Broadband Tech > Security > Security > [Scam] Hijacked browser - Fake Virus Scan

[Scam] Hijacked browser - Fake Virus Scan

Not clicking on your link, it is not a good idea to post a link to a malware site, try posting it without the http in front. As far as firefox is concerned, I use no-script as an add-on which should stop those kinds of scripts however not being a security expert I will leave that up to others.

"Not clicking on your link, it is not a good idea to post a link to a malware site, try posting it without the http in front."

Yeah point taken. But I figured that the kind of folks in here, have the good sense to understand that I am not posting the link, as an open invitation to to click indiscriminately, besides which I reckoned that there would be a number who could quarantine the little bastard, on a virtualized machine or a live Linux distro etc. I assumed a reasonably interested party would want to check it out and find out WTF is going on and see that it is genuine fraud.

"As far as firefox is concerned, I use no-script as an add-on which should stop those kinds of scripts however not being a security expert I will leave that up to others."

Hmmm. Welll that's one approach. On the other hand hunting the little f***ers down and putting them in hospital would be more effective. I am so f**king sick if the complacency. The attitude seems to be that we all just need to adapt to the situation. F**K that for a joke. This is bullshit and I want to see some blood. F**K those little C**TS screwing peoples lives up. At least they need to be hunted down and dealt with legally. I first saw that shit like 8 months ago. this scam is probably like, a couple of years old by now.

Regards, StevoDevo

reply to StevoDevo

Re: [Scam] Hijacked browser - Fake Virus Scan

reply to StevoDevo

reply to StevoDevo
There are boatloads of these foul things - new ones pop up every day... Here's another flavour of the day, blogged about at Sophos: »www.sophos.com/blogs/sophoslabs/post/8564

Edited to add: Oh look, there's another: »www.sophos.com/blogs/gc/g/2010/0···-attack/

reply to StevoDevo
Some of the scareware families are known to release new clones as often as once a day - Winiguard is notorious for doing that.

One of the newest ones mimics the Automatic Updates window that pops up when Microsoft updates are ready to install. There's also one that seems to change its name depending on the OS it has been installed on.

And they are getting more and more sophisticated with their attempts at defeating tried and true removal methods, such as preventing any executable from running, blocking the installation or running of Malwarebytes, disabling the Task Manager, and more.

And now in addiiton to the usual vectors, such as SEO poisoning, malvertisements, spam, and being dropped by other malware, the scareware operators have even taken to Skype: »[Phish] not even skype is safe.....
--
"The trouble with computers, of course, is that they are very sophisticated idiots." - Doctor Who (from Robot)

reply to StevoDevo

reply to StevoDevo
Just now I had one of these rogues try to load a fake/scare scan page after I went looking for information on General Beauregard Lee, the Southern groundhog who lives on the Yellow River Game Ranch just outside of Atlanta, GA.

The 6th hit on a Google search for this landed me on what appeared to be a fake security scan page. The page had a URL that was based out of India, part of which was www1.do-cleanand-scanzone.in followed by what appeared to be a bunch of obfuscated javascript. The page was titled Security Threat Analysis, and in the center was a circular animated icon with the words "Initializing Internal Security System...". This was not what was in the Google results - looks like another referrer hack. Since I visited the fake scanner page with Firefox and NoScript with no scripts allowed, it could not do anything.

General Beauregard Lee did not see his shadow, BTW.
--
"The trouble with computers, of course, is that they are very sophisticated idiots." - Doctor Who (from Robot)

reply to StevoDevo
Just spent a good chunk of yesterday cleaning one of these antivirus malware from my son's computer. He's 11, and is savvy enough to recognize when they hit, and knows to (try to) use the Task Manager to bail out of what he is doing.

This sucker was strong -- locked down the Task Manager, turned off the (real) AV and Microsoft Update, partially disabled Explorer's ability to open CD/DVD drives. It would allow MalwareBytes to be installed, except for actually installing mban.exe. All of this, even in safe mode as Administrator.

I eventually was able to get MB installed using the random name installer, and cleaning enough to start the cleaning process all over again.

These things are really becoming a PITA...
--
New to Forum Life? Click here and learn.

reply to StevoDevo
Evasive little bugger that fake scanner page is - I tried the original URL from the Firefox history, and it was now a dead link. Going back to the original hacked webpage redirected me to a different fake scanner page, with the same title and animated image in the center. Again it was hosted from the same country domain (.in).

Looks like a deliberate tactic to evade detection by anti-malware researchers, or programs like Malwarebytes. And the redirection chain, which shows up in the history, has some obfuscated characters in the URLs.
--
"The trouble with computers, of course, is that they are very sophisticated idiots." - Doctor Who (from Robot)