Crafty Malware Detects Browser, Imitates Warning Page

Posted 09/07/2010 at 5:35am | by Paul Lilly

3

Comments

Print

Malware writers are a cunning bunch, and if you don't keep up with the latest trickery, you could be in for a world of hurt. The latest ruse making the rounds is a nasty bit of code called Rogue:MSIL/Zeven that first detects what browser you're using and then spoofs said browser's warning page.

"This is meant to be a social engineering scheme in order to trick the user into downloading and installing the rogue, relying on the user's trust of his day-to-day browser," Microsoft warned in a recent blog post on its Malware Protection Center portal.

"The similarity between the fake warning pages is so accurate that it can trick even highly trained eyes."

It works with Internet Explorer, Chrome, and Firefox, the three most popular browsers on the planet, though there are some telltale signs.

"In the Firefox page, for example, you can see it's not the real warning page because they misspelled 'out' and wrote 'Get me our of here,'" Microsoft explains.

The biggest telltale sign is that in all three browsers, the fake warning prompts potential victims to download an "update" or a "solution," which is not something you should ever see when a website is blocked.