other platforms will have this eventually, but no others do right now. You can argue that Windows is more secure than others, but no other OSes have this scam. You can argue that Windows is more common/well known/familiar, BUT NO OTHER OS HAS THESE SCAMS.

A car analogy: If the Crown Vic was a horribly unreliable car and could kill them if they used the turn signal wrong, you'd never let them buy it. Why would you let them get robbed by using Windows/IE?

Re:PEBKAC

[QuantumBeep]

For a new/elderly user, I submit to you that the correct answer is that they should not use a public terminal. That's just asking for trouble for even the most experienced of users.

Re:PEBKAC

[QuantumBeep]

I'm sorry, I thought we were joking around. Are you actually suggesting we outlaw javascript?

Re:PEBKAC

[Nursie]

This is I think the whole "browser as an application platform" thing we've had going for the last few years.

I know, I know, we need advances and you web programmer types can do some great things with your languages these days. But it's no longer just a browser at that point, is it? And when it gets to interact with the OS on various levels, and when there are holes (which there always are) bad things happen. The fact that web-apps and their multitude of up-popping windows can and do frequently look the same as messages from the OS is probably not a very good thing. I know, we can't stop people faking it with images, but IMHO some sort of inbuilt restrictions on the appearance of web-originating content vs local programs would be a good thing.

Re:PEBKAC

[NatasRevol]

They've already had a year or two.

iOS is 3+ years old (June 2007). It's had an SDK for 2.5 years (Mar 2008)
Android is 1.5 years old (April 2009). It's had an SDK for 1+ year (Sept 2009)

Why do they need another year or two? Or are you just spewing made up BS?

Re:PEBKAC

[mlts]

You don't want that. Having "licenses" to surf the Internet means it is easier to have people's access pulled if they are suspected of a copyright/trademark/patent violation. It makes it easier to yank access to people or even whole groups, then answer questions later.

Instead, operating systems should primarily install software from repositories. Web browsers should never be the interface where users download programs. Instead, they should be pointed to the application on a known good repository (if on a UNIX), or a store (if on Mac/Windows), and download/install it from that. This way, if someone is asked to install some dubious antivirus, it won't be present on a store (either not approved, or the store admins would have pulled it), as opposed to getting binaries from anywhere there is a website.

Of course, this doesn't mean locking things down where the only way to get things is from a store or repository. However, having this be the default will make getting stung by drive-by malware a lot harder.

Re:PEBKAC

[flappinbooger]

Not only is there already such a virus, the PC usually comes with it preinstalled.

Let me guess ... You are referring to Norton 360 or McAfee?

Re:PEBKAC

[pyrosine]

I think windows was what he meant

Re:PEBKAC

[Jicehix]

Well, you can surely guess what could happen to some people when their bank account details are stolen by scammers like those FakeAV publishers, and the bank puts the account on hold or closes it because of the debt. Not everyone has a good enough insurance to cover this and all the nasty "collateral damage".

Re:PEBKAC

[SirWhoopass]

It isn't always that easy. Look up "Think Point".

I was using Google image search (looking at farm machinery). Clicking on an image (from Google) my machine (Win 7, MSE running, firewalled) paused and then Firefox disappeared. I was left with what appeared to be the Microsoft Security Essentials screen, stating the site had a trojan and it needed to look up the solution.

A second later the MSE screen says it found the solution and click next to clean the system. At that point I became skeptical. Using Task Manager I found it wasn't MSE and killed the processing generating the fake (but realistic) screen. Found the .exe files that were already downloaded and set to run on the next boot. Deleted new registry entries. Shortcuts in the start menu and taskbar.

So, having done nothing but navigate to a page through Google - using Firefox - I already had .exe downloaded and registry changes. Neither Firefox nor Google had it flagged as an attack site. Where did that vulnerability come from... Flash, Media Player ? I don't know. The point being that it isn't always that simple anymore. And I would not expect the average user to drop to the Task Manager and find it in progress.

If you're going to reply about using Linux, save it. I've run plenty of *nix systems where I can. But in the real world a lot of business simply must be done using Windows.

Re:PEBKAC

[Belial6]

So, are you claiming that the IT guy didn't know that Macs existed? In 2006? Really? I'm not sure your story says what you think it does. Because the only logical take away from it would be that the IT guy got fired.

Re:PEBKAC

[mlts]

Quis custodiet ipsos custodes?

We all want to take root away from Joe Sixpack whose machine pollutes our corner of the Internet with botnets because he cannot be separated from his nudie pics, so he installs any and all "codecs" and "viewers" imaginable.

However, someone has to have admin authority. Do we trust Apple and Microsoft 100% with it? Do we trust the cellular carriers or the phone makers 100% never to do anything like pushing out code behind our backs, or removing features to charge for them?

This can't be answered in black or white. Probably the best system is shipping the machine locked down, with a way to unlock it for people with a clue. However, how high this speedbump needs to be to keep Joe Sixpack in the walled garden can be debated. Some would say that a warning dialog after entering a command at a command prompt is enough. Others think a physical switch that allows developers to write on ChromeOS hardware is good. Still others think that doing the OLTP method and having users register with the distributer for an override key is the best. Of course, there are those who believe no user ever should have root/admin in any way, shape or form; and just sit down, shut up, buy, and obey.

Re:PEBKAC

[flappinbooger]

Not only is there already such a virus, the PC usually comes with it preinstalled.

Let me guess ... You are referring to Norton 360 or McAfee?

I think windows was what he meant

Awwww... come on, windows pc will usually get on the internet properly at least when first set up, and I've seen norton a/v immediately break the networking on a perfectly working windows pc - more than once.

However, I do see your point windows was probably what he meant.

Re:PEBKAC

[oldspewey]

if they want to be secure and not have their bank info stolen/cleaned out, then don't use Windows/IE. Since that is what EVERY scam uses.

Seems to me that if a phish arrives at my email account, and I open it up using the default email client, and I click the http link that says "your banking details need to be updated", and I fill in all my personal financial information in the resulting web page ... I'm equally boned whether I'm using Windows, MacOS, or Linux.

Same goes for when a former Nigerian oil minister contacts me to assist with a large funds transfer. Some goes for any number of other social engineering scams that don't rely on any specific technology platform.

Re:PEBKAC

[Anonymous Coward]

After working for 10 months doing tech support over the phone for HP, there is a really high chance that he is referring to Norton 360.

Re:PEBKAC

[Belial6]

Not looking to cause a flame war but the answer is a Mac. The security on it makes sense and most of this malware just won't run (because its for Windows), and the stuff that could can't run by itself. You actually would have to install it and enter your password for it to work.

As someone who has switched their parents to a mac I can tell you that its much easier to support as well. And they can call apple support and get helped through lots of issues.

For the trolls: *Please note, I have indicated that macs are good for this purpose, I didn't say that it was the be all end all better then anything else solution. Above all l am not suggesting that you stop using whatever you are using.

This article is talking about malware that is installed by the user, so the Mac is no help there. They are talking about situations where the malware writers have even set up helpdesks to help the users install the malware.

Macs are perfectly fine computers. Overrated, but perfectly fine. They are not any better at solving this particular problem than any other computer that has ever been on the market.

Re:PEBKAC

[Erikderzweite]

When I was working for Siemens, we had to use IE6 which is a major PITA as you can imagine. So I get and theme Firefox mobile. No one has spotted the difference while I was working there.

Yet as parents go, I still prefer installing Linux and explaining them the basics. And no, it's not harder for them neither to install (I do it anyway, no matter the OS) nor to use (Web pages here, chat there, photos in this folder). Should problems occur, I've set up reverse SSH with VNC port forwarding -- I live in a different country so that's an important thing for me.
As for threat like these -- I don't think we'll see something similar for Linux for the next years to come. Be it because of small market share as some people claim -- I don't care. Here and now my parents are safe and I don't see the situation changing soon. In fact, Linux is participating in arms' race for a long time -- there is simply no sword to hit its ever-improving shield.

Re:PEBKAC

[bl8n8r]

All kidding aside, a lot of web based malware does do an incredibly good job of mimicking windows file manager and/or windows pop-ups. It's not fair to say a user is a lamer because they clicked something - especially when pop-ups are so frigging commonplace in desktop environments.

EULAS, errors, inane install programs, they all want the user to read and click 10 times and it's friggin annoying. People just click to make it go away and don't even bother to read it. Hallf the time the dialogs are undecipherable ('blah cause a general protect fault'.. etc); this means nothing to the average user except maybe 'I hurled so restart something'.

If you want to crusade against something, blame microsoft. They are the ones allowing maware to propogate so readily; they could stop it if they wanted to but they don't.

Re:PEBKAC

[NatasRevol]

Ok, point taken. every AV scam. instead of every scam.

Re:PEBKAC

[WuphonsReach]

Firefox is not immune.

Pretty much, if you're letting Javascript/Flash run from every site you visit (and the dozen or so "associated" sites that the original site pulls content from), you're going to get hacked... monthly. Depending on your luck and whether any ad networks on sites you frequent are serving up malicious ads. The wider variety of sites that you visit, the riskier it gets. But even the big mainstream news sites have served up malware.

NoScript + FlashBlock = the only sane way to browse any more
(with a very small, as small as you can make it and still access the sites, whitelist)

The bad actors are getting closer to completely destroying the rich ad ecosystem. It's gotten continually worse for a few years now. Makes one wonder how much worse it can get before either the users revolt or browser makers are forced to switch to run-only-if-whitelisted.

(I've had a few people this month inquire into learning NoScript/FlashBlock after their machines got infected multiple times in the course of a month.)

Re:PEBKAC

[Anonymous Coward]

I also noticed that there were grammatical errors and/or misspellings in the popup windows for these fake AV things. Buy a spell-checker if you're going to try to become a criminal mastermind...

Re:PEBKAC

[jargon82]

Lets consider though, if you did setup your parents/grandparents/whatever with linux. If they ran ubuntu, and a window (in firefox) popped up saying they were infected, would they still not fill in their credit card info? I realize it would look like a "windows" window, as do you, but would that really stop the clueless?

Maybe, but probably not. I'm not saying running linux won't make them at least a LITTLE more secure, but I doubt it would solve this issue in all cases, either. If anything, the popup blocker might. Maybe :)

Re:PEBKAC

[Anonymous Coward]

Most IT guys I know love Windows and anything from Microsoft. Without it, they'd be out of work.

Re:PEBKAC

[NatasRevol]

Every fake AV pop I've seen is from IE being the underlying display system in Windows. So I don't think this would happen in Linux or Mac or any handset except WP7.

Re:PEBKAC

[hairyfeet]

So far the only "trick" I've found to help keep the "panicky" users from pwning themselves is to use the free Comodo AV or Internet Security because by default it'll not only shut down those kinds of "apps" but sandbox them as well, so even if Granny tries to force it unless you knows how to get into the Comodo system settings and disable the sandbox (doubtful) then anything she does simply won't stick.

Add in Comodo Time Machine (also free) for when Granny somehow manages to corrupt Win32.dll in XP (I still haven't figured out how some folks keep doing that) and it makes the machine pretty much a toaster with a screen. When my GF forgot to log off before work and her niece came over and totally hosed her desktop it took me less than 15 minutes by phone to walk her through a complete restore via Comodo Time Machine.

