Do NOT Call This Number..!

AKA Norton Users Be Aware

I just received an alert from an alert reader (ahem) which demonstrates a new twist on an old attack tactic.

Yup. That’s a fake. (One hint is the “Message from webpage” in the title bar.. [Norton is not a web program, it’s installed on your machine.])

The website you’re visiting is poisoned (and you probably have some programs in need of updates). Keywords, if you’re interested in learning more are “scareware” and “rogue anitvirus” (and maybe “poisoned website”, too).
*  Your Computer Is Lying To You… The Epidemic Of Rogues
* Why You Don’t Stand A Chance Against Cyber Crime

Copyright 2007-2014 © “Tech Paul” (Paul Eckstrom). All Rights Reserved.

---

>> Folks, don’t miss an article! To get Tech – for Everyone articles delivered to your e-mail Inbox, click here, or to subscribe in your RSS reader, click here. <<

---

All we really have, in the end, are our stories.
Make yours great ones. Ones to be proud of.
And please, never forget – one person can make a difference.
Find a way to make someone’s day today.
(Best advice I ever heard? Don’t sweat the small stuff.)

A Warning For Apple Users

I have long been advising owners of computers – even Apple computers – to make sure they run an antivirus (any device that connects to the Internet needs an antivirus) and keep it up-to-date.  Also true: the outright *myth* that Apple is immune from viruses and hackers persists. Guess what I saw in my InfoSec headlines yesterday?

Attackers set sights on Mac OS X with Apple malware toolkit

“The growing success of Apple’s Mac OS, bolstered by iPhone sales and new iPad tablet users, has caught the attention of cybercriminals who are setting their sights on Apple users.

Danish IT-security firm, CSIS Security Group, has stumbled upon a new Apple crimeware toolkit targeting Mac OS X. Security researchers at the organization discovered the toolkit being sold in low numbers on several black hat hacking forums.” Read more..

Also: New MAC OS X scareware delivered through blackhat SEO

Researchers from Intego have intercepted a new scareware sample targeting the MAC OS X. Read more..

(Geek Speak Translation: A “malware toolkit” is a simple-to-use program that creates custom viruses, and takes advantage of known weaknesses. See, http://en.wikipedia.org/wiki/Hacker (computer_security). They are [typically] used by ‘hackers’ who aren’t really into computer programming, called “script kiddies”. “Blackhat SEO” refers to criminal manipulation of search results, so their ‘poison’ websites appear at or near the top.)

I know that my posting this will not do anything to dispel common perception; but for those of you who are Apple Mac owners, and want to prevent Identity Theft and to surf the web (more) safely, I re-recommend purchasing and installing Norton for Mac, or downloading ..

Today’s free download: Sophos Anti-Virus for Mac Home Edition

“Free antivirus that works simply and beautifully. Just like your Mac.

Download now

Overview: As Apple computers grow more popular than ever, they’re an increasingly-enticing target for hackers. And these hackers aren’t just mischief-makers — by targeting your computer or applications you use, these criminals are out to steal and profit from your valuable personal information. Don’t let them. Get free Sophos Anti-Virus for Mac today.”

Please! Let your Apple using friends and family know – Apple is in the hacker crosshairs now. (And also tell ’em “hacker” translates to “cyber criminal” these days.)

Bonus:

Copyright 2007-2011 © “Tech Paul” (Paul Eckstrom). All Rights Reserved.

---

>> Folks, don’t miss an article! To get Tech – for Everyone articles delivered to your e-mail Inbox, click here, or to subscribe in your RSS reader, click here. <<

---

Your Computer Is Lying To You… The Epidemic Of Rogues

You Click On A Search Result, And A Screen Tells You An Infection Has Been Detected…

There currently is an epidemic of fake anti-malware software on the Internet– which is collectively called “rogue anti-malware” (aka “scareware”). These fakes are, in fact ‘marketed’ under hundreds of different names, such as “Internet Security 2010”, “Online Scanner”, and “Antivirus XP 2009”.

At our current state of Internet insecurity, you will see one of these scans pop open… if you haven’t already.

This ‘rogue’ software scares people by giving false “a virus has been detected!” notifications, and then tries to deceive them into using a credit card and paying for removal of of the non-existing “infection”.
Worst part is, many are designed to appear to be legitimate products.. professionally packaged/presented, with “customer testimonials”, etc.

The Internet’s “shadow economy” of cybercrime is worth over $105 billion. Online crime is bigger business than the global drugs trade¹. No country, no person, no business and no government is immune from CyberCrime.

