Showing posts with label SmitFraud. Show all posts
Showing posts with label SmitFraud. Show all posts

Tuesday, November 25, 2008

New Blogspot Trickery?

This last weekend I was perusing the Blogspot domain for fake\rogue pages which re-direct users to fake scans to get malware installed. Or to try and goad users into purchasing fake security software, which in and of itself is also malware.

As I was tracking the sites, which btw is easy as pie if you know what to look for, I noticed a new trick they use. Instead of either having a pop up box which just slides down the page as you scroll or have you click a link to generate a pop up, they have the page load and if you click anywhere on the page, a new instance of IE starts up, at a fake scan page. No matter where on the page you place your mouse, if you click, that's what happens.

I'm having a look at how this is done and will provide more on that as I get the info.

I'm not coder by any strecth, so I need to talkk to someone who is.

Saturday, September 13, 2008

Busy Rogue Week

This last week has been one of the busiest for new rogues and new variants of existing rogues.

The IEDefender, Files Secure, Malware Bell, IE Antivirus, Total Secure 2000 family has been updated 5 times!

New rogues or just clones of another:
  • XP Protector 2009-Antivirus XP 2008 clone
  • Antispyware PRO XP
  • MS Antivirus-new variant
  • XP Antivirus transofrms to MS Antivirus then to Micro Antivirus
  • Advanced Antivirus-related to Vista Antivirus 2008, Antispyware 2008 XP, System Antivirus 2008, Internet Antivirus, Smart Antivirus 2009
  • Power Antivirus-family from Vista Antivirus 2008, Antispyware 2008 XP, System Antivirus 2008, Internet Antivirus, Smart Antivirus 2009, MS Antivirus, Advanced Antivirus
And of course we've had a bunch of new Zlob spewing sites as well.

It's good to see the bad guys are quickly making new variants as this indicates that the good guys are tracking them just as quickly. Bit of cat and mouse I suppose but with the recent fall out from the Brian Krebs Security Fix write ups, the cat seems to have sharpened it's claws a bit.

Zlob\Rogues [IEDefender-File Secure-Total Secure 09\Sept 13]