Free Republic
Browse · Search
General/Chat
Topics · Post Article

Skip to comments.

New Fake Antivirus Attack Holds Victim's System Hostage
DarkReading ^ | Oct 15, 2009 | 02:42 PM | Kelly Jackson Higgins

Posted on 10/16/2009 7:14:08 AM PDT by knittnmom

Attack forces user to purchase phony antivirus package to free computer

(Excerpt) Read more at darkreading.com ...


TOPICS: Miscellaneous
KEYWORDS: malware; rogueware; virus
Provides details and countermeasures for an aggressive security threat. Not sure of posting/excerpting rules for this site, so erring on the cautious side.
1 posted on 10/16/2009 7:14:11 AM PDT by knittnmom
[ Post Reply | Private Reply | View Replies]

To: knittnmom
Better Link
2 posted on 10/16/2009 7:16:41 AM PDT by InterceptPoint
[ Post Reply | Private Reply | To 1 | View Replies]

To: knittnmom

Which story at that link are you referencing?


3 posted on 10/16/2009 7:16:58 AM PDT by La Lydia
[ Post Reply | Private Reply | To 1 | View Replies]

To: La Lydia
Which story at that link are you referencing?

See the link in Post #2.

4 posted on 10/16/2009 7:19:49 AM PDT by InterceptPoint
[ Post Reply | Private Reply | To 3 | View Replies]

To: knittnmom
I've encountered two machines with this....it's a nasty, nasty rootkit/boot-sector virus.

It goes so far as to disable booting in safe mode and it completely takes over the Windows shell.

5 posted on 10/16/2009 7:21:15 AM PDT by Psycho_Bunny (ALSO SPRACH ZEROTHUSTRA)
[ Post Reply | Private Reply | To 1 | View Replies]

To: knittnmom

I hope we see an
Ad-Aware/MalwareBytes/Spybot/HijackThis type solution to this one soon. I do “Tech Support” for 4 grandsons age 5-11 so I’m dealing with this sort of thing all the time.


6 posted on 10/16/2009 7:22:41 AM PDT by InterceptPoint
[ Post Reply | Private Reply | To 1 | View Replies]

To: InterceptPoint

Thanks. I thought I pasted the full link, but must have missed some.


7 posted on 10/16/2009 7:24:27 AM PDT by knittnmom ("...only dead fish 'go with the flow'". - Sarah Palin 7/09)
[ Post Reply | Private Reply | To 2 | View Replies]

To: InterceptPoint

Okay, being a Mac person, I don’t understand this entirely. What company is responsible for this, and why can’t that company be held accountable? Are they overseas? Why can’t people put a stop pay on their blackmail payment to these thieves?


8 posted on 10/16/2009 7:27:25 AM PDT by La Lydia
[ Post Reply | Private Reply | To 2 | View Replies]

To: InterceptPoint

The link in the article to PandaLabs is invalid, correct link is http://pandalabs.pandasecurity.com/archive/Rogueware-with-new-Ransomware-Technology_2221_.aspx

And has a list of valid serial numbers to disable the attacking software.


9 posted on 10/16/2009 7:29:38 AM PDT by knittnmom ("...only dead fish 'go with the flow'". - Sarah Palin 7/09)
[ Post Reply | Private Reply | To 6 | View Replies]

To: hiredhand; Ernest_at_the_Beach

Ping


10 posted on 10/16/2009 7:30:20 AM PDT by Squantos (Be polite. Be professional. But have a plan to kill everyone you meet)
[ Post Reply | Private Reply | To 1 | View Replies]

To: knittnmom

A couple of weeks ago my screen went blank then up comes one showing what looked like the My Computer screen, it showed flashing red triangles telling me that it was under a virus attack and to click something to stop it.

I didn’t do it, of course.

I X’ed the window and did a virus scan. It found nothing.


11 posted on 10/16/2009 7:30:47 AM PDT by GeronL
[ Post Reply | Private Reply | To 1 | View Replies]

To: Psycho_Bunny

See #11.

Have you heard of this before?


12 posted on 10/16/2009 7:31:35 AM PDT by GeronL
[ Post Reply | Private Reply | To 5 | View Replies]

To: knittnmom
Can't vouch for this
13 posted on 10/16/2009 7:33:30 AM PDT by JoeProBono (A closed mouth gathers no feet)
[ Post Reply | Private Reply | To 1 | View Replies]

To: GeronL

Same/similar thing happened to me. The bogus screen made it look as if it had come from Microsoft. And at first, the warning didn’t want to close. IIRC, I just rebooted and did a scan; nothing came of it, thank goodness.