While Windows Vista and 7 are better about security, as you pointed out it is often the USER not the OS that does the machine in, and using Comodo is pretty much as close as I've come to a "No no, bad monkey!" button for PCs.

Re:PEBKAC

[nanotik]

There are several worms for iOS spreading in the internets already, the only reason they haven't been attacked more is the fact that Windows PC's are far more lucrative and populous targets for malware writers.

Re:PEBKAC

[gordguide]

" ... Compound this with the MacAfee Heel: most OTS boxes come with MacAfee installed at least as a demo. ..."

You've inadvertently hit the nail on the head. The scam is simple and effective because it exploits human logic. I've noticed most /.'ers think that users are naive, or clueless, or worse, but they're missing the beauty of the scam because they can't think like a non-sophisticated user ... they're beyond it and don't have the same mindset anymore.

But, to get to the point, the PC comes pre-installed with some kind of AV, in demo mode. It works for a while, then times out or goes to some limited functionality. This is the AV vendor's only real means to get a license sold. I would bet that pretty much every user that falls for this scam has at least considered buying the demo up to full functionality, but balk at the cost.

Along comes Mr Fake AV. The user knows they have no or limited AV protection. They know everyone says they need some protection. The crooks know that all they have to do is price their scam SW lower than whatever McAffee (or whomever) wants for the demo to go licensed. McAffee has helped this transaction by setting the bar price-wise, and the scammer knows ALL the users have been exposed to the price via the demo, so he also knows ALL the users will see it as a bargain. Bingo. Hook, meet Line and Sinker.

Re:PEBKAC

[NatasRevol]

You're going to have to provide sources to make that sort of wild claim. Otherwise, you're full of shit.

The only 'worm' I've seen in the wild is one that runs on jailbroken iOS, with SSH installed, with the default root password.

Re:PEBKAC

[mywhitewolf]

Installing dodgy apps and getting a virus is not the same as handing over your bank details, I'm yet to find a 20 something year old fall for a Nigerian scammer.

I personally think the problem is because all legitimate companies do too much for the user and are too proactive about trying to liberate the users money from them. no longer do you go on line, go to your favorite website and purchase goods or do any research at all before parting with your money. Too many legitimate companies spam your email with "hot deals" and "go to our website and spend more cash". if you want service, you should either research or ask a professional, but the mentality today is to just go with what the marketing department of that company suggest and find something with "sale" written on it. why think for yourself when all you have to do is enter your credit card details and receive goods?

That's right, all life's problems are because of the marketing and sales departments, that's my philosophy anyway.

Re:PEBKAC

[mywhitewolf]

This is great because it stops people buying stupid shit from even legitimately run business because they received a flier with 'sale' written on it.

Re:PEBKAC

[Beardo the Bearded]

I've worked with end users that had access to power tools and the desire to use them. There is no limit to the dumn fucking themng sht eht do .

No, really, there was one time when they thought a bridge didn't look strong enough so they drilled and tapped a hole in the bottom and added mild steel... to a marine-grade Aluminium superstructure that had been designed by a team of professional engineers. So yeah, don't make the mistake of thinking "Nah, they couldn't possibly..." and I never do. Actually, one end user was a wolverine that sheared off a stainless antenna with the cleanness of a laser. That was pretty cool.

A lot of /. users are condescending to new computer users. But now computers are applicances like toasters or microwaves or consumer goods like cars or jackets. You buy whatever one looks the shiniest with the features you like. Gone forever are the days when you had to put together your own, swap around jumpers, and get something that worked that you built on your own. (I know, for high-performance stuff you still do, sometimes, but for 99% of users it's just as good to get a "gamer" package from Alienware -- whoops, I mean Dell -- if you want to game.) Anyone can get a computer and get online, and access FB and porn and email and /. and WoW and /b/ and usenet and PB and mediafire and wikipedia and netflix and youtube and everything else. That's something like 90% of users.

That 90% is the group that are the power users now. They use more bandwidth and have more raw computer power at their disposal than everyone on /. (and I've had access to a supercomputer)

Re:PEBKAC

[windcask]

Why do they need another year or two? Or are you just spewing made up BS?

Why are you flamebaiting me? It's not a big problem right now, short of a few well-publicized apps. I just guessed that in probably a year or two more crimeware sellers would start including malicious apps in their kits.

Re:PEBKAC

[freedumb2000]

Disabling Norton 360 is usually my first step to troubleshoot a system.

Re:PEBKAC

[DurendalMac]

But it also doesn't leave them a mangled, charred mess, either.

Re:PEBKAC

[Lanteran]

good analogy I've heard is: Windows is like a submarine with screen door, and guess who gets paid to scoop out the water?

Re:PEBKAC

[NatasRevol]

Why? Because you compared IE exploits being similar on different platforms, for a different browser. Including one platform that is curated, and one platform that is peer reviewed.

And then you say that a couple of apps on one platform, which were promptly pulled (unlike the IE exploits that keep happening) are examples that will keep happening - on both platforms.

Your guess is flat out Bull Shit.

Re:PEBKAC

[Anonymous Coward]

I know you think you're being clever but "virii" is not a word and using it just makes you look like a moron. It's spelled viruses.

Re:PEBKAC

[Bert64]

However, someone has to have admin authority. Do we trust Apple and Microsoft 100% with it? Do we trust the cellular carriers or the phone makers 100% never to do anything like pushing out code behind our backs, or removing features to charge for them?

Which is exactly why we need competition, a controlled system would be absolutely horrendous if it was controlled by a single entity or a self serving cartel... We need choices for who manages systems, ranging from big multinationals like Apple, your local computer store, the it dept at your company, a non profit, even your geeky friends or relatives...

Re:PEBKAC

[windcask]

Whatever, troll. It was an innocent comment. The fact that it was poorly worded is a problem for no one but you.

Re:PEBKAC

[NatasRevol]

Yeah, that was an innocent comment.

Gee, these platforms that have existed for several years now are SURE to have exploits just like Windows does. Any day now!

You're a douchebag and just can't admit it.

Re:PEBKAC

[windcask]

You're a douchebag and just can't admit it.

Something tells me you're craving attention. I don't know why...

Re:PEBKAC

[Jicehix]

If they happen to own a gun, maybe.

Re:PEBKAC

[symbolset]

What a coincidence! Disabling the system is the first step in installation of Norton 360. You've achieved equilibrium. Congratulations.

How is this news?

[gregthebunny]

Most computer users are simply naive; some are downright stupid. This should be tagged: !news.

Re:How is this news?

[Anonymous Coward]

Most people are fucking idiots.

Obviously not news.

Re:How is this news?

[Tarlus]

Yeah, it's not exactly news. For a couple of years I've been seeing pop-ups which try to mimic the XP "My Computer" Explorer window, warning of hundreds of viruses on each of the user's drives. Of course the whole thing is bogus but soon I find myself removing "AntiVirus XP 2011" or some crap like that from the computers of people who fell for it.

But, it is always funny if not a little confusing to see those popups while using Win7 or a non-Windows OS.

Re:How is this news?

[piripiri]

Most people are fucking idiots.

Not idiots, but ignorant. You can't blame them for that.

Re:How is this news?

[Anonymous Coward]

Not idiots, but ignorant. You can't blame them for that.

Why shouldn't they be blamed? Why do we insist on creating a dumber world where nobody is responsible for their own actions?

Re:How is this news?

[Anonymous Coward]

Nuns are particularly trusting.

Re:How is this news?

[delinear]

Yes, because it's impossible to educate yourself on any of this stuff. What we need is some kind of global information resource available to pretty much anyone, pretty much anywhere, that people could use to educate themselves. Seriously, you can't blame users for starting from a point of ignorance, but when they choose to remain in a state of ignorance then they're hardly blameless. People manage to learn how to drive largely without everyone killing themselves or each other the first time they get in a car. If it's possible for people to learn the dangers of that activity, how hard is it for people to similarly educate themselves (or have someone else educate them) on the dangers of the internet (sure it's not your life that's in jeopardy online, but it could well be your house, all your savings, your job, your credit-worthiness...)

Re:How is this news?

[bonch]

Just because users are often naive doesn't mean it's not news with there's a new wave of a specific type of malware, which allows Slashdot's technical readers to discuss Windows security, how to better educate users, the current state of the antivirus market, and so on. Lighten up a little, sheesh.

Re:How is this news?

[blair1q]

It's science. It increases the number of significant figures in "most" from 0 ("0.5 to 1") to 2 ("24%) and reveals it not to be "most" but only 1 in 4.2 of those surveyed.

Re:How is this news?

[Bert64]

Because people shouldn't be expected to require such a level of knowledge to use a consumer grade product...

Basically, windows isn't ready for typical users, the closest anyone has got is iOS...

Re:How is this news?

[Culture20]

Yes, because it's impossible to educate yourself on any of this stuff. What we need is some kind of global information resource available to pretty much anyone, pretty much anywhere, that people could use to educate themselves.

one that doesn't trick people with fake AV scams, you mean.

Re:How is this news?

[Anonymous Coward]

jebus, calm down.

I know you are gods gift to humankind, but please, go easy on the rest of us.

I mean honestly, someone as perfect as you cannot have any flaws outside of the IT world.

Re:How is this news?

[Evl]

Not idiots, but ignorant. You can't blame them for that.

Yes you can. People can chose to get informed, at which point they will no longer be ignorant. On the other hand, an idiot can't change their mental ability, and as such they are blameless for their handicap.

Re:How is this news?

[imakemusic]

What we need is some kind of global information resource available to pretty much anyone, pretty much anywhere, that people could use to educate themselves.

This could work. Maybe some sort of interconnected network of computers...

But seriously...most people will, given time, learn how to protect themselves on the internet. The problem is that this does take time. Sure, you can tell someone not to click on popups, but then you need to teach them the difference between all the different windows that popup. You've got your windows dialogs, your anti-virus dialogs, popups from a browser and then fake versions of all of the above that might come from a browser or from malware installed on the system. To a noob these are all just different types of "popup". I would argue that noticing the subtle differences between all these different windows that appear, seemingly at random, is a skill that can't be taught directly.

I'm not saying you can't teach yourself or that people shouldn't. I'm just saying it's not as simple as telling people "don't click that" if they're not entirely sure what "that" is. I would try and explain my point better but I've just finished work and I'm going home now.

Re:How is this news?

[pckl300]

Not idiots, but ignorant. You can't blame them for that.

You've got that the wrong way around. You can't blame someone for being mentally impaired, but you can blame someone for not using their perfectly good brain.

Re:How is this news?

[skiman1979]

There's an implied risk, and required training, with driving. In order to be allowed to drive, one must take appropriate training and get a license. This tells potential drivers that there are things they need to learn before they can get behind the wheel.

In the computing world, there really isn't any such thing, especially for the home user. Joe Average can just go out to Best Buy, purchase a computer, take it home, and be online. He can, and probably will, very quickly get infected with all sorts of malware and his computer may start attacking systems all over the Internet without Joe Average's knowledge - He was never told.

Perhaps there should be a license (and training) required for Internet access similarly to what is required for driving. Maybe even throw in annual inspections of the licensee's computer for good measure.

Of course then there's the whole privacy issue...

Re:How is this news?

[PitaBred]

Yes, I can. If I'm ignorant about something I have to deal with, I take the time to learn it. Or at least enough about it that I can tell bullshit from fact.