This video (produced by the good folks at WOT) shows what happens when a legitimate Web site gets infected and redirected to one of these bogus anti-malware scams.
(Yes, folks, legitimate websites are being ‘hacked’. It’s known as “poisoning”. And search results links are being hijacked. And the cybercriminals can afford to pay for advertising and appear in search results that way too..)

The *people* behind this scourge use many different ways to try to entice you to click – realistic looking pop-up windows appear, offers of “free trials” arrive in e-mail, and “free scan” buttons on legit-looking ‘fight malware’ websites.. the means are quite varied! There’s even some that put a red shield icon in your System Tray (down by the clock) and mimic a Security Center alert.

As this video shows, the user is tricked into (scared into, really) providing their credit card #  to clean infections that weren’t there before they clicked and aren’t really there now.
* The ‘false positives’ are not “cleaned”, BUT, more adware and spyware is installed.
* A good percentage of my calls at Aplus Computer Aid are folks needing help with getting rid of these ‘rogues’. Because these clever programs use the latest techniques to combat removal, and it can be quite tough — if not impossible — to truly remove them.. without formatting your hard-drive.
* For more, please read Is that anti-spyware program really spyware? and Bill Mullins’ How Fake/Rogue Software Affects Real People
* One Website dedicated to combating this epidemic is Spyware Warrior. It has a pretty good list of known rogues, and much more detailed information. Another excellent resource is Bleeping Computer.
* I have written several How-To’s on protecting yourself from malware, and how to clean your machines as well. Click here to see those titles.

¹ From the new MessageLabs whitepaper. (This eye-opening report provides a disturbing look into the ‘dark’ world of cyber-crime. This link is the online version.. you need to scroll a bit..)

Today’s free download: WOT is a free Internet security add-on for your web browser. It will help keep you safer from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky Website. It’s easy and it’s free.

• So easy a child can use it
• Ratings for over 20 million websites
• Downloaded 3 million times
• The WOT browser add-on is light and updates automatically
• WOT rating icons appear beside search results in Google, Yahoo!, Wikipedia, and webmail – Gmail, Hotmail, Yahoo!
• Settings can be customized to better protect your family
• WOT Security Scorecard shows rating details and user comments

In case I wasn’t clear:
1) The alerts are fake. The scans are fake. The results are fake. Don’t fall for it.
2) For you to even see these scans, your machine has been attacked, and you should start a virus removal process immediately.. and/or get help.
3) Epidemic? You bet! Thousands of websites get poisoned each week, and the cybercriminals create their own bogus websites at the rate of thousands a day.
Oh, yes, almost forgot. A new ‘variant’ of rogue is released onto the Internet roughly twice a week…

Copyright 2007-2010 © Tech Paul. All rights reserved. post to jaanix

Share this post :

Windows Does Not “Requires Immediate Attention”…*

Chat Message Scares Reader Into Installing Malware

Folks, criminals are once again using Skype to send phishing “chats” in an attempt to defraud you. So, I am re-posting this article. It is the exact same ruse I first warned of in early ’08, but the name has changed.
This attack will reappear every so often with a slightly different name and URL… It is a classic scareware attack.

Yesterday a Skype chat window opened on my machine, and presented me with a dire warning from someone named “Software Update” “Registry Scan Online®” Today’s flavor (I think it was “OnlineUpdate.org”..). It said that “WINDOWS REQUIRES IMMEDIATE ATTENTION” and, it provided me with a solution. 

(Click on image to see large version)

Please, folks, tell me you have spotted this for what it is. Please tell me that you knew –instantly– that this is a cybercrime attempt; that it is Phraud-ulent.

Please tell me that you know what will happen if the link provided in this message is clicked; and, please, please, please tell me you would never click the link.

Just in case you aren’t sure:
* “Software Update”, “Registry Scan Online ®”,  Today’s flavor, doesn’t exist.
* “www.onlinemonitor.info”, “www.registryscan.com”, Today’s flavor, is not registered in ARIN (the registry of Internet addresses).
* clicking the link will allow scripts to run, and/or take you to a poisoned Website which will install malware on your machine, or/and it may take you to a site that will sell you a rogue anti-spyware program
(please read my article, Is that antispyware program really spyware).

* Microsoft DOES NOT alert you via Instant Messaging. No legitimate company does. Period. Ever.
This is a classic example of a hacker’s attempt to get you to click their link.