14 posted on 10/16/2009 7:35:10 AM PDT by Daffynition (What's all this about hellfire and Dalmatians?)
[ Post Reply | Private Reply | To 11 | View Replies]

To: knittnmom

And I can’t download Adobe 10 so I no longer can watch Youtube videos. It says I am running a 64 bit browser and Adobe 10 only works on 32 bit browsers. Anybody have any solutions?


15 posted on 10/16/2009 7:38:59 AM PDT by csmusaret (Obama. The master of Jack, Squat, and the Nobel committee.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: InterceptPoint
"I hope we see an Ad-Aware/MalwareBytes/Spybot/HijackThis type solution to this one soon. I do “Tech Support” for 4 grandsons age 5-11 so I’m dealing with this sort of thing all the time."

Practically all of the computer viruses "in the wild" are designed to attack Windows exclusively. Why wear a such a big target on your chest? I surf the web using an operating system whose environment is alien and immune to those Windows-oriented viruses: Linux. No worries. You don't even use an AntiVirus program, although you could download a free one if it made you feel any safer. Your grandsons would find Linux just as easy to use as Windows, and probably easier. It is easier to install, too. I recommend Ubuntu or Linux Mint. All free, too.

16 posted on 10/16/2009 7:42:38 AM PDT by TexasRepublic (Socialism is a parasite that kills the host)
[ Post Reply | Private Reply | To 6 | View Replies]

To: Psycho_Bunny

I’ve been a victim of this one. Got past Norton.


17 posted on 10/16/2009 7:42:55 AM PDT by DManA
[ Post Reply | Private Reply | To 5 | View Replies]

To: La Lydia

I deal with these all the time with my work and I call them “extortion ware”. The companies look like they are based out of Russia, and unlike traditional viruses, it is not about bragging rights, it’s about cold hard cash.

These programs are designed to look legitimate, even going so far as scanning your system to find out what anti-virus you are using and modifying the “warning screen” to match it. I’ve seen screens that look like it came from Microsoft, Norton, McAfee, AVG, Avast and Panda.

They make money because many people assume that it came from their company and they need this new program from that company to clean off the viruses.

When people run their anti-virus or anti-spyware program, these nasty little pieces of extortion-ware unleash their trojans and infect the system something fierce.

Malware-bytes and Spybot S&D have been lifesavers for me and my clients when they get hit hard.

An FYI to Mac users who care. One of the Russian groups has put out a bounty contest on anyone who can infect a large group of Macs with a trojan and get verified reports back from the machines. Every Mac who sends a report back earns the creator of the virus 40 cents. This sounds like someone is finally going to go after the growing Mac user base. So be careful what you click on out in cyberspace.


18 posted on 10/16/2009 7:48:06 AM PDT by Anitius Severinus Boethius
[ Post Reply | Private Reply | To 8 | View Replies]

To: GeronL

I try to run scans every night (when I remember), I launch MalwareBytes one night, and McAfee the next. So far, so good.


19 posted on 10/16/2009 7:53:40 AM PDT by knittnmom ("...only dead fish 'go with the flow'". - Sarah Palin 7/09)
[ Post Reply | Private Reply | To 11 | View Replies]

To: csmusaret
And I can’t download Adobe 10 so I no longer can watch Youtube videos. It says I am running a 64 bit browser and Adobe 10 only works on 32 bit browsers. Anybody have any solutions?

there is no solution. Adobe has idiots working for them. No 64-bit Flash. No Flash for iPhone. Morons.

20 posted on 10/16/2009 8:01:37 AM PDT by montag813 (During times of universal deceit, telling the truth becomes a revolutionary act. -George Orwell)
[ Post Reply | Private Reply | To 15 | View Replies]

To: Anitius Severinus Boethius

I never click on ANYTHING unless I know exactly what it is. Creature of habit, dislike of change, ebay shopper. And I never open things I didn’t personally download.


21 posted on 10/16/2009 8:02:54 AM PDT by La Lydia
[ Post Reply | Private Reply | To 18 | View Replies]

To: montag813

Since this morning I am unable to play videos, music or anything.


22 posted on 10/16/2009 8:04:25 AM PDT by csmusaret (Obama. The master of Jack, Squat, and the Nobel committee.)
[ Post Reply | Private Reply | To 20 | View Replies]

To: InterceptPoint
According to "Cool computer tricks," to remove this spyware from your computer follow the steps given below.

Open task manager and stop this processes. TotalSecurity 2009.exe, tsc.exe, Sc2C21UvvM.exe.

Delete following files. Winsource.dll, tsc.exe Sc2C21UvvM.exe winsource.dll TSC.lnk Help.lnk Registration.lnk Uninstall TSC.lnk and also delete the directory at C:\Program Files\TSC.