There's ignorance, and there's stupidity. You can fix ignorance, but if you refuse to, that's stupidity.

Re:How is this news?

[The Yuckinator]

No, you can't.

Oh wait, yes you can. You can blame them for being ignorant of how to properly operate the tool that they're trying to use.

If someone went out and purchased a brand new precision lathe, brought it home and managed to lose a finger while taking it for its first spin, we'd blame them for being ignorant of how to use that tool. To keep with /. tradition, if someone bought a new car and smashed it up 100m from the dealership and it was found that they didn't have a license and had never driven a car before - they would absolutely be blamed for being ignorant of how to use the car (tool).

So why are we supposed to give them a pass when they don't know how to use their computer, which is essentially just another tool?

Re:How is this news?

[mcgrew]

The trouble is, you can't educate yourself if you don't know you're ignorant.

Re:How is this news?

[Anonymous Coward]

Yes, because it's impossible to educate yourself on any of this stuff. What we need is some kind of global information resource available to pretty much anyone, pretty much anywhere, that people could use to educate themselves.

I agree that we need some massive information resource out there that can educate people!
Does anyone have any ideas how we might set things up like that?

Re:How is this news?

[sirlatrom]

Most people are fucking idiots.

Not idiots, but ignorant. You can't blame them for that.

Well, you could, but they wouldn't listen, would they?

Re:How is this news?

[Anonymous Coward]

Most people are fucking idiots.

Not idiots, but ignorant. You can't blame them for that.

No, you *can* blame them for being ignorant.
"Ignorance" means purposefully ignoring things.
This is the opposite of ignorance: these people are security-conscious and wish to "learn more". But they just lack the common sense you'd have if you grew up with computers.

Really the problem lies with browsers which fail to educate new users. There should be a tutorial saying "DO NOT TRUST CONTENT IN THIS RECTANGLE" or "DO NOT TRUST CONTENT IN A BROWSER WINDOW" unless you see [window decoration that is impossible to forge].

Re:How is this news?

[Anonymous Coward]

Obviously you are missing the root of the word, which is ignore. Ignoring something is always a choice, it doesn't "just happen". I can and do blame them for being ignorant.

Re:How is this news?

[Anonymous Coward]

Any sufficiently advanced technology is indistinguishable from magic.

For many people this rule applies to computers - they don't even bother to think about anything, after all understanding the magic box is impossible. That makes teaching them even the basics about security very hard, and even then they will only do what they were told - word for word.

I don't know about the rest of the world, but in germany they only teach Microsoft Office skills in the computer classes, if they taught about security people would have to think and learn about it.

Re:How is this news?

[Anonymous Coward]

That's like blaming people for not being lawyers ...

Re:How is this news?

[FrankieBaby1986]

Sometimes you can. Some people simply have no interest in even bothering to learn how to properly, effectively and safely use things that are important to their daily lives, such as cars, computers, or any other tool. These people are ignorant, fucking idiots.

Re:How is this news?

[Anonymous Coward]

Yes I can. Ignorance is a choice, not an affliction.

Re:How is this news?

[mcrbids]

Scams are, by definition, acts where people work to appear 'legit'. But being 'legit' is itself nothing more than an act! There's nothing about a professional that isn't anything but an act, an intentional presentation of what you want the user to believe. You think that the Terminex guy in the uniform spent his/her life wanting to kill bugs?

The only difference with a scam artist is the degree to which they will go to keep up the act -real professionals will act all the way through doing the job, while scam artists only act long enough to get your money. Since this is the ONLY difference, there will ALWAYS be problems with scam artists in any society big enough to force its members to transact with strangers.

Re:How is this news?

[Anonymous Coward]

When you've made them aware of the risks, told them numerous times not to click on these fake alerts, and even gone so far as to show them examples and yet they STILL click on the false alerts, is that ignorance or idiocy? This is what I see happening all the time. These are people who have been trained to look out for these alerts, and yet they still click on them.

If someone needs their hand held to get through a simple browsing of the internet, yes they are idiots.

Refunds

[Anonymous Coward]

If you would like a refund for any of fake antivirus software you have already purchased, please send your bank account number, credit card number, pin number, email address, and password to ...

I would have put in a fake email address, but knowing my luck someone would fall for it.

Or...

[ShadowRangerRIT]

The thriving market for fake AV scams simply means people are too cheap to pay full price for a commercial AV scanner, or too stupid to find a legit free one. Computers are appliances to 90% of the world's population, and no other appliance requires expensive upgrades to determine if it's being misused. Even without a car alarm, you'll notice if your car isn't where you parked it, but a most infected computers don't advertise as such. People know they need an AV scanner, and hey, the computer just offered them one, "Score! No need to go shopping for one!" All viruses (that aren't autonomous worms) spread based on misplaced trust or greed, and getting a cheap AV scanner appeals to both instincts.

Re:Or...

[ByOhTek]

Or that they are unaware that they already have one, or that they just are too trusting when someone says it's failed. Given that the users are demonstrating a lack of knowledge about reliability about AV software, the latter says more about the user than the installed AV.

Re:Or...

[takowl]

Even without a car alarm, you'll notice if your car isn't where you parked it

It won't do you much good, though. This is why an alarm is now standard in most, if not all, new cars. Microsoft seems to be moving in the same direction for Windows, with Security Essentials. I guess antitrust issues stop them from installing it by default, though.

Re:Or...

[Schadrach]

The funny part being that Security Essentials is actually pretty decent for a freely (as in gratis) distributed app. I actually wish MS put just a tiny bit of effort to push it in windows, so that those who are cheap would install it before they fall prey to the Antivirus XP BS.

Re:Or...

[KarmaMB84]

If ads on legitimate sites weren't offering up these kinds of "tools", I'd be more inclined to agree the users that get infected are somehow stupid. I remember having my antivirus going off on a regular basis when browsing completely legit sites because an ad embedded in it was attempting an exploit.

Re:Or...

[brainboyz]

They did and they got backlash from the anti-monopoly community and other AV vendors for "repeating the IE mistake" with AV.

Re:Or...

[hedwards]

To be fair, it was handled differently than IE was. It was apparently only showing up on computers where the update program didn't detect an already installed antivirus program.

Re:Or...

[dmmiller2k]

Or that they are unaware that they already have one, or that they just are too trusting when someone says it's failed.

This is, by far, what happens most often among my friends and family, who tend to call me only after the fact, when something major has already occurred (and now needs to be cleaned up).

Re:Or...

[dmmiller2k]

They did and they got backlash from the anti-monopoly community and other AV vendors for "repeating the IE mistake" with AV.

Well, as for the big established AV vendors, screw 'em if they can't take a joke.

IMHO, the free MS Security Essentials appears to at least as effective as any of the big two AV's, and so far on all the machines I administer (that is, my own machines and mostly friends and family), it has proven to have far lower impact on CPU and/or memory than they have.

In fact, stripping off Norton and replacing it with MS has, in at least two instances, made such a difference in responsiveness that the people involved ultimately decided not to upgrade their machines.

Re:Or...

[PitaBred]

Do you know how fast they'd get sued if they did that? Remember Internet Explorer?

Re:Or...

[Schadrach]

I'm not talking about irremovably bundling it into the OS, I just mean something as simple as recommending it or even displaying it in a list of other AVs noting price points when the user clicks on the "You have no antivirus, click here to get one installed, numbnuts!" red shield.

You know, something like:

1. Norton: $x/year
2. McAfee: $x/year
3. AVG: $x/year
4. AVG Free: Free!
5. Microsoft Security Essentials (Recommended): Free!
6. I have my own choice of antivirus that I will install.
7. I have my own antivirus already installed that you do not recognize, and I will monitor it myself.

Add whoever else you like to that list.

Re:Or...

[mcgrew]

Yes, true, and I thought it was brain-dead stupid. AV should be part of the OS, a web browser should not.

Re:Or...

[Anonymous Coward]

To be honest, if a user has an AV scanner, then gets a popup saying that their AV failed, then it probably did.

Re:Or...

[Oxford_Comma_Lover]

> The thriving market for fake AV scams simply means people are too cheap to pay full price for a commercial AV scanner, or too stupid to find a legit free one. Computers are appliances to 90% of the world's population, and no other appliance requires expensive upgrades to determine if it's being misused. Even without a car alarm, you'll notice if your car isn't where you parked it, but a most infected computers don't advertise as such. People know they need an AV scanner, and hey, the computer just offered them one, "Score! No need to go shopping for one!" All viruses (that aren't autonomous worms) spread based on misplaced trust or greed, and getting a cheap AV scanner appeals to both instincts.

No, that's not how they work--they don't advertise themselves as being a cheap competitor and people find them somewhere, they advertise by taking control of your computer and popping up a warning saying you have a billion infections and would you like to pay for their service to uninstall them. To someone who doesn't know the three hundred programs their computer is preinstalled with or how any of them work, that's potentially believable because they don't know any better. It's like following a road, being stopped and paying a toll, and only finding out later that the toll was a fake. If you've never driven the road before, how do you know the difference?

Re:Or...

[mywhitewolf]

as long as people have the option of installing other browsers / AV, there shouldn't be an anti trust issue? its like people complaining because windows comes with an inbuilt firewall because that's anti competitive for Firewall companies.

Re:Or...

[mcgrew]

its like people complaining because windows comes with an inbuilt firewall because that's anti competitive for Firewall companies.

Agreed; a firewall should be included with the OS. If MS had included a firewall and AV with the first network-capable OS, nobody would have complained of antitrust. AV vendors and firewall vendors for Windows wouldn't even exist unless they had produced a better firewall and AV than MS.

Had MS included a web browser with Win 95, there would have been no antitrust issues with IE and Netscape. Bur MS didn't get into the browser business until they saw Netscape making money.

What planet has the submitter been living on?

[timestride]

Seriously. This has been going on for YEARS. Why is this being posted here?

Re:What planet has the submitter been living on?

[ByOhTek]

There was a huge news rush several years back. Slashdot is just trying to catch up.

Re:What planet has the submitter been living on?

[Frosty Piss]

Seriously. This has been going on for YEARS. Why is this being posted here?

Because eWeek wanted to shill a "story" here to get page views?

Re:What planet has the submitter been living on?

[Anonymous Coward]

That's the very first thing I thought when I read the article. Someone's been living under a rock.

Ugh

[bonch]

I've had to clear a few of these off co-workers' machines this year. Running Windows 7 with the latest security patches and legitimate protection software installed, and people still get infected with this crap, so it's the users installing it and not just holes in the system being exploited. The last one I removed actually replaced the Windows shell on startup with itself, disabling web browsers, regedit, and other key system software. I felt like going on a shooting spree.

Re:Ugh

[tverbeek]

Is it too late to require people to learn how to use these devices properly before they're sent zooming along the information superhighway?

Re:Ugh

[bonch]

I don't blame them at all for installing the malware. In the case of the last cleanup I did, a web page apparently displayed a window that was made to resemble a Windows security alert. I think the solution is better computing environments, such as iOS, leaving the technical environment of a desktop PC to technical individuals who require it. Why should someone run Windows if all they do is word processing or web browsing? As Steve Jobs put it, today's PC environment will eventually be like pickup trucks. Not everyone will have one, but those who do will have specific needs that demand one.

