• Security incident: ISF was recently accessed by intruders. Please change your password, and change it anywhere else you used it. Read more

Virus/ trojan posing as security software

Dancing David said:
More recently people have been inserting stuff into Google images, and then there are hoardes of other trojans: screen savers, coupon programs, toolbars.
Click to expand...

Oh yeah. I'm a PC technician, and I meet this on a daily basis. It's amazing the ways this kind of malware is making it's way into the mainstream, even on completely legit sites.
 
Driftwood said:
Oh yeah. I'm a PC technician, and I meet this on a daily basis. It's amazing the ways this kind of malware is making it's way into the mainstream, even on completely legit sites.
Click to expand...


How does it get into legit sites? Some examples of sites it's crept into that we should be wary of..?
 
picture.php
 
So what can this malware actually allow an intruder to do with a police computer? Can he access confidential records? Run license plates? Get info like home addresses from licenses and registrations? Get Social Security numbers? Change or delete records? Make licenses look suspended? Make it look like some citizen is an escaped murderer? This sounds like a much more serious problem than if the average office drone screws up his desktop. Does senior management have any interest in this? Do police really need full-functioned laptops, or would they be better served by a dumb terminal linked directly to secure computers at headquarters?
 
Bob001 said:
So what can this malware actually allow an intruder to do with a police computer? Can he access confidential records? Run license plates? Get info like home addresses from licenses and registrations? Get Social Security numbers? Change or delete records? Make licenses look suspended? Make it look like some citizen is an escaped murderer? This sounds like a much more serious problem than if the average office drone screws up his desktop. Does senior management have any interest in this? Do police really need full-functioned laptops, or would they be better served by a dumb terminal linked directly to secure computers at headquarters?
Click to expand...

Wrong side.

It prevents the computer to be used for police work.
 
AdMan said:
How does it get into legit sites? Some examples of sites it's crept into that we should be wary of..?
Click to expand...

Mostly through ad banner rotation. The little ads on the tops and sides of web pages. Most adservers aren't really aware of what they're putting into rotation as long as they get paid for the service, at least, the more shady ones don't.

So you can be browsing a legit site, hit a malware infested ad, and *boom* Win 7 Security 2011.
 
AdMan said:
How does it get into legit sites? Some examples of sites it's crept into that we should be wary of..?
Click to expand...

Um it varies but basically any web host that does not run regular security sweeps the pages it is hosting. And does not have a sysadmin who is doing their stuf. So like our school district stopped supporting user generated pages or PTA generated pages.
 
Bob001 said:
So what can this malware actually allow an intruder to do with a police computer? Can he access confidential records? Run license plates? Get info like home addresses from licenses and registrations? Get Social Security numbers? Change or delete records? Make licenses look suspended? Make it look like some citizen is an escaped murderer? This sounds like a much more serious problem than if the average office drone screws up his desktop. Does senior management have any interest in this? Do police really need full-functioned laptops, or would they be better served by a dumb terminal linked directly to secure computers at headquarters?
Click to expand...

Um most of it will just lockup the desktop, now some variants are very deep and will gather passwords, which if it snags one with high level admin privileges could be a problem.
 
Driftwood said:
Mostly through ad banner rotation. The little ads on the tops and sides of web pages. Most adservers aren't really aware of what they're putting into rotation as long as they get paid for the service, at least, the more shady ones don't.

So you can be browsing a legit site, hit a malware infested ad, and *boom* Win 7 Security 2011.
Click to expand...

OOOOOOoooooooooohhhhhhhhhh, that sucks.

And explains a lot.
 
There does seem to be a recent increase in these things, I have cleaned 3 computers in the past 2 days that the users have been scammed into installing.
Nothing freaks out a basic user more than getting the "you have a virus" warning flashing all over the screen. Even when they know not to push the ok/buy/install button it is too hard for them not to.

Thats what keeps ups computer "experts" in business, I guess
 
bryan said:
Thats what keeps ups computer "experts" in business, I guess.
Click to expand...
The fellow who bailed me out was worth every penny I paid him.

Have you ever seen the USB drivers go to hell after one of these trojans?

~~ Paul
 
Two ways to reduce your chances of getting infected when you're surfing the web on Windows:
  • Use Firefox with the NoScript add-on. JavaScript is a favoured vector these days for malware infections; NoScript refuses to let third-party JavaScript code run when you surf to a site. (I've seen some sites go to as many as 20(!) other sites for JavaScript when I connect to them.) It does make things a little harder to work with in today's hyper-connected Web 2.0 world, but that very hyper-connectedness is what's helping fuel these infections.
  • Use the MVPS Hosts file to prevent any web-enabled program on your system (web browser, email client, RSS news reader, Adobe Reader, music player) from connecting to advertising sites by giving them a fake IP address.
 
Last edited:
Blue Mountain said:
Which is why you want to be running ad blockers and JavaScript blockers. Surfing the net without them these days borders on insane.
Click to expand...

I agree, but the problem arises when companies complain that they're getting no ad impression feedback. That makes for more persistent ad pushes. It's almost a self sustaining cycle. You get ads, people block the ads, the ads get more outrageous, you block the javascript, ads get even more intrusive, and now you've got a problem.
 
You must log in or register to reply here.

Share this page

ISF - Join now!

Every member here is approved by hand. No bots, no spam, just people who care about evidence and honest debate.

Membership is free!

Create your free account

Back
Top Bottom