Remove registry entries of this files. To do this open registry editor and press F3.Then search for tsc.exe. Delete all the entries of that file from registry. Now search for TotalSecurity and Total Security and delete those entries too.

Also look for winsource.dll file in registry and delete related entries from registry.

23 posted on 10/16/2009 8:05:05 AM PDT by La Lydia
[ Post Reply | Private Reply | To 6 | View Replies]

To: knittnmom
get Root !

24 posted on 10/16/2009 8:05:24 AM PDT by Uri’el-2012 (Psalm 119:174 I long for Your salvation, YHvH, Your law is my delight.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: knittnmom
My daughter got this a couple of weeks ago. Just booted to Ghost disk and restored to an image a day or so before. Back to normal in about 20 minutes.

This has been my saving grace more than a few times. Have your drive partitioned into at least 2 drives. Put your Ghost images on to D:drive. You are protected to the extent you keep your images up to date.

25 posted on 10/16/2009 8:11:10 AM PDT by chuckles
[ Post Reply | Private Reply | To 1 | View Replies]

To: La Lydia

Thanks!


26 posted on 10/16/2009 8:11:47 AM PDT by knittnmom ("...only dead fish 'go with the flow'". - Sarah Palin 7/09)
[ Post Reply | Private Reply | To 23 | View Replies]

To: knittnmom

I cannot vouch for that, I just came across it. The site seems legit, and I guess it can’t hurt if you remove only the things it stipulates. See if it works.


27 posted on 10/16/2009 8:12:48 AM PDT by La Lydia
[ Post Reply | Private Reply | To 26 | View Replies]

To: La Lydia
According to "Cool computer tricks," to remove this spyware from your computer follow the steps given below...

Perfect. Thanks.

28 posted on 10/16/2009 8:15:13 AM PDT by InterceptPoint
[ Post Reply | Private Reply | To 23 | View Replies]

To: GeronL

My daughter, unfortunately, DID click...and the virus totaled the system.

In the end, I had to reformat and do a clean install. NOT good!


29 posted on 10/16/2009 8:17:28 AM PDT by Mr Rogers (I loathe the ground he slithers on!)
[ Post Reply | Private Reply | To 11 | View Replies]

To: Mr Rogers

ouch. My laptop did not come with a restore disc... I need to make one... or two


30 posted on 10/16/2009 8:24:25 AM PDT by GeronL (They Made It Happen On Purpose Economically. MIHOPE)
[ Post Reply | Private Reply | To 29 | View Replies]

To: La Lydia
My daughter tried this and it no worky. See post #25.
31 posted on 10/16/2009 8:25:11 AM PDT by chuckles
[ Post Reply | Private Reply | To 23 | View Replies]

To: knittnmom

I’ve had my system infected by similar ‘rogueware’ programs in the past. It throws up a fake ‘You’ve been infected’ message and prompts you to go to a website to download the program to remove it. Some of the newer ones will cripple your system preventing you from using your antivirus or antispyware software.

What most people aren’t aware of is that you can reboot your system into ‘Safe mode’ and in this mode the rogueware in almost 99% of the cases can’t cripple your system. I then use Malwarebyte’s AntiMalware software. You can download it for free and it has always found and gotten rid of all these rogue programs.


32 posted on 10/16/2009 8:27:09 AM PDT by LoneStarGI (Vegetarian: Old Indian word for "BAD HUNTER.")
[ Post Reply | Private Reply | To 1 | View Replies]

To: La Lydia

I’ve seen those steps posted as well, but I urge extreme caution. Please, please be very wary of anything that instructs you go edit your registry. Even if this is a completely innocent attempt to help out, unless you are very skilled with computers and have experience with editing a registry, don’t take this approach. All it takes is one simple entry being accidentally erased in the registry to completely ‘brick’ a system. Once that’s done, it’s almost impossible to restore it. I’m a software engineer, I know this from experience.

The advice I’ve always given is go download MalwareByte’s AntiMalware software. It’s free (there is also a payed option, but I’ve never needed it) to download and update, and it has always located and completely removed any rogueware I’ve had on my systems or on other systems I’ve helped fix.


33 posted on 10/16/2009 8:35:28 AM PDT by LoneStarGI (Vegetarian: Old Indian word for "BAD HUNTER.")
[ Post Reply | Private Reply | To 23 | View Replies]

To: GeronL
See post #25. Get Norton Ghost and make an image of your drive. I have done a clean install, got all updates, installed 3rd party software with serial numbers, added Java, Adobe Reader, Flash and all the "have to" software, and made the image on another drive to start fresh if needed in the future. All documents are saved on another drive, all music/movies/ and e-mail are also saved to another drive. You can change the default store folder to wherever you want in most cases. Ghost will make backup updates as often as you tell it to.

