XP Antivirus Malware - More convincing than the real thing!

[flyinghaggis]

Kind of an interesting study into social engineering!

 

Anatomy of a malware scam | The Register

 

Cant believe they went to the trouble of creating a fake Windows security centre dialogue, online help and Terms and Conditions! Malware Authors are getting way too crafty these days

[Geoff]

Ooo I hate this one. It's turning up a lot on the infested machines I fix.

[dhicks]

Kind of an interesting study into social engineering!

 

See also:

 

Coding Horror: The Perils of FUI: Fake User Interface

 

--

David Hicks

[Dos_Box]

I have just answered a question for my Helpline column on this. There is a more nefarious variant which keeps coming back from the dead too.

[originofsymmetry]

Just got rid of that this morning on an XP machine - have to give credit where credits due though

[bizzel]

Parents currently have this on their machine which Kaspersky missed totally. Even on VirusTotal only 2 pieces of software pick it up.

[MK-2]

I had a user with one Wednesday which set the background on her pc as a bitmap which looked like a popup box, and then put a notice in the taskbar saying windows antivirus had detected a virus etc etc, click here to download and clean. it disabled all anti virus software, it stopped you changing the background. it also installed the microsoft blue screen screensaver so after 5 mins, it looks like your pc blue screens, obviously because its infected!

it then put files everywhere that recreated any deleted ones.

took me half a day to get rid of. and to top it off, once i removed part of it, windows needed activation again, and wouldnt activate online so i had to do it by phone.

as said previously, credit on the amount of work going in to them, but off from my machines

[RabbieBurns]

Ive got a laptop the now that I cant figure out what is screwing with it. In Safe mode it found the various usual spyware crap but nothign too serious. A safemode scan with nod32 and symantec didnt find anything. Booting to normal mode, the machine just locks up. Ive disabled all startup programs, all non critical services, etc. Theres nothing in the event log out the ordinary. I just cant figure out whats causing it to lock up. I cant even get Taskman to work to see if theres something maxing at 100%. Stumped.

[Domino]

I found a fix.....

 

Apple - Mac OS X Leopard

[ahuxham]

You'd hope people would actually think before click, for start in the image. (In the article)

 

1.) It's clearly an image load, as the corners are rounded yet the ajax/js code isn't making it look round.

2.) Different colour theme, Windows XP Default Theme popup, on an Windows Vista Aero Theme.

 

Somethings are obvious, than again, majority of people just don't noticed.

[MK-2]

You'd hope people would actually think before click, for start in the image. (In the article)

 

1.) It's clearly an image load, as the corners are rounded yet the ajax/js code isn't making it look round.

2.) Different colour theme, Windows XP Default Theme popup, on an Windows Vista Aero Theme.

 

Somethings are obvious, than again, majority of people just don't noticed.

 

Also, although takes a little more searching, spelling is sometimes off.

For the one I had to fix, Windows AntiSpyware was going to 'pertect' my machine when I ran the link. It was also advisable to 'downlaod' this to keep my machine safe.

 

Rabbie: If you can get in the registry, try looking in local machine at:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

 

under userinit. i know some spyware now put something in there so it autoloads

[RabbieBurns]

cheers mk2 ill give that a shot at some point over the weekend

[MkII]

Would like to know of effective removal methods. Currently we use system restore.

[djdohboy]

hi guys

 

I part time help out the old school network manager in his new job of home pc repair,

 

this is brilliant!!!!! malwarebytes

 

Will deal with windows antivirus completly, its free and you only need to do the smart scan, plus it has a remove on reboot function.

 

Very Very Usefull!!!!

 

[tarquel]

Like geoff... been seeing this one alot more quite recently. Not hard to fix though.

 

Basic rule of thumb everyone [home users] should have... if you or another family member didnt knowingly install it, then its spyware of some sort hehe

 

Nath.