Nobody here is a better person than anyone else just for knowing how computers work. I'm sure you wouldn't enjoy taking your car into a shop and overhearing the mechanics mocking you for not understanding some complex aspect of your automobile's combustion process.

Re:Ugh

[gad_zuki!]

>so it's the users installing it and not just holes in the system being exploited.

Are you sure about that? The analysis of various crimepack stats posted by Brian Krebs shows that the vector for these infections is usually (in order) Java, Adobe Reader, Flash, and browser exploits. So lets assume you patched these machines using Windows Update. That means you patched any known browser exploits, but the malware writer can still try various Java, Reader, and Flash exploits.

I think the real issue currently is how poorly these app updaters are written. Reader may never ask to do an update unless you manually start it once to install the current version of Adobe Updater. Java, depending on the version, either sits quietly in the tray asking for an update or never bothers. Flash asks at startup sometimes, but it may only update IE, but not Firefox.

For end users who have no clue, which is most of them, these apps should just be set to auto-update without asking. Admins and power users can edit this as needs be. In the meantime, its pretty trivial to infect a machine. Almost no one makes an effort to patch these apps.

I don't believe the problem is PEBCAK as we like to think. Browser plugs are a serious issue. They're just not being updated.

Re:Ugh

[delinear]

Only when it hits them financially - maybe if banks offered better rates or incentives to people who had passed some kind of basic internet competency exam, we'd see people making the effort to educate themselves (or lots of people falling for fake competency exam scams).

Re:Ugh

[hedwards]

I've suggested that in the past and been accused of being elitist. That's how driver licensing came into being. Having people driving around at a whopping 8mph with no other vehicles on the road didn't really require much in the way of regulation. But now that vehicles have to be able to do at least 30 mph in order to cope with even side streets we now license just about all of them. Bikes and mopeds excluded.

Likewise, I think that requiring people to be able to install anti-malware and update their computer is a pretty reasonable minimum requirement. It doesn't really take a lot of time to test for, and would cut down significantly on the amount of trouble on the net. Perhaps a couple other things on top of that, but you don't need to test much more than that.

Re:Ugh

[hedwards]

I don't believe the problem is PEBCAK as we like to think. Browser plugs are a serious issue. They're just not being updated.

To an extent you're correct. The technology has gotten to the point where all sorts of things can be infected and you don't have to download it explicitly to get infected.

However, sandboxing, antivirus software, not clicking on suspicious links and keeping the OS updated is more or less mandatory for anything resembling a secure browsing experience.

Re:Ugh

[Voyager529]

My mechanic gets plenty of money from me not knowing the ins and outs of my exhaust manifold. However...

-I do know what oil my car takes and how to change it myself. I may not always change it myself due to time constraints.

-I know where my spare tire is located and how to change it if I'm stuck on the side of the road.

-I have a cursory idea as to what the major components of my car do, so when he describes what the issue is, my eyes don't glaze over.

-When I do get a 'check engine' light, I make a mental note of what was happening immediately before the light came on, if there is any change to the feel of driving, call my mechanic as immediately as possible to provide as complete a description as I'm able, and cancel any optional engagements until my car has been repaired.

As for why people have desktops when all they do is web browsing and word processing, the answer goes something like this: most people have at least one or two additional tasks that they do besides the core web/office jobs, except they completely forget about them when buying a computer. "Word and the Internet" was all anyone who walked into Staples ever did when I asked them, but as it turned out, these people also used Quicken, downloaded photos from their digital cameras, uploaded videos onto Youtube, and several other tasks that I had to remind them of. Plenty of them play Bejeweled or Diner Dash on Facebook. specialized, low-use computing environments have their place, but the iPad's success doesn't necessarily mean that it's the death of the desktop.

I don't think people are idiots for falling for a fake virus window that does look a lot like some commercial ones. I've seen a handful that were "norton yellow" and used similar fonts. I can't blame them for that - what I try to do is to have a screenshot of what their virus scanner's "infected" window looks like and put a copy of the image on their desktop. "If you're not sure, open this picture and compare them". This has helped many.

The people I *do* think are idiots are the ones who don't display even the slightest amount of common sense:
"Chase sent me a text message asking me to call them about an issue with my account!"
"do you have an account at Chase?"
"...no."
*facepalm*

Or its slightly-more-forgivable cousin:
"Chase sent me a text message asking me to call them about an issue with my account!"
"do you have an account at Chase?"
"yes"
"Okay, well, did your last bill indicate a problem?"
"no."
"Then may I suggest calling the customer service number on the back of your debit card and asking them if there's a problem?"
"but the number is different than the one in the text message!!"
"Exactly. If it's legit, the people you'll talk to when you call the number on your card will transfer you there. If it's a scam, they'll inform you as such."
"I don't want to take the chance. should I text them back?"
*facepalm*

I know I've said dumb things to my mechanic, but I trust him more than a poorly worded text message.

Re:Ugh

[gad_zuki!]

Who is sandboxing? Sure IE by default runs in protected mode, but the plugins I mentioned do not. Suspicious links are meaningless, these exploits do no require visiting some odd link. Most of these hackers take over ad servers and push malware in ads on legitimate sites.

AV sofware is also useless. These guys are compiling multiple versions of their malware per hour. Your AV can't keep up. By the time the AV vendors have a signature its 12-48 hours too late and that build is removed from production.

Remember, we're talking out of the box security for end users - they're not downloading VMware and loading VMs or using sandboxie. We need better out of the box security. Plugin writers need to have auto-update running daily without user intervention. Expecting the end user to run all these apps and go to Help > Update is a failed strategy.

Re:Ugh

[Theoboley]

Along those lines, I was out of town one weekend, and my cousin messages me over Facebook saying he received a refund check from PCMall.com or some computer component website in the amount of like 1500 bucks. I called him shortly thereafter and asked him 2 things, "did you cash it?" And "Have you ever bought anything from PCMall.com" He answered No to both questions... He did tell me, however, that he went to the police, and asked them if it seemed legitimate. The cop took a quick look at it, and deemed it "Legit to cash"

I laughed at that statement and then offered my rebuttal... "CJ, You haven't shopped there, and they're sending you a "refund check" for something you've never purchased... doesnt this throw a red flag somewhere?"

Common sense says if you haven't shopped there, or signed up for any contests, then obviously it's a scam. He tore up the check.

Re:Ugh

[Anonymous Coward]

On the contrary, I would love to take my vehicle into a shop where the mechanics are so knowledgeable about their craft they make inside jokes about known issues between models, even if it's at my emotional expense. It beats the hell out of a place where they'll loosen your belt a few notches while changing your brakes to get "return" business...

Re:Ugh

[FrankieBaby1986]

Not to mention Java shit's all over your Add/Remove programs list with "Java update 10, 11, 12, 13, 14, 15, 16...:. I mean, really? WTF?

Re:Ugh

[dwinks616]

I don't believe the problem is PEBCAK as we like to think. Browser plugs are a serious issue. They're just not being updated

So how the hell is failing to properly update one's computer NOT PEBCAK? Here's a car analogy: that's like saying it's not the owner's fault when cars seize up due to never having the oil changed. If one installs crappy insecure software such as Java, Adobe-anything, etc, and doesn't keep it updated and run routine virus scans to keep the possible damage from exploits to a minimum, one deserves what one gets. It's actually a shame these people aren't getting scammed out of more than just $30-40. Let these idiots get taken for a few thousand each and they'll wise up pretty quickly...either that or not have enough money to keep a computer and internet access. Either way, they are no longer MY problem.

cue /. superiority complex...

[kj_kabaje]

cue /. superiority complex... Seriously, rather than tag as !news or PEBKAC, how about some intelligent discussion about either educating the general public or another more intelligent solution?

Re:cue /. superiority complex...

[Monkeedude1212]

how about some intelligent discussion about either educating the general public or another more intelligent solution?

We did that about 10 years ago when this story was fresh.

We've been doing that for the past 10 years. And we've decided that PEBKAC.

My idea of an intelligent solution is an infectious antivirus - spreads like other viruses do, via email, poisoned URLS, phishing, etc etc - use all the vulnerable vectors you can to spread an antivirus. It goes and tries to remove any viruses it can find and occaisonally calls back to some central server for an updated list on new threats and how to combat them.

Not a perfect solution, but I think we need to start fighting fire with fire.

Re:cue /. superiority complex...

[Tarlus]

cue /. superiority complex...

Wait, I know this one! *Ahem*...

Pffft. I never have to deal with these sorts of things on my Mac/Linux/BSD computer!

Did I do it right?

Re:cue /. superiority complex...

[Sockatume]

I read an argument recently (maybe on Language Log of all places) that this was an example of intelligence being disadvantage. Having a general awareness of the threats represented by viruses is a requisite for vulnerability to the scam, while someone completely ignorant of computer threats wouldn't be susceptible. Sort of the scam-art equivalent of the uncanny valley.

Re:cue /. superiority complex...

[takowl]

Plus patching any known security holes? Interesting idea. I think the trouble is funding/motivation: both virus and antivirus writers usually do it for profit, and it would take time and effort to keep it up to date. Since it would be, at best, dubiously legal, it probably couldn't be sponsored by any company, so it would have to be a guerilla effort. And the people who could write it mostly wouldn't benefit (except perhaps that they'd spend less time cleaning their families computers...).

Re:cue /. superiority complex...

[Anonymous Coward]

Superiority complex? How about people refusing to learn from the last time, and the time before that, and the one before that, and before that, and the last 18 before that, and the 55 before that?

We had PC viruses spreading in the days of 5 1/4" floppies. We've had online viruses for 15 or 20 years now. This is not a NEW thing. If people, by 2010, haven't figured out that it's a bad idea to run random shit, then yes, they deserve what they get. It's time to stop trying to help them. They have NO desire to help themselves.

I know; I have tried. Really I have. Repeatedly. I've disinfected people's machines, tried to explain to them what they did and how to avoid getting infected the next time. The eyes glaze over when I explain in simple layman terms how they got infected, and in two weeks they are back in the same boat. I'm done trying to help people who refuse to help themselves. It's called "enabling behaviour" in psychological circles: when someone acts in a self-destructive way and you go clean up after their mess every time. It just lets them avoid accepting that they have a problem *THEY* need to fix.

It's 2010, folks. Malware is not some surprising new thing that nobody ever heard of.

Re:cue /. superiority complex...

[Anrego]

Dunno if I agree with that argument.

Most scams are pretty good about educating you on the product .. it's part of the scar tactic:

There may be a VIRUS on your computer.. RIGHT NOW!

A VIRUS can DELETE YOUR WORK or STEAL YOUR PRIVATE INFORMATION!

Here.. let me check if you have any..

Yup.. found a whole bunch... the following files are currently infected AT THIS MOMENT:

C:\My Documents\
C:\System\
C:\Windows\

Don't worry though.. download MakeThisGoAwaySoICanGetBackToFarmville.exe to fix the problem. You'll probably see this security warning:

[image of the dialog that is supposed to warn the user of stuff like this]

Just click "run" and we'll fix things right up for you!

Re:cue /. superiority complex...

[bonch]

We did that about 10 years ago when this story was fresh.

Oh, shit, we talked about it on Slashdot 10 years ago? Well, that settles it, there's simply no excuse for the public not reading Slashdot 10 years ago. Stupid people!

Re:cue /. superiority complex...