The ideal situation is to just have your OS and program files on C: drive. If you have a crash or virus, you still have your "stuff" on another drive.

34 posted on 10/16/2009 8:37:37 AM PDT by chuckles
[ Post Reply | Private Reply | To 30 | View Replies]

To: LoneStarGI
My daughter was able to boot to safe mode, but Malwarebytes was disabled. All spyware programs wouldn't load. We uninstalled and re installed from a thumb drive and it still wouldn't load. We tried SpyBot and Addaware and none would load. The spyware looks for these programs and disables them.

Instead of messing around with regedit and uninstalling and re installing for hours with all the reboots and headache, just get Norton Ghost. Been there, got the T shirt.

35 posted on 10/16/2009 8:45:16 AM PDT by chuckles
[ Post Reply | Private Reply | To 33 | View Replies]

To: chuckles

How much is Ghost Drive?

I could burn all the important stuff on DVD’s couldn’t I?

The smaller stuff could be put onto a flash drive? Mine is only 4GB.


36 posted on 10/16/2009 8:51:40 AM PDT by GeronL (They Made It Happen On Purpose Economically. MIHOPE)
[ Post Reply | Private Reply | To 34 | View Replies]

To: LoneStarGI

This was no pop-up window.

It looked like my computer and not something from the internet. Thats what was new about it. I’m glad I didn’t click it.


37 posted on 10/16/2009 8:56:11 AM PDT by GeronL (They Made It Happen On Purpose Economically. MIHOPE)
[ Post Reply | Private Reply | To 32 | View Replies]

To: GeronL
Norton Ghost is a software program. You can get it for various prices if you look at Ebay and other places. I wouldn't pay over $30 bucks. Another option is to buy an older version. It isn't necessary to get the latest and greatest. I used version 9 forever. I just recently got version 14. Version 9 was working fine.

Norton Ghost will save an image of your whole drive into a file that you need to put somewhere else. If your computer only has one drive, you can partition it into 2 drives( or more) and save the image to the other partition. If you have the money, just buy a second drive and install it as a slave drive. What that does is it assures you that if drive C is damaged and won't even format, then you still have your image. If you have a DVD burner, you can burn the image file to DVD's. If your Image is under 4.35 GigaBytes, it may fit on just one disk. You can also put the image on a thumbdrive if it is large enough to hold it. WalMart recently had 20 Gig dives for $20. They are much cheaper on Ebay but you can get one today if needed. I have several drives for myself, but that is just me. I have several Ghost images in various places for different reasons. I convert home movies, save movies, and music, and have large files when needed. If I had spent several hours and even days working on converting home movies and then stored it on C: drive and the caught one of these viruses, I would be very disappointed and may have to vent with my .45 Colt.

38 posted on 10/16/2009 9:29:24 AM PDT by chuckles
[ Post Reply | Private Reply | To 36 | View Replies]

To: chuckles

I can’t afford anything right now. Its just going to have to not get infected for a while. =o)


39 posted on 10/16/2009 9:33:28 AM PDT by GeronL (They Made It Happen On Purpose Economically. MIHOPE)
[ Post Reply | Private Reply | To 38 | View Replies]

To: LoneStarGI

Thank you. But I am a Mac person, so I think I am not threatened by this particular menace. You might want to post this to the others on here who thanked me.


40 posted on 10/16/2009 9:35:49 AM PDT by La Lydia
[ Post Reply | Private Reply | To 33 | View Replies]

To: chuckles

It no worky for me, because I am a Mac person. As I said above, I can’t vouch for it, I only came across it. Must have worked for the person who thanked me. Maybe your daughter has a different virus. Maybe she should be looking at a Mac instead of a PC. I am very low tech, and since changing, haven’t had any problems.


41 posted on 10/16/2009 9:38:34 AM PDT by La Lydia
[ Post Reply | Private Reply | To 31 | View Replies]

To: knittnmom

Had something similar a year ago. It was a nightmare. Get Malwarebytes anti-malware beforehand. That’s what fixed my system. It’s free, also.


42 posted on 10/16/2009 9:38:57 AM PDT by mysterio
[ Post Reply | Private Reply | To 1 | View Replies]

To: Squantos

From the sounds of it, my brother had something VERY similar. He told me what he was doing when he started having the problem. It turned out to be a malicious site which exploited a hole in IE 7. We managed to get rid of the thing with Symantec AV, but it was a regular PITA I tell ya!


43 posted on 10/16/2009 5:46:47 PM PDT by hiredhand (Understand the CRA and why we're facing economic collapse - see my about page.)
[ Post Reply | Private Reply | To 10 | View Replies]

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
General/Chat
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson