BleepingComputer.com: Rogue Av Tactics Continue To Threaten: Fake Bsod

Jump to content

Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

Rogue Av Tactics Continue To Threaten: Fake Bsod

#1 User is offline   quietman7 

  • Bleepin' Janitor
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Global Moderator
  • Posts: 25,511
  • Joined: 09-July 05
  • Gender:Male
  • Location:Virginia, USA

Posted 03 October 2008 - 08:33 AM

Quote

...Trend Micro threat researchers keep seeing more and more — slightly different, but yet increasingly more annoying — variations to the set of rogue AV infection signals we have been documenting on this blog...Fake BSOD (actually a screensaver) now sports a specific mention of the problem — an unregistered version of a certain AV product...

blog.trendmicro.com screenshots included
Microsoft MVP - Consumer Security 2007-2012 Posted Image
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

#2 User is offline   harrywaldron 

  • Security Reporter
  • PipPipPipPip
  • Find Topics
  • Group: Members
  • Posts: 509
  • Joined: 10-April 04
  • Gender:Male
  • Location:Roanoke, Virginia

  Posted 03 October 2008 - 09:58 AM

^ Thanks for sharing ... More links below, including how to safely EXIT any pop-ups presented ...

AntiVirus 2009 - Fake BSODs and Reboots continue in new variants

Trend Micro is continuing to see more variants of Antivirus 2009 in the wild using these tactics to frighten users (i.e., new term of "scareware" was been introduced). Unfortunately, inexperienced users may feel it's their true AV system that's creating these messages. They may become infected by following "the yellow brick road" of prompts that eventually load these malicious agents.

Keeping AV protection updated is important. However, the malware agent is constantly changing with new variant to avoid AV detection (e.g., Packing algorithms, MD5 hash total changes, HTML changes, etc).

Please be careful with all email and websites.

AntiVirus 2009 - Fake BSODs and Reboots continue in new variants
http://blog.trendmicro.com/rogue-av-tactic...ue-to-threaten/

Quote

October has just begun and Trend Micro threat researchers keep seeing more and more — slightly different, but yet increasingly more annoying — variations to the set of rogue AV infection signals we have been documenting on this blog.

This variant is an ongoing iteration of the Antivirus 2009 campaign and is detected as TROJ_FAKEAV.SV. It is nice to see Microsoft and the State of Washington going after scareware purveyors. We completely support efforts to bring these criminals to justice.


Some Past references
http://blog.trendmicro.com/rogue-av-theatr...n-extended-run/
http://blog.trendmicro.com/a-million-searc...o-get-infected/

Use of Task Manager to close pop-up messages more safely
http://msmvps.com/blogs/harrywaldron/archi...afely-exit.aspx

#3 User is offline   quietman7 

  • Bleepin' Janitor
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Global Moderator
  • Posts: 25,511
  • Joined: 09-July 05
  • Gender:Male
  • Location:Virginia, USA

Posted 10 October 2008 - 08:18 AM

New rogue: Antivirus 2010

Quote

Antivirus 2010 is a new rogue security product. This rogue is a clone evolved from IEdefender that begat XP Antivirus, that begat Antivirus 2008, that then begat Antispyware 2009...The rogue application uses the same old tricks to lure users into purchasing their worthless application...Fake BSOD...

Microsoft MVP - Consumer Security 2007-2012 Posted Image
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

#4 User is offline   jgweed 

  • Forum Addict
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Global Moderator
  • Posts: 27,603
  • Joined: 11-April 04
  • Gender:Male
  • Location:Chicago, Il.

Posted 10 October 2008 - 08:38 AM

They are begatting like the proverbial rabbits; but so are the ways to prevent or get rid of them.
John
Whereof one cannot speak, thereof one should be silent.

Share this topic:


Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users