[Anrego]

Wow.. thats some bad typo action, even for me!

* Most scams are pretty good about educating you on the threat.. it's part of the scare tactic:

Re:cue /. superiority complex...

[Sir_Sri]

How about just letting MS put security essentials onto your computer as part of regular windows updates? You could even set it up to remove fake antivirus products automatically. And if it accidentally breaks a legitimate one, at least you have MSE on there, which may (or may not) be as good as whatever it removed but it's better than millions of people with fake AV's.

Or how about a walled garden security store in windows? If you want access you have to be approved for the national app store by the government (not MS), but then your software has to be both legitimate, and actually show up, you get the benefit of exposure and the consumer gets the benefit of legitimacy and working updates. The EU basically showed us how to do this with web browsers, security software is just as important, and if you do it pre-emptively you can avoid anti trust issues. To some degree this goes to the whole idea of security certificates, since you shouldn't be able to install an AV without a valid security certificate, assuming they can keep said certificates clean.

For all of the many (many) things wrong with microsoft, good security rules should acknowledge they happen to be in the majority right now, and we have to deal with the problems on their platform in the most consumer friendly and secure way possible. If that means that some boutique AV vendors get screwed, that's still preferable to the constant parade of broken norton installs and fake av programs out there.

Personally I have both avast and MSE. Avast messes with Opera a bit, but otherwise I'm quite happy with it. But MSE seems a bit better at catching stuff it doesn't.

Re:cue /. superiority complex...

[vlueboy]

Besides the null legality of infecting PC's with legit antivirus software for the greater good, there is a secondary problem.
Any tech-savvy user with their own AV solution, will most likely see their PC acquire a second set of system-hogging antivirus software. Ever installed two concurrent firewalls on your PC and saw that neither one complained? Yup, don't expect coders to make the right assumptions.

You might instead have chosen to stop using ANY antivirus --then you get mad this virusy antivirus has to keep being removed over and over to free your PC. If coders create a an opt-out flag for your registry so the AV will run and not force itself upon you, then we all know real viruses will be the first ones to set it to "true" to actually avoid getting removed. So then the AV writers would have to counter by forcing a full virus check on both the conscious-antivirus-avoiders and the unsuspecting infected users, to play it safe before the software decides it needs no further cleanup action on the avoiders' PC. And then virus writers could just kill that would-be helpful scanner and prevent the real legal-and-virusy-AV's install anyway.

Where does the war really stop?

Re:cue /. superiority complex...

[Anonymous Coward]

Typos don't really matter as even legitimate software has them.

On the other side, this is an unfortunate money-maker for me. I freelance support locally and get quite a few calls from folks who refuse to believe someone on the 'net would try to scam them. As a result I carry the newest copy of Malwarebytes wherever I go, and others as well.

One client had already made the phone call. Address listed in East Bay, phone was 866-something but the phone records listed Nigeria as the destination and the credit cards were charged in Russia, no kidding. While I was scrubbing her PC I told her to call the bank; poor lady cut up her cards in front of me.

It's a powerful social message, and it doesn't help that the message style mimics some popular anti-malware programs' appearance. The best defense after inoculation is indoctrination: Don't Click That!

Re:cue /. superiority complex...

[hedwards]

That's an extremely bad idea. At the end of the day it would end up being exploited by crackers and in the best case it would give people the idea that if they don't secure their computers that somebody will do it for them.

In some parts of the world, they do things like that for lawns. If you don't mow your lawn frequently enough, the local council will have somebody do it for you, then send you a bill for the work. Not saying, I agree with it, but it does work. In meatspace, on the net, there's any number of ways that sort of thing would go wrong.

Re:cue /. superiority complex...

[hedwards]

I think you forgot to point out something about Netcraft confirming it.

Re:cue /. superiority complex...

[cratermoon]

Natalie "hot grits" Portman has to be involved there somehow, also.

Re:cue /. superiority complex...

[Monkeedude1212]

Any tech-savvy user won't be infected by the antivirus anymore than they'd be infected by a regular virus. That's the beauty of it.

The great thing about it is that even if it annoys you that you keep getting infected by it - you can at least rest knowing that its not trying to steal your information, you're safer battling to get the antivirus off your machine than you would be battling to get a regular virus off your machine.

Re:cue /. superiority complex...

[Monkeedude1212]

That's an extremely bad idea. At the end of the day it would end up being exploited by crackers and in the best case it would give people the idea that if they don't secure their computers that somebody will do it for them.
 

People already have that idea. That isn't giving it to them, its already there.

We have been trying education for years now, but users are still falling to terribly bad email scams.

The answer is going to have to be something that requires no work on the part of the user. You can't fix stupid, no. You can't stop someone from entering their credit card on a fake website if they are silly enough to fall for it. You CAN however stop them from landing at those places.

Re:cue /. superiority complex...

[wondafucka]

cue /. superiority complex... Seriously, rather than tag as !news or PEBKAC, how about some intelligent discussion about either educating the general public or another more intelligent solution?

Let's take educating the public off the table. Fools are the greatest user segment. I hate to say it, but Apple's walled garden sounds really good when it comes to my family and never having to clean their computers again.

Re:cue /. superiority complex...

[Anonymous Coward]

cue /. superiority complex... Seriously, rather than tag as !news or PEBKAC, how about some intelligent discussion about either educating the general public or another more intelligent solution?

Or how about some responsibility on the part of the user? There are many things we do on a day-to-day basis that we need to be responsible about. Go to a gun range and you're expected to know how to handle your weapon properly. Drive a car and you're expected to know how to change lanes, use turn signals, keep your high beams off when there are oncoming cars. Go to a public bathroom and you take minimal precautions not to drape your junk on the seat or touch the yellow puddles.

It's not up to us to educate. It's up to the people using the machines to get educated. Do not shift the responsibility to our already burdened shoulders.

Re:cue /. superiority complex...

[vlueboy]

Any tech-savvy user won't be infected by the antivirus anymore than they'd be infected by a regular virus. That's the beauty of it.

You're right!

Still, any legit company in the US spreading like this will end up sued and losing, and threatened overseas like Blackberry was a couple months ago.

Why? it takes a few short years of "do no evil" for a closed-source company to get greedy and make you re-evaluate using their stuff --see Google in 2010.

Re:cue /. superiority complex...

[Wildclaw]

or another more intelligent solution?

Using Antivirus programss is like fucking without a condom, blacklisting any registered sex disease carriers. Sooner or later you will catch something.

If you want actual security, you restrict program (not user) access with sandboxing of some kind or another. Of course, most people on the Internet are like horny teenagers and can't be bothered with the trouble of using real protection. And operating system manufacturers are more worried about if you have the rights to fuck someone than how safe the actual fucking is.

Re:cue /. superiority complex...

[Schadrach]

MSE will never be part of standard windows installations, because they'd get sued for antitrust in the same exact way as happened with IE. I do wish the red shield icon from the "Security Center" would at least have a "Click here if you would like to install MSE" on it, if only to get more people protected with something rather than Antivirus XP'ed.

Re:cue /. superiority complex...

[Culture20]

We had PC viruses spreading in the days of 5 1/4" floppies. We've had online viruses for 15 or 20 years now. This is not a NEW thing. If people, by 2010, haven't figured out that it's a bad idea to run random shit, then yes, they deserve what they get.

Some people, old and young alike, have only recently started using computers and aren't aware of the virus back-history that we know beyond a cursory "here be dragons" mention in the newspaper or television shows.

Re:cue /. superiority complex...

[Anonymous Coward]

Any legit AV-software should be able to stop the "self-installing anti-virus". If it can't then it's not doing its job and is unlikely to stop other virus. I agree that this practice is illegal, but I think it's morally defend-able, people who cannot look after themselves needs to be looked after.

Just alert the AV-companies that you will be rolling out soon and let them protect their costumers if they can.

really?

[ace418]

If "security-conscious intenet-users" are falling for this, are they really security-conscious? For quite a few years now, Geek Squad's (and any other pc repair company) prime customers are people who fall for these types of scams. This is nothing new, except to the writer of this article.

Exploitation of fear.. who'd a thunk?

[countertrolling]

Fake AV scams say a lot more about the present state of the market economy and human psychology in general. Attempted fraud is an essential if you desire infinite growth through consumer debt.. A game of cat and mouse, like many things in nature.

Re:Exploitation of fear.. who'd a thunk?

[bonch]

It also says a lot about the security design of the operating system. Many of the scareware programs mimic Windows security alerts, so users who believe they are being security-minded by going along with the prompts are actually infecting themselves.

It's a pavlovian response

[Flipao]

You gotta give it to companies like McAffee, Symantec, etc... they know how to scare people into handing over money so they are "protected". It was only a matter of time before people started to copy their methods.

Re:It's a pavlovian response

[Lunoria]

Not really. Most people know they need an Anti-virus scanner, so if a website tells them they can download one for a small fee, they will. It's no different with auto repair shops. If people don't know enough about the subject, they are usually ripped off. The AV scams are simply harder to stop, because most of them aren't locally.

Re:It's a pavlovian response

[Sockatume]

The scam isn't merely getting them to pay for un-needed antivirus software, it's installing a trojan which enables them to grab people's bank details.

Re:It's a pavlovian response

[Flipao]

Most people have been led to believe they need an Anti-virus scanner

Fixed that for you.

so if a website tells them they can download one for a small fee, they will.

There's a difference between telling someone they can download an anti-virus scanner for a small fee and throwing an ominous looking pop up window saying something along the lines of "YOUR COMPUTER IS ABOUT TO GET INFECTED AND SOMEONE WILL STEAL YOUR BANK DETAILS YOU SHOULD PURCHASE OUR ANTI-VIRUS NOW OR ELSE".

Here is a good example

Re:It's a pavlovian response

[delinear]

If people know they need anti-virus they must know it's a pretty stupid idea to pay for it on a machine that's currently compromised. I know absolutely nothing about cars, but if someone told me my break line had been cut (even if they were scamming me) I'd know enough not to drive to the garage to get it fixed. If you seriously thought your PC was unprotected and you still went ahead and entered your credit card details, what would you expect to happen? Is it so much hassle to go to the store and get an AV package, or ask a friend/relative to order you a copy?

there is no technical fix for stupid.

[Anonymous Coward]

At the end of the day, the computer obeys what you tell it to do. If you tell it to do stupid shit, it's going to do stupid shit.

The fix for this problem is not technical, it is social.

Re:there is no technical fix for stupid.

[Lumpy]

100% correct.

I solved it with relatives. They are given an ultimatum.

"You use This OS or follow my list of requirements or you are on your own."

The Relative that follow my demands have a great time. the ones that dont, cry for help at holidays, but refuse to change their ways so I do not help.

"Sorry Grandma, you wont stop downloading warez and clicking on every link you find posted on 4chan... You are on your own. Stop calling me a Tool grandma...I'm not going to help."

Re:there is no technical fix for stupid.

[tverbeek]

Mod parent up.

Re:there is no technical fix for stupid.

[Anonymous Coward]

Your parents must be proud.

Re:there is no technical fix for stupid.

[QuantumBeep]

As it turns out, you actually are a tool. I fix my grandma's malware infection because I love my grandma.

Re:there is no technical fix for stupid.

[Anonymous Coward]

I think his grandma is pretty cool, she clicks on all the links and aren't afraid of anything.

