NWA-PCUG Newsletter Article, February 2010
Scumware and Scareware Warning and Removal
By Ira Wilsker, APCUG Director;
Columnist, The Examiner, Beaumont, TX; Radio & TV Show Host

iwilsker@apcug.net
(click to email author)

WEBSITES:
http://www.fbi.gov/pressrel/pressrel09/popup121109.htm
http://www.usatoday.com/tech/news/2009-06-09-cybergangs-scareware-hackers_N.htm
http://www.networkworld.com/news/2009/101909-scareware.html
http://blogs.zdnet.com/security/?p=4297A>
http://online.wsj.com/article/SB123976230407519659.html
http://www.malwarebytes.org/mbam-download.php
http://www.malwarebytes.org/mbam/database/mbam-rules.exe
http://www.emsisoft.com/en/software/free/
http://download1.emsisoft.com/a2usb.zip
http://www.threatfire.com
http://www.microsoft.com/security/malwareremove/default.aspx

Many of you have had the experience of having a popup or window open on your computer that tells you that your computer is infected with a substantial quantity of viruses, worms, Trojans, and other forms of spyware. Typically, these warning messages, which may appear to be authentic Windows warnings, instruct the user to “click here” to remove the malware. Upon clicking, another window opens which solicits a fee, typically $29.95 to $49.95 (or more) to purchase software to remove the infection. The software being offered has an attractive and professional looking interface, and often carries a name that is intended to inspire confidence, sometimes even being similar to reputable product names that we have heard of before. Trying to close the window often results in the popup reappearing again, almost instantly. If we choose to ignore the warning or close it, it may continue to reappear whenever we click on a webpage, open our own already installed programs or security software, or randomly. These warnings may “scare” us, or become so intrusive that many of us will pay to purchase the recommended software to clean our computers of malware and restore the usability of our machines. By doing so, at a minimum, we just became the victim of a scam that according to the FBI has duped Americans out of an estimated $150 million.

If it was only money that was lost, the damage would be bad enough, but the infection and hijacking that produced the popups and warnings in the first place may have also destroyed our existing antivirus software, deactivated our firewall, transmitted our vulnerabilities to unknown miscreants, and made our computers vulnerable to continued attacks. Purchasing, downloading, and installing this rogue software may possibly also open us up to even worse attacks such as turning our computers into spam sending zombies that can generate massive income for the zombie master. Other identified hazards of this software may include the installation of keylogging software to steal our usernames, passwords, and credit card information to be sold on illicit websites for criminal purposes including credit card fraud and identity theft. Simply put, your computer may physically be in your home, but for all practical purposes it belongs to some crook somewhere who in reality has control over it for nefarious and pecuniary reasons.

This may sound like science fiction or the theme of an action movie, but the scenario is a sad reality that has been repeated on millions of personal computers. The victims of this scam may have visited websites, often legitimate websites, that have been victimized themselves by hackers who installed the dangerous code that can infect a computer by simply opening a webpage, causing the malware to be loaded onto the victim computer. In some other cases the infection can occur by clicking on an apparently authentic looking online advertisement, opening an email attachment, or simply doing other online activities. A lot of the victims clicked on links posted on Twitter, YouTube comments, instant messages, links illicitly planted in search engine results, and ads posted on legitimate websites. Many of these “drive-by” infections are explicitly designed to evade antivirus and anti-spyware software, and once on the computer, may destroy the ability of the antivirus and anti-spyware to provide any future protection. The authors of this malware are smart, and if the legitimate security software is indeed neutralized, it will still appear to load and even update, as well as display the program icon in the tray by the clock, giving the user a false sense of security that his computer is still protected. Not just is the computer no longer protected, but some of the malware sends out invitations to other cyber crooks to visit the “buffet” of purloined computers and help themselves to the bounty of goodies that may be available, as well as allow them to install additional spyware and malware on the victimized computer.

Some of this illicit activity is done in a “multi-level marketing” or pyramid model where cyber criminals can pay the master crook for access, and then resell this access to others, who can then sell to others, each paying a fee or commission that is passed up the line to the master crook. This is not some obscure threat or risk that we face, but a very common occurrence. According to the security company F-Secure’s senior researcher Mikko Hypponen, one of these master criminals recently ran a contest offering a $36,000 Lexus sedan to the top-selling affiliate. According to a report in USA Today, in 2008, “… SecureWorks researcher Stewart infiltrated a Russian group known as the Baka Software gang. He accessed documentation showing one affiliate earned $146,525 in 10 days by spreading promotions for a worthless program, called Antivirus XP 2008, to more than 154,000 people, and closing sales to 2,772 of them. Another record showed five top Baka Software affiliates earning weekly commissions averaging $107,604.” In another example of the degree of infection, Microsoft reported that its Malicious Software Removal Tool found one specific fake security program on 4.4 million computers! There are hundreds or thousands of these rogue programs currently infesting countless millions of computers. This begs an answer to a rhetorical question; would you really want to give your credit card number and security code to a crook that is probably in Russia? If you fell for this scam, contact your credit card company immediately and tell them what happened; also ask them to chargeback the charges made on your card by the crooks.