All of this so they can rip you off. It’s these cyber-criminal’s full time job.

Please point your less-savvy friends and family to this article and educate them to the dangers of spam (unsolicited) messages and tell them– NEVER CLICK THE LINK. (Yes, I am shouting. 2010 is days away, and I still have to say this everyday.. Sigh.)
[Note: while this article directly references the VoIP client Skype, you may see this type of thing in other Instant Messaging/Chat programs, and social networking communications.]

[addenda: Peter Parkes (Skype Blogger) wrote and asked me to remind my readers to, quote, “Please report users who send these messages to abuse@skype.net – that will help us to block them where appropriate.”]

Today’s free downloads(s): I have assembled on my Website a collection of links to the best free anti-malware programs to help you prevent infection.. and clean up if you’ve been infected. To see them, click here.

An Infection Has Been Detected!

Online crime is bigger than the global drugs trade¹. The Internet shadow economy is worth over $105 billion. No country, no person, no business and no government is immune from cybercrime.

Currently there is an epidemic of fake anti-malware software on the Internet– which is collectively called “rogue anti-malware“ and/or “scareware“. Marketed under hundreds of different names, such as VirusRemover 2008 and Antivirus XP 2009, this type of rogue software scares people by giving false alarms, and then tries to deceive them into paying for removal of non-existing malware. [update: some of the newer ones are now encrypting your files, and requiring a ‘ransom’ for the key. Don’t pay. There is help online.]

This video shows what happens when a legitimate Website gets infected and redirected to one of these bogus anti-malware scams.
Yes, folks, legitimate websites are being ‘hacked’. (It’s called “poisoned”.)

Please watch, and see what these things looks like (how “real looking”). I repeat, there are thousands of these, being planted on tens-of-thousands of sites.

The people behind this scourge use many different ways to try to entice you to click – realistic looking pop-up windows appear, offers of “free trials” arrive in e-mail, and “free scan” buttons on legit-looking ‘fight malware’ websites.. the means are quite varied!

As this video shows, the user is tricked into (scared into, really) providing their credit card # to clean infections that weren’t there before they clicked and aren’t really there now.
* The ‘false positives’ are not “cleaned” BUT, more adware and spyware is installed.
* A good percentage of my calls at Aplus Computer Aid are folks needing help with getting rid of these rogues. Because these clever programs use the latest techniques to combat removal, and it can be quite tough — if not impossible — to truly remove them.. without formatting your hard-drive.
* For more, please read Is that anti-spyware program really spyware?
* One Website dedicated to combating this epidemic is Spyware Warrior. It has a pretty good list of known rogues, and much more detailed information. Another excellent resource is Bleeping Computer.
* I have written several How-To’s on protecting yourself from malware, and how to clean your machines as well. Click here to see those titles. But I really cannot advise you strongly enough – should you get one of these nasties – to enlist the aid of a Pro. I would tell you that even if I wasn’t one myself!

¹ From a recent MessageLabs whitepaper. (This eye-opening report provides a disturbing look into the ‘dark’ world of cyber-crime. This link is the online version.. you need to scroll a bit..)

Today’s free link(s): Spammers seeking “volunteers” to DDoS White House.
“Cybercriminals have begun to capitalize on the vehement debate in the country over health care reform, sending spam targeted at opponents of President Obama.”

Also, it just so happens that Bill Mullins posted a close look at one these, named “Total Security 2009” on his site today. Please see, Total Security 2009 Scareware – Panda Security Takes a Look.

Today’s free download: WOT (Web Of Trust) is a free Internet security add-on for your browser. It’s community-based ratings can help keep you safer from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky Website. It’s easy and it’s free.

• Ratings for over 22 million websites
• Downloaded over 4 million times
• The WOT browser addon is light and updates automatically
• WOT rating icons appear beside search results in Google, Yahoo!, Wikipedia, Gmail, etc.
• Settings can be customized to better protect your family (new “Parental Control” setting blocks access to Web sites with a poor child safety rating and no rating at all)
• WOT Security Scorecard shows rating details and user comments

Orig post: 4/16/09

Copyright 2007-9 © Tech Paul. All rights reserved. post to jaanix

Share this post :

Internet Plague – Rogue Antivirus

Currently there is an epidemic of fake anti-malware software on the Internet– which is collectively called “rogue anti-malware” (aka “scareware”). ‘Marketed’ under hundreds of different names, such as VirusRemover 2008 and Antivirus XP 2009, this type of rogue software scares people by giving false alarms, and then tries to deceive them into paying for removal of non-existing malware.
Worst part is, they are designed to appear to be legitimate products.. professionally packaged/presented, with testemonials, etc.