And he shouldn't piss her off is she's part of the notorious hacker group "anonymous"!

So, uh...

[Anrego]

This article really was an eye opener!

Who would have thought that a large percentage of windows users are not technically inclined and easily tricked by scary looking windows!

Rumour has it that scissors can be fairly sharp, and fire is damn hot sometimes.

Also.. _really_ old news. This scam has been around for at least a decade. It followed closely on the success of the "YOU HAvE ONE URGENT MESSAGE" banner ad.

Re:So, uh...

[Sockatume]

I think the cold-calling aspect is relatively new, no?

Re:So, uh...

[Anonymous Coward]

Posting anon because I already moderated.

Let's make it a large percentage of computer users are not technically inclined. It equates to the same thing because of the prevalence of Windows on the desktop.

But what happens if Linux were to miraculously explode in popularity so that these same users were now using Ubuntu or Fedora (name your distribution)? They're still going to be technically unaware, still easily tricked, and still prone to doing the same "uh-oh, I'd better type in my password because it asked me to" trick. You don't see it now because, as people rightly point out, why try and scam something which is not going to get you a big audience? But if that ever changes...

Re:So, uh...

[Anonymous Coward]

Yawn.

Re:So, uh...

[Anrego]

Totally agree, and infact I've argued before that Linux in the hands of someone less technically inclined can actually be _less_ secure than windows in some ways.

Linux provides a lot of flexibilty, has a powerful command line, and has pretty standard tools for remote administration.

To someone less technically inclined, a command that gets your video card working in ubuntu doesn't look much different than a command that used netcat to open up a call-back style back door.. giving someone dirrect shell access to your box.

And of _course_ you run the command as root.. because fixing a video card is an administrative task!

If linux was mainstream, I have no doubt you'd probably see a lot more of this sort of thing.

The "trick a user into doing something" style attack is definitely universal.

Crazy

[falldeaf]

Windows malware is getting insane... I don't run as admin *ever* and I don't use IE so I keep pretty clean but some *really* nasty stuff has gotten through. People love to say PEBKAC and all but with some of these programs, I wouldn't be surprised if a seasoned computer person got fooled let alone a casual user. The last one I had faked a freaking bluescreen pretty convincingly, even...

P.T. Barnum said it best...

[Lumpy]

“There's a sucker born every minute”

Sorry, but this will NEVER go away. It's not new, it's been around for 80,000 years.

A news flash that people are easily suckered is not news to anyone.

Nothing new but certainly worth bringing up

[Anonymous Coward]

I work at a small computer shop and killing these things is at least 75% of the work I do. They are everywhere. Norton and Mcafee have done a fine job of making people believe that their antivirus will make them invincible and that they should believe anything that pops up on their screen talking about viruses. It's like saying "OK!" to a guy that pops out of a bush and says "OMG you have swine flu! Quick, swallow this pill!"

AV companies scare their customers

[benjfowler]

Colour me surprised.

I recently had to install Windows 7 at home, and decided to put Norton AV on my machine. I boot up on Windows roughly once every couple of weeks to run a specific application. So I notice Norton AV popping up loads of windows, running it's intrusive update process about bombarding me with scary looking crap prompting me to read about the "latest security threats from cyber-criminals". Hair-raising stuff, especially if you're not a computer specialist.

I'm an IT professional, and _I_ find this behaviour sleazy, unethical, annoying and slightly alarming. This is a product I paid GOOD MONEY FOR. I'm PAYING to be bullied, essentially.

So I can just imagine the average user being bullied and terrified by this crap... which is not only enriching the AV vendors, but also making regular folk like lambs to the slaughter for the forces of evil out there.

I'd say that the consumer, criminals and the AV companies are really inhabitants of one ecosystem: prey, parasites and predators respectively.

Re:AV companies scare their customers

[Rude Turnip]

I've been loving Microsoft Security Essentials for about a year now, after AVG started getting Norton-esque. It's the first AV program since AVG 7.x to actually be lightweight and out of the way.
Do not get me started on McAfee sucking down the runtime on my work laptop...

Re:AV companies scare their customers

[vlm]

This is a product I paid GOOD MONEY FOR. I'm PAYING to be bullied, essentially.

They're stealing the patented business patented model from the airlines!

Re:AV companies scare their customers

[spyingwind]

Tan("Where I work, 4 man IT shop w/ 50+ users, we have Norton SAV installed on ever PC. Server pushes updates. User's never see the update screen. Now that's the enterprise version, clean, not to clunky. Now just take the same software for a single home user. What do you get? crap... What happened to the good old days of a non-colorful gui? I never had installed an antivirus up until M$ update popped up an optional update with SE's. It does a decent job. I had to exclude some of my tools from its "bad hacking tools" list. I won't touch another XP machine again");

Re:AV companies scare their customers

[Anonymous Coward]

Colour me surprised.

I boot up on Windows roughly once every couple of weeks to run a specific application. So I notice Norton AV popping up loads of windows, running it's intrusive update process about bombarding me with scary looking crap prompting me to read about the "latest security threats from cyber-criminals".

I'm not sure what version of Norton it is you're using, but 2010 and 2011 update silently in the background without alerting the user. The only pop-up I can think of is the 'Monthly Report' thing, but you can turn that off in Norton's settings.

Re:AV companies scare their customers

[Anonymous Coward]

Anti virus companies like Symantec isn't marketing Norton for IT professionals, techies or the majority of slashdot readers. They are designing a product for people that no nothing about computers, and its simply because that is the majority of their customers.

Imagine how many phone calls Symantec support gets with customers asking why they got a virus on their machine when they have paid Symantec $40 a year for a product that was supposed to "protect them?"

You can't fix stupid, but you can try to mitigate it as best as possible.

Re:AV companies scare their customers

[Anonymous Coward]

I know people That were so scared by norton FUD that they actually went on the internet and manually downloaded 2 or 3 other fake AV products so they were 'more secure'. I had to contact norton in these cases to save their subscription and in EVERY CASE they said 'see? you need more protection', as if it was policy.

Re:AV companies scare their customers

[gcatullus]

Security Essentials even seems to be more effective than AVG

Re:AV companies scare their customers

[DeadboltX]

Sorry, but your story doesn't add up.

You claim to be an IT professional, but you willingly decided to put Norton on your own machine?

Re:AV companies scare their customers

[Anonymous Coward]

You just *had* to install Windows 7. You are a user.

Re:AV companies scare their customers

[benjfowler]

[rimshot]

I know AV is worthless, but it's still better than going naked. I had a legal copy of it lying around, so I went with that. Otherwise, I might've reached for something a bit faster and more reputable, e.g. Sophos, Kaspersky.

Re:AV companies scare their customers

[benjfowler]

Actually, a developer stuck with antiquated tools that shackle me to a Windows development environment. Not everybody gets their choice of OS. At home, apart from work, I avoid that shit completely.

Re:AV companies scare their customers

[Anonymous Coward]

hmm, I thought the article was talking about Norton... it's pretty much a fake anti-virus.

Re:AV companies scare their customers

[BuhDuh]

I have ran Norton Internet Security since the 2009 incarnation, with generally OK results [I'm a 40-year IT veteran and was curious how a "big box" suite would perform], but when I got the pop-up pushed at me to upgrade to 2011, I was appalled to see that it refused to install unless I uninstalled Threatfire, which it deemed to be "incompatible" - that's it; no other option, no explanation, just uninstall, "trust me, I'm Symantec and know best." Guess who will NOT be renewing their subscription in 24 days? What's the difference between "Security Toolkit" [as an example] telling me I have BAD STUFF on my system, and this?

Re:AV companies scare their customers

[doesnothingwell]

AV companies may scare their retail customers, but the corporate client versions are mostly silent. Funny they never expire either if they are installed unmanaged. My antivirus hasn't asked for anything for over 8 years.

Tell grandma she's a corporation now and not to worry.

Re:AV companies scare their customers

[Rude Turnip]

Hopefully, you would think that Microsoft knows how to address their own security issues. Oh, who am I kidding?

Re:AV companies scare their customers

[QuantumBeep]

You're right. That IS a tangent.

Re:AV companies scare their customers

[QuantumBeep]

You're right. Symantec seems to be slowly getting it together.

Too bad that only leaves us at "slightly less bloody horrible than before".

Re:AV companies scare their customers

[cbhacking]

I'd say a large portion of this is your choice of AV. Symantec's consumer line has been crap for about a decade.

That doesn't solve the problem for people who don't know any better, and it certainly doesn't exonerate Symantec's bullshit, but they're not all anywhere near that bad.

Re:AV companies scare their customers

[Lanteran]

Good security practices are infinitely better than norton. A computer crawling with malware is also infinitely faster than one infested with norton AV.

...from the trenches

[neogramps]

From what I can see, working at a helpdesk with a userbase of ~30000, these are on the rise again, and in the last 2 months, I've had several infections which failed to be picked up by MSE, Avast, Spybot and Sophos. This year I've had at least 1-3 infected machines a day, 5 days a week, and 90% have been the fake-av variety. They are also getting more sophisticated recently, doing more and more damage, creating local proxies, adding in rootkits, hiding in system files (instead of user profiles). So while fake-av's are old news, they are the malware of choice at the moment, and their visibility means a larger number are detected (unlike traditional malware, which Jo Bloggs fails to notice)

They Pay?

[BradleyUffner]

I love the fact that they actually get the people to PAY to infect their own computer. That's simply brilliant.

Re:They Pay?

[John Hasler]

That's because these consumers know better than to trust anything free. "You get what you pay for", right?

Re:They Pay?

[arkane1234]

You have to be saying this tongue-in-cheek...

They're phoning us to tell us we have a virus

[Anonymous Coward]

... about 4 times in the last month, someone calls us (UK) from an international number saying the computer has a virus.

The summary doesn't give much weight to it, but that's the newer news here, that there are call centres set up just to do this...

Re:They're phoning us to tell us we have a virus

[Tapewolf]

I've had three of these now. I'm not sure how I would have reacted if I hadn't already read about this practice on The Register some months ago, but it's interesting nonetheless.

First time I humoured him for a little bit, told him that I wasn't running windows on any of my systems. When he started asking what OSes I was running, I ran off part of a list, then decided that it wasn't really his business anyway, told him so and hung up.

Second guy that tried it asked specifically about my Windows computer. This time I just laughed and put the phone down.

The third one got about that far at which point I again hung up. I do wonder if I should play along next time and ask him to confirm my IP address. As I understand it, the basic idea is to install LogMeIn or some other remote desktop software on the victim's machine.

http://www.theregister.co.uk/2010/05/07/scamware_cold_calling/

Free isn't Easy

[cheesethegreat]

To be fair, it's not exactly easy to find a legit free AV programme. Downloading my poinson of choice, AVG, for example, requires you to navigate through the website, locate the tiny "free version" link on a series of pages, and wind through and around a whole lot of annoying screens designed to baffle/frustrate/bully you into buy a pay version.

And worse, you then have to go through this whole process again every six months when they release a new version that isn't covered by the auto updater.

I definitely consider the behaviour of companies like AVG to be partially responsible for people getting confused, frustrated, and resorting to less legitimate means.

Re:Free isn't Easy

[Anonymous Coward]

Who the hell still uses AVG, they're just as bad as the big names now. Check out Avast

Re:Free isn't Easy

[mlts]

Avast! does the same exact thing.