If you feel that you have been victimized there are some free utilities that can likely detect and kill the malware. Since much of this malware will not be initially detected by the protective software on our computers, and may in fact neutralize the protection that we do have, simply performing a scan with the security software we already have may provide little or no benefit. It should also be noted that if the user cannot access the websites of the legitimate utilities that can detect and kill the malware, that is a sure symptom that the victim computer is under the control of the cyber crook.

I am now receiving daily emails and phone calls from people describing a similar problem, complete with the typical symptoms of a scumware or scareware infection. I have had very good results with a few free utilities that will likely detect and kill the malware, and remove it from our machines. While there can be no guarantees that they will continue to work well, they do have a proven track record, and so far, have fared well in this “cat and mouse” game where the cyber crooks keep developing something new, and the security companies have to come up with a way to detect and kill the infection.

My first choice is Malwarebytes Anti-Malware, available for download from http://www.malwarebytes.ORG. I emphasized the “.ORG” because there have been knock-off websites with other upper-level domains designed to explicitly scam people looking for the authentic product. Malwarebytes has both a free version and a commercial version. As is customary, the paid commercial version has more features and capabilities, but the free version is fine for detecting and removing most malware. Download it (probably from a link redirecting the user to CNet’s Download.com), install it, update it, and perform a scan. A quick scan will detect malware in the most common locations in just a few minutes, but a full scan will be much more thorough, and may take an hour or two to run. If the user cannot directly access the malwarebytes.org website, but is redirected somewhere else or totally blocked, then that is a sure sign that the computer has been hijacked. If this happens, download Malwarebytes to another computer, and copy it to a flash drive or CD, and install it from that media. It may also be a good idea to manually download the latest updated signature files (called “rules”), from http://www.malwarebytes.org/mbam/database/mbam-rules.exe, as access to the update server may also be blocked on the infected computer. Install the Malwarebytes on the infected computer, and then run the file mbam-rules.exe to update the software. If there is memory resident malware detected, Malwarebytes may direct the user to reboot the computer, and Malwarebytes will then automatically rerun at boot, killing the malware before it can load. Update it and rerun it frequently to help keep your computer clean of malware.

The other utility that I use along with Malwarebytes to detect and kill malware is A-Squared Free, available for download from http://www.emsisoft.com/en/software/free/. A-Squared Free has a commercial sister product, A-squared Anti-Malware (http://www.emsisoft.com/en/) with more features and a memory resident component that provides real time protection in addition to the security software already on the computer. Both versions also integrate a full featured virus scanner to detect more than most other scanners. Download one of the versions of A-Squared (the free version is adequate if the user only wants to detect and remove malware and viruses), install it, and update it. Do a quick scan for a quick clean, and a deep scan to detect more potential threats. A-Squared also detects fragments, or pieces of code that may be a threat. Since a detector as sensitive as A-Squared may occasionally detect a file and label it as a threat, but it is really a false-positive, I choose to initially quarantine anything that is found, rather than delete it. That way, I can recover any files that may have been misdiagnosed. A-Squared is another product whose website is commonly blocked by malware, in order for the malware to protect itself from removal. If that happens, the A-Squared software can be downloaded to another computer, and copied to a flash drive or CD, and installed from that. An alternative designed explicitly for just such an occurrence is A-Squared Emergency USB Stick Files (download1.emsisoft.com/a2usb.zip). This version, which is kept up to date continuously on the Emsisoft website, is a 67mb download which contains all of the necessary files, is intended to be copied to a flash drive, and installed on the infected computer from that media.

After the computer is cleaned of malware, the user will often notice a marked increase in performance. Do not be complacent, because you may still be victimized even though your computer is likely clean. Since your logons, user names, and passwords may have been compromised, it would be a good idea to change them, and repeat the scanning process on a frequent and regular basis. It may also be necessary to reinstall your security software, as it may have been destroyed by the malware. Consider installing another layer of security that works in addition to your security software, and enhances your protection, making a re-infestation less likely. The paid commercial versions of Malwarebytes or A-Squared Anti-Malware would be good choices, or a freeware product such as Threatfire (http://www.threatfire.com) would provide enhanced protection in addition to the traditional security software.

Click here to return to top



==================================================================