The Internet’s “shadow economy” of cybercrime is worth over $105 billion. Online crime is bigger business than the global drugs trade¹. No country, no person, no business and no government is immune from CyberCrime.

This video (produced by the good folks at WOT) shows what happens when a legitimate site gets infected and redirected to one of these bogus anti-malware scams.
(Yes, folks, legitimate websites are being ‘hacked’, it’s known as “poisoning”.)

The people behind this scourge use many different ways to try to entice you to click– realistic looking pop-up windows appear, offers of “free trials” arrive in e-mail, and “free scan” buttons on legit-looking ‘fight malware’ websites.. the means are quite varied! There’s even some that put a red shield icon in your System Tray (down by the clock) and mimic a Security Center alert.

As this video shows, the user is tricked into (scared into, really) providing their credit card #  to clean infections that weren’t there before they clicked and aren’t really there now.
* The ‘false positives’ are not “cleaned” BUT, more adware and spyware is installed.
* A good percentage of my calls at Aplus Computer Aid are folks needing help with getting rid of these rogues. Because these clever programs use the latest techniques to combat removal, and it can be quite tough — if not impossible — to truly remove them.. without formatting your hard-drive.
* For more, please read Is that anti-spyware program really spyware? and Bill Mullins’ How Fake/Rogue Software Affects Real People
* One Website dedicated to combating this epidemic is Spyware Warrior. It has a pretty good list of known rogues, and much more detailed information. Another excellent resource is Bleeping Computer.
* I have written several How-To’s on protecting yourself from malware, and how to clean your machines as well. Click here to see those titles.

¹ From the new MessageLabs whitepaper. (This eye-opening report provides a disturbing look into the ‘dark’ world of cyber-crime. This link is the online version.. you need to scroll a bit..)

Today’s free download: WOT is a free Internet security add-on for your web browser. It will help keep you safer from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky Website. It’s easy and it’s free.

• So easy a child can use it
• Ratings for over 20 million websites
• Downloaded 3 million times
• The WOT browser addon is light and updates automatically
• WOT rating icons appear beside search results in Google, Yahoo!, Wikipedia, and webmail – Gmail, Hotmail, Yahoo!
• Settings can be customized to better protect your family
• WOT Security Scorecard shows rating details and user comments

Copyright 2007-9 © Tech Paul. All rights reserved. post to jaanix

Share this post :

Skype says I’m infected with malware…

Yesterday a “chat” window (Skype) opened on my machine, and presented me with a dire warning from someone named “Software Update”. It said that “WINDOWS REQUIRES IMMEDIATE ATTENTION” and, it provided me with a solution.

(Click on image to see large version)

Please, folks, tell me you have spotted this for what it is.

Please tell me that you knew –instantly– that this is a cybercrime attempt.. that it is Phraud-ulent.

Please tell me that you know what will happen if the link provided in this message is clicked; and, please, please, please tell me you would never click the link.

Just in case you aren’t sure…
* “Software Update” doesn’t exist.
* “www.onlinemonitor.info” is not registered in ARIN (the registry of Internet addresses)
* clicking the link will allow scripts to run and/or take you to a poisoned Website which will install malware on your machine.. or/and, it may take you to a site that will sell you a rogue antispyware program (please read my article, Is that antispyware program really spyware).. all of this so that the hacker can take control of your machine.
* Microsoft DOES NOT alert you via Instant Messaging. No legitimate company does.

This is a classic example of a hacker’s attempt to get you to click their link. Please point your less-savvy friends and family to this article and educate them to the dangers of spam (unsolicited) messages and tell them–
NEVER CLICK THE LINK.

[addenda: Peter Parkes (Skype Blogger) wrote and asked me to remind my readers to, quote, “Please report users who send these messages to abuse@skype.net – that will help us to block them where appropriate.”]

Today’s free link(s): I have assembled on my Website a collection of links to the best free anti-malware programs to help you prevent infection.. and clean up if you’ve been infected. To see them, click here. Also, Bill Mullins has posted a very complete tutorial, Think You Have A Virus?– Some Solutions, which is quite probably the best one-stop lesson on malware I have ever run across. (I also recommend his How Fake/Rogue Software Affects Real People.)

Copyright 2007-8 Tech Paul. All rights reserved. post to jaanix

Share this post :