Out of all the antivirus utilities, MSE does the job, does it right without prompting or harassing about subscriptions or registration, and is very lightweight.

Now, enterprise-level, I'd recommend something different, but for home users, MSE is licensed at no charge, and does as good a job as anything else out there. Best deal running, IMHO.

Re:Free isn't Easy

[The Yuckinator]

That, or you could just start at http://free.avg.com/ which does include attention-grabbing links for the paid version but also very clear and easy-to-find links to the free version.

Re:Free isn't Easy

[jp10558]

I find that Comodo is quite good about being really free, and it's not horribly difficult to find the initial install. It will generally install all updates automatically... And if you're clueless but not cheap, you can purchase remote support from them for a yearly fee that's equivelent to the big guys just for the software...

"Web-Users Fall..."

[Call Me Black Cloud]

This is why I use gopher.

Windows users fall for fake Anti-Virus scams

[Anonymous Coward]

There, corrected the typos .. :)

Another more intelligent solution?

[Alwin Henseler]

(..) how about some intelligent discussion about either educating the general public or another more intelligent solution?

History has shown that educating the public has little effect, if any. Therefore I conclude that if at any time a regular user has to make a decision about whether some software can be trusted, the method is flawed. Regardless of whether user would make the right choice or not. If a trust issue can't be decided automatically, software should be regarded as harmful & unsafe to run, period.

So any intelligent solution should focus on reliable ways to tell apart software from trusted sources (for example by using a community-maintained list of trusted vendors, and cryptography to verify downloads is genuine from one in that list), and limiting what software (trusted & untrusted) can do. Like: by default, very, very limited access rights to things like networking, persistent storage or user data, unless given more rights by administrator. For anyone that says it would cause too many warnings etc: can you explain why random game / app / desktop widget that a user runs, would need access to all user files? No idea? Yet strangely that's normally the case - sounds like a design error to me. Another example: when user selects a file to open, there's nothing stopping an app from discarding that selection & opening some other file instead (or open 2nd file behind user's back). Another design error, if you ask me - if there's an open file dialog, the apps' file access should automatically be limited (by the OS) to the user-selected file. There's many more examples like this.

Microsoft Security Essentials

[BudAaron]

That's one more reason I love Microsoft... They provide me with FREE antivirus software from a trusted source!

Re:Microsoft Security Essentials

[Pop69]

I cleaned 3 machines last week with fake anti-virus on them

http://www.softsailor.com/how-to/8723-how-to-remove-security-tool-virus-malware-removal-guide.html

All 3 machines had working and fully up to date Microsoft Security Essentials which did absolutely nothing to protect them.

Re:So, uh... / Believe it or not...

[RFSSystems]

Those fuckers are getting REALLY crafty! Case in point... As a software developer and PC repair tech, I've seen a lot of BS from both ends of the spectrum but nothing prepared me for a "virus" that was found on a buddy's PC a few weeks ago. We were sitting around coding our Quake III mod and the small "update shield" popped up in the taskbar. The bubble popped up and said that updates were available and he needed to install them... so he did. Bad choice, my friend! A few minutes later an "Avast" bubble pops up and says that a threat has been detected. He clicked the button to stop and within a few seconds, the PC shut down. Once he managed to reboot, there were at least 10-15 Firefox windows open (ads), numerous [fake] Avast bubbles, another update shield and a shitload of warnings and error messages. He got duped. They're getting good! Thank god I run Linux for nearly everything these days!

well...

[Anonymous Coward]

Personally I always advise against any kind of spyware or adware protection. The key is twofold: Don't download anything malicious. 2. Keep programs that interface with the outside world (such as your browser) up to date. If you follow those two things then you can't get adware or spyware.

Also , most spyware/adware protection I see tremendously slows down the computer systems they are loaded on. In addition they are simply not effective because if you execute a malicious program then it can get control no matter what protection you use..........

If you want to try out a program and you aren't sure about it then use a virtual machine and just run it in that sandbox until you are sure about it. I find virtual machines useful for doing that especially if it is for programs you will seldom use..

Oh wait this is slashdot.

My Mom fell for one of these, but on a Mac

[sjonke]

However, she is on a Mac, so I *presume* she is safe, except for her credit card number, which she did enter in order to buy the software. I told her to cancel her credit card and she did that and they issued her a new one. It is correct that she has no worries from the downloaded software, right? These things are always Windows-only, right? Just want to make absolutely sure. Or is there some way for them to hack her account given that she provided a credit card, and probably address and such?

Re:My Mom fell for one of these, but on a Mac

[mikestew]

It's really hard to make a determination remotely over a text-based medium, and there are way too many unknowns in your description. Yeah, she's probably safe. But do you want to find out the hard way that just recently the hackers have been hard at work learning Cocoa and Objective-C?

In the end, I guess you're asking what I, random /. user, would do. I'd wipe the disk and reinstall Mac OS, restoring from a Time Machine backup that I know was taken before Mom entered her credit card info. Half hour of your time, an afternoon of machine time while the backup restores.

No backup? (Seriously, dude, TB drives are $100US; show Mom you love her.) Copy off whatever pictures and documents you can, and nuke the machine from orbit. After you reinstall Mac OS, turn on Time Machine and point it to the new 1TB USB drive you just bought.

This is news how?

[Just Brew It!]

Fake AV has been around for a long time. My father fell for one of those "your system is infected" ads 5+ years ago, and I had to spend an afternoon cleaning out the crapware he bought and installed when he clicked through. Fortunately all he was out was the $40 or so for the "product"; we scanned his system with some real AV and anti-malware/spyware products to remove all the junk that piggybacked its way in, and nothing more ever came of it.

That's funny. But not true.

[professorguy]

Having a general awareness of the threats represented by viruses is a requisite for vulnerability to the scam, while someone completely ignorant of computer threats wouldn't be susceptible.

The pop up comes up and the completely ignorant doesn't click on "Install" because he doesn't have an awareness of the threat, so he clicks on "No thanks." Too bad that ALSO INFECTS HIS MACHINE.

The ones I've seen install on any client click. Only hard powering (hold the power button for 10 seconds) will prevent infection at this point, so the completely ignorant are NOT going to be safe.

Pretty easy to detect.

[formfeed]

If you have a lot of files ending on ".dll", chances are pretty high that you have software on your system that might be harmful.

Re:So, uh... / Believe it or not...

[Anrego]

Yeah, the scams have gotten pretty sofisticated. I guess "you're infected yo!" dialogs don't cut it any more, which may actually show that there's hope afterall.

The sad thing is, this is really the best payload you can hope for.. because it's obvious!

You know you've been infected and can re-install (or try to fix if you enjoy pain).

The ones that scare me are those that are less obvious. Say if instead of turning his desktop into a billboard, the virus simply dropped in a trojan. You're now part of your favorite botnet with probably no clue you've been infected.

NEWS FLASH

[sneakyimp]

Dumbasses world wide have been tricked into clicking malware! And--AND HERE IS THE MOST FASCINATING PART--the malware peddlers lie to the users, telling them that they are going to scan for viruses!

Re:So, uh... / Believe it or not...

[Anonymous Coward]

The other day the "You're currently running firefox 3.6.12, click here to update to the newest version" screen popped up in a tab while I was browsing. It was a near perfect replica of the official page, and it nearly caught me.

Rogue Gallery

[Lagurz]

Lavasoft has published a list of rouges that might be helpful when people see scareware. But, I guess, the only problem is make people look at this list before they buy security software
http://www.lavasoft.com/mylavasoft/rogues/latest

Ok, per your request... apk

[Anonymous Coward]

"cue /. superiority complex... Seriously, rather than tag as !news or PEBKAC, how about some intelligent discussion about either educating the general public or another more intelligent solution?" - by kj_kabaje (1241696) on Monday November 15, @11:28AM (#34231628)

http://www.pcreview.co.uk/forums/thread-3511888.php per your request, there's a topic on how to secure a Windows based PC as best as I know how to, point-by-point (15 of them), and, it works (because it goes into details of how malwares often work, what they use to get to you, and what you can do to stop them).

APK

P.S.=> I wrote the first model back as far as 1997-1998, for NTCOMPATIBLE.COM, & that's the "present day evolution" of that article on how to secure a Windows based PC (circa 2006-2008)... apk

Re:Ok, per your request... apk

[kj_kabaje]

Thanks. That Anonymous Coward fellow rotates between jack-ass and informative and insightful all in one thread. :-D

re: It's the users installing it

[King_TJ]

Actually, I'm not so sure it's always an issue of users installing this stuff voluntarily?

The "Vundo" trojan is supposedly a leading cause of automated installations of the annoying "AntiVirus 2009/2010" fake AV packages and other garbage.

(See: http://en.wikipedia.org/wiki/Vundo)

I recently cleaned this off of a PC for a client of mine, and in their case, the original trojan horse files were found embedded in the compressed Java runtime files. So at least some of this stuff may be coming from "drive by infections" that take advantage of security flaws in older versions of the Sun JRE. Once the trojan is implanted in the JRE, it proceeds to auto download and install this other stuff.

Browser designers are not reacting enough

[abigsmurf]

Malware developers are getting increasingly clever in how the social engineering techniques they use to get people to install their crap. Even people who are fairly competent can be tricked. Browser makers need to realise that there's far more they could do to prevent these kinds of social engineering tricks: 1: Make it clear what a confirm() (or the equivalent in other languages) box is trying to do. Is it trying to prevent you from leaving a page? Will it redirect you? Is clicking OK the safest thing to do? Clicking cancel? No? close window? They implemented something like this for a window.unload triggered confirm and but it doesn't inform the user that what they need to click to leave the page safely.

2: Don't make update notifications spoofable! Look at things like Sitekey for examples. inform the users that update windows will always contain a phrase/image that can't be obtained by malware authors on uncompromised machines so users will know something is fake.

3: Implement a halt all button. A single button that will disable all javascript (even if there's an alert box displaying) and forcefully halt and close every active plugin. All too often something will be caught by an antivirus but the script behind it keeps running and compromises the system anyway.

Mod points!

[Nursie]

I wish I had them.

Sorry, but a lot of folks are wilfully ignorant of computers and others are just incapable of learning about them properly.

I don't blame the incapable ones, they should be guided to a safer net experience on a Mac or something, where it's hard to screw up. The wilfully ignorant should be beaten in the streets!

Someone give these guys credit.

[drunkennewfiemidget]

They've invented a new system.

1. Write program to steal information.
2. ????
3. Profit!
4. Steal card information with said program.
5. ????
6. PROFIT AGAIN!

when will they learn?

[hesaigo999ca]

You buy your AV cd frmo the bestbuy or futureshop or compusa, etc...not off the web where someone could be a man in the middle sending you anything, if there is any application of which you MUST enforce actual hard coded data, (on a disk) that would be AV cds.
I actually even heard of someone securing their linux distro by burning certain partitions of the system to cd, and keeping that cd in the cd rom, that way they could never be rootkitted.

how is this new?

[ILuvRamen]

This one particular string of viruses has been about 75% of all my computer repairs for my private computer repair business for the last 2 years. How is this finally a story now? How does the blaster worm get hours on CNN and they maybe mentioned this once in a filler segment? This is like the end of the world in computer terms and worse than any virus I've ever seen in history and finally just now it's getting one slashdot story? Amazing.

