Meet the New Faces of Fake Antivirus Software
Meet the New Faces of Fake Antivirus Software
Posted 06/13/2011 at 5:53am
| by Paul Lilly
6
Comments
Print
One of the most popular tricks in the Malware Handbook is to fool users into installing fake antivirus software. You've seen the bogus warnings before, the ones telling you your PC is infected with viruses, and all you have to do to restore order is download and install whatever fake antivirus software is on your screen. Savvy PC users recognize this as a scam designed to get users to unwittingly install real malware under the guise of a helpful product, and the reason it still works is because malware writers keep finding new and creative ways of dishing up their bogus software.
According to security firm Sophos, one of the latest scams is to detect your user-agent string from your browser and display a fake Firefox security alert if you're using Mozilla's Firefox browser. Internet Explorer users get the generic "My Computer" dialog box, but the fake Firefox warning looks legit except for one thing -- Firefox doesn't include a built-in virus scanner and only warns against visiting malicious pages, not specific viruses.
Another clever trick currently making the rounds is to spoof Microsoft Update. Once again, it's Firefox users who appear to be the most popular target as of late.
"The page is nearly an exact replica of the real Microsoft Update page with one major exception... It only comes up when surfing from Firefox on Windows," Sophos warns. "The real Microsoft Update requires Internet Explorer."
It used to be that these two-bit spoof jobs were littered with grammatical errors, but attackers have started to clean up their act with professional looking pages and, more recently, clever attacks aimed at a specific set of users (Firefox).
Image Credit: Sophos
More like this
6
Comments
Comments are closed on this article
andrewc513
June 13, 2011 at 9:57pm
Long story short, somebody needs to step up their game. No one weakness can be blamed, because nothing is 100%. But AV's aren't cutting it anymore, even the best ones like Avast and MSE aren't doing jack against newer zero-days. Programs are too exploitable; I'm looking at you, Java, Adobe Reader, and Flash. I remove these infections for a living as a tech, but the fact that a little granny has to lay down a hundred bucks because of shit like this, it almost makes me feel like the criminal.
This is how bad it is: I've had 3 attempted rogues try to get in my machine through Google image searches in the past month. I of course killed the browser , processes, etc. before they started, but here's the skinny: I'm a tech and know how to avoid this stuff. I update Windows religously. I have MSE. I use Chrome with AdBlock and WOT. I run my Ninite executable daily (silent & automated w/Ninite Pro) to keep tabs on outdated Flash, Java, Adobe Reader, Air, browsers, etc. I use OpenDNS. I know what safe browsing habits are and apply them to my daily habits. And the stuff still finds a way through. I know how to react to it, that's the difference. Joe Schmoe will click on it 9 times out of 10 even after teaching them how to keep themselves protected and how to browse safely.
noobstix
June 13, 2011 at 11:10am
Due to my "Internet voyeurism", I've almost gotten quite a few this past year. Luckily, I had MSE running and that nothing really happened *knock on wood*. However, what annoys me the most is that these would-be malwares would shrink the hell out of my browser window so I really don't have any clue on what it really looks like. I just end up using the Task Manager to kill my web browser.
DDRDiesel
June 13, 2011 at 11:59am
So I'm not the only one that experiences that issue? I thought it was something with my browser or Windows installation. I have to manually drag the corners of my browser to see what the Hell it is, usually to be greeted with the window in the picture above. Kill the application via Task Manager, clean temp files and folders, then scan the computer just to be sure
DDRDiesel
June 13, 2011 at 9:48am
For your sake, I hope you aren't referring to the ACTUAL Microsoft Security Essentials AV program, but rather a fake that looks like it. After all, MSSE scored very high marks in multiple AV tests around the net
rich5665
June 13, 2011 at 6:56am
I hate to say it, but the newest Microsoft Version looks very similar to the Firefox version, but is labled as Microsoft Security Essentials. When the bloody thing opened up it was a pain in the ass to close. Clicking cancle or the X in the upper right corner did absolutely nothing. I had to click OK, then close the Window. I run Super AntiSpyware and AVG Antivirus so wasn't to worried. I ran an update on both even though they were current, then scanned my PC just to be sure it wasn't infected. I just got done cleaning this crap off of 6 computers at work, so I wasn't happy seeing it try to install on my home computer. I'm happy to say that my PC was not infect, unlike the employees at the company I support, I knew what I was looking at.
silverblack
June 13, 2011 at 9:51am
My supervisor caught "Microsoft Security Essentials" doing a google image search. She installed it and, when it reported viruses, pulled the network cable. She then called me over on what to do. I took one look and a)knew this was not the security program IT had on our PCs, b) knew Microsoft does not install programs on your computer then ask for money to remove malisiocus software. A Google search on my phone confirmed what it was.
Connect with MaximumPC
Featured Content
The gang discusses the GTX 690, Trinity, Ivy Bridge, Amazon, big-box stores, MMOs,...
This month's issue
Feature
Build a PC On Any Budget
Feature
Cloud Services Showdown
How-To
Encrypt Your External Drive
Build It
Upgrade an X58 Rig
Most Commented Articles
Latest Max PC Tweets
- maximumpc: Original RickRoll Video Returns to YouTube After 24-Hour Copyright Hiatus http://t.co/MaH9Sxyy1 day 19 hours ago
- maximumpc: Corsair has decided not to go forward with its $78 million IPO, citing weak equity market conditions http://t.co/A5a4DAzj1 day 19 hours ago
- maximumpc: Want to work at Maximum PC? Our Online Managing Editor, Alex, is moving away, so we need a new one. http://t.co/9Z7JCh0E3 days 17 hours ago