Brilliant

[Anonymous Coward]

That is the brilliant part of the scam, you ask for money so you look legit.

Is it just me

[Anonymous Coward]

Is it just me or does GetSafeOnline.org seem like a con site URL?

Mum kept getting Calls

[otherniceman]

My mother kept receiving calls from some company claiming to be IT support and trying to get her to visit a website to update her machine as there records show it being infected. She always says that my son deals with that sort of thing and she will just not switch the computer on until I have checked it. One day they called while I was there so I spoke to them, they always mumbled the name of the company, I asked them for their company registration number as I needed to check they are a legitimate company. They try to get me to visit there website where I can see that they are legitimate, eventually they give me a number which was about 12 digits too long for a company registration number I tell them I can't find anything about them at Companies House and eventually they give.

I'm suspicious

[arshadk]

I think that article might be scareware... they're just trying to make us click on the 'GetSafeOnline' link.

why don't we fix this ourselves??

[RobertLTux]

okay so we get somebodies computer to fix and after we salvage the data as best we can why don't we

1 either by slipstream or by autopatcher make sure the system is up to date as of this date
2 install firefox ,disable MSIE and install adblock with a good patterns subscription
3 Install all of the stuff that will get installed (flash a proper java acrobat reader ect) with the correct settings (to avoid some of the drive-byware problems)
4 install some sort of free antivirus and then set it to autoupdate SILENTLY
5 also install a few FLOSS programs that would work for that user

in short we can not "fix stupid" but we can make it a lot harder to break the computer

Sort of like Linux variant, Android?

[Anonymous Coward]

http://mobile.slashdot.org/story/10/11/14/0115255/Android-Holes-Allow-Secret-Installation-of-Apps , so read that, & tell us another "tall tale" there, symbolset. You make me laugh, you really do. You're such a "Linux zealot" that you can't resist spreading more of your "Pro-*NIX F.U.D." constantly, and yet you don't admit to the fact that exploits such as shown in the URL above exist on Linux and its variants. I'd also like to know an answer to these 2 questions, from you: Does javascript run on Linux in the browsers it has? Do those browsers ever get security vulnerabilities as well?? Yes to both, and thus, Linux isn't really all that "secure". It's just less targetted because less users use it. Online criminals aren't any different than say, a pickpocket: He doesn't operate where there is only a few possible victims, he operates where the crowds are (e.g.- malls, subway & train stations, etc.), & online??? That's on Windows. "Security-by-Obscurity" is what Linux enjoys in other words. Heh, I recall the MacOS X T.V. ads campaigns trying to imply that "Macs are secure, PC's are not" & once MacOS X got a lot more market share, what happened then???? Malwares for MacOS X! So, you can stop trying to be "funny" because your F.U.D. you spread may actually influence others, and wrongly via less than honorable methods.

(Un)intended Consequences

[drooling-dog]

Ironically, many of the vulnerabilities that Windows has always had - e.g., autorun on CDROMs, running emailed executables, etc. - were only done to keep things simple for naive users. Ultimately, these minor conveniences have encouraged a malware ecosystem that is far more complicated and stressful to these same users than the lack of them would ever have been.

But now there's good money to be made from frightened and confused users, both illegitimately and semi-legitimately. So the unintended consequence of ease-of-use turns out to be convenient for some, but not the novice users for whom it was originally designed.

Re:So, uh... / Believe it or not...

[Culture20]

If it popped up in his taskbar, then it already installed and was running a program (at least under his local account). Let me guess, it mimicked a Java update request?

Re:So, uh... / Believe it or not...

[RFSSystems]

*ding ding ding* We have a winner! After a bit of trial and error, thats the only thing we could think of. I guess you get so used to seeing it that once you finally get around to updating it, you never really know whats going on "under the hood". That's why I trust... "aptitude safe-upgrade" haha MUCH less painful!!

They got me

[Anonymous Coward]

I bought some AV software a few years ago when it sai d I had a virus. Nothing bad happened to my credit card information so no big deal. The problem was a few months later another AV solution popped up and told me that I had a fake AV solution. That company stole from my account after I paid them for their services. I won't use them or recommend them again.

the virus analogy needs to go deeper

[amn108]

OK, once we managed to implant people everywhere with the analogy between a real organic virus and it's now just as common computer counterpart. People realized that it's a scary thing, and Norton Antivirus was born. I think it is time now to implant clueless moms and dads everywhere with a new idea - that buying a new pill you never seen in your life promising to cure you of cold, will most likely not do the trick. In other words, it's amazing how much people trust computer antivirus programs they never have even heard of before, but go and try to ask your mum to drink a mixture as an "antivirus" to common cold - she'll dismiss it on the spot. I think it's time we pushed the virus analogy a step deeeper - computer system is your body, would you want to experiment with unknown pills without asking some sort of authority on the subject first?

It's not always the users' fault.

[crazyf00l]

Many of you are equally foolish by declaring all of the people that get infected with Fake AV consoles to be idiots. While it's true that many people get infected by going places they shouldn't and/or clicking things that they shouldn't, these "viruses" are frequently propagated by SQL injection and CSS (Cross Site Scripting). Sometimes they aren't installed explicitly at all, and just appear on machines. They are a pervasive problem, and one that many AV programs are not adept at dealing with at all. I have found that BitDefender, Kaspersky, and Sophos are about the most reliable at removing them, but none of them are 100% effective at prevention or removal. The biggest issue is education. Social engineering is a very big part of the dissemination of spyware, trojans, and viruses. People need to get educated about these types of threats, and learn to be more wary of where they go. Even careful selection of what websites you browse isn't a surefire bet, as many times CSS attacks aren't immediately noticed, and many rather popular (and generally safe) websites become little more than unwilling dissemination points for these types of threats. I am in charge of the desktop system administrator team at my company, and most of our workers aren't all that knowledgeable when it comes to computers. Many don't have any idea that there are programs out there that masquerade as a helpful program but are really just clever attempts to steal bank and/or credit card information. In my experience, Fake AV consoles are the #1 threat that we face from an AV perspective, encompassing about 90% of our infections. We recently switched from Symantec Endpoint Protection 11.5 (Absolutely worthless, don't ever buy it) to Sophos Endpoint Protection, and our Fake AV infection rates have dropped by nearly 95%. It's that big of a difference. That coupled with education on Social Engineering tactics has helped keep our environments much safer, and resulted in a much better overall experience for users. It's easy to bag on the idiots, and there are certainly a lot of them, but you have to remember that a lot of the people did nothing wrong or especially risky, other than trusting that their AV software works as advertised. Sadly, most of the popular AV programs are TERRIBLE at eliminating these threats. AVG, MS Security Essentials, Symantec Endpoint Protection, PC Cillin, HouseCall, etc. have all proven rather unreliable against these types of threats in our enterprise and in my experience troubleshooting user machines privately as well. Ultimately this is very similar to the spread of STDs. The biggest two factors still have by far the largest impact just as they do with the spread of STDs: Education and Prevention. Just my 2 cents.

Re: It's the users installing it

[gordguide]

Assuming you mean Java, and not JavaScript, I have a solution.

Turn off Java in the browser. I've had it off for years ... apparently it has no Earthly use, as my browsing experience is completely unchanged. Banking, whatever ... just works.

Hit the switch, and at least for that particular issue, it's gone. For good.

No problem here

[homes32]

Ha suckers. I have never had a problem with this. My protection software (Antivirus Pro 2010) catches everything that tries to infect my computer!

Get a virus over the phone

[youngone]

Here (in New Zealand), we've been getting a rash of phone callers telling people they're infected and asking for money. In fact me wife got just such a call last week. Fortunately she knows just enough to tell the caller to fsk off. http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=10686568 I don't know if that's common in other places. We might just be a gullible bunch.

How will this help against "store phishing"?

[Mathinker]

These kinds of users would probably be fooled by a phish which duplicates the look & feel of their store.

I think that eventually people will end up only doing banking and (to a lesser extent) shopping from "trusted platforms" : either the Apple-walled-garden-style ones, or from a live Linux distro booted from read-only media, set up for no data persistence. (Yes, I know neither of those is totally secure --- nothing is totally secure!)

Interesting that the only walled garden product that I can think of which Microsoft offers is its XBox gaming console. I wonder if people will start to use gaming consoles for this, and if banks will eventually start to offer "banking interface programs" which run on gaming consoles (I can just imagine someone saying "I'm tired of killing cops in GTA --- Time to hit Citibank and go to sleep.". Even funnier is the image of some clueless gamer trying to get "God mode" in his banking application.)

Re:How will this help against "store phishing"?

[Bert64]

The problem with this is the corporate mentality of banks, they don't know anything but windows and some (far less than a few years ago) won't even let you access them from a linux based livecd environment.
Several banks i can think of even provide an activex based application for their online banking, possibly one of the least secure technologies ever developed.

In other news...

[Anonymous Coward]

Bear shits in woods. Twice.

Cross pollination

[Anonymous Coward]

So do "legitimate" AV companies create viruses that only their AV is secure against, or haven't they considered that business model yet? Learning can go both ways.

Why blame the user?

[NuKe_MoNgOoSe]

Having worked with virus removal for some time. I am displeased to see people who are in the know about computers calling the average PC user derogatory terms especially when it comes to intelligence. I look at it this way I am not a doctor I know little to nothing about medecine does it make me a idiot because I dont know what a doctor knows? Or that (even with legitimate doctors) they make a wrong diagnosis am I a idiot because I dont pick up on it? It just seems unfair to blame the user for the actions of those who prey on them. I know a fair amount about technology, but my grandfather is altogether clueless and has fallen victim to these online scams and why wouldnt he? For all he knows of the internet and computers these applications are legit, until I educated him otherwise. Now though the game has changed it used to be a anonymous application that was the problem but now you have help desk clients like iyogi which claim to be affiliated with major OEM vendors they charge you for service, generally a fraction of the OEM cost, and if anything goes wrong and you request a refund they send you back to the OEM who obviously will not refund the victim the cost of the service.

Re:Why blame the user?

[neminem]

If a doctor you've never heard of calls you up on your cell phone to tell you, I'm sorry, but you have cancer, and if you don't want to die at an early age, you should visit his office immediately and take these expensive pills he just happens to have, and you do it, then, yes, in fact, that makes you an idiot. It's not about having computer knowledge, it's about being excruciatingly gullible.

My mom was almost hit by one of these scams a couple years ago, but she had the good sense to ask me before clicking on it. My mom has *also* asked me about a couple *other* obviously-scams she was tempted to reply to, that had absolutely nothing to do with computers. (Other than that she could have googled them herself, I suppose, instead of asking me to do it.)

Re:Why blame the user?

[NuKe_MoNgOoSe]

While the comparison may have been a little extreme the meaning is the same: the unaware get taken by people who guise themselves as professionals. There are some which are blatantly obvious as being a scam, but there are other infections which emulate trusted brands. I just dont think calling the victims of these things 'idiots' is fair.

using unix to fix windows

[ElliotWilcox]

I posted an article last spring on how to fix windows viruses using Unix and responders contributed information creating a very useful guide to securing windows operating systems in the most unlikely of places: a linux forum: details: http://virus.gregrank.us/ will redirect you to the article mentioned above. I have built my windows desktop AV standards around the ideas obtained from responders (with great success)