Memoirs Of An IT Guy

Overview

Throughout the last couple of years, scareware (a.k.a. fake security software), emerged quickly as the single most profitable money-making strategy for cybercriminals to leverage on. Due to aggressive advertising practices used by the cybercrime syndicates, thousands of users fall victim to the scam on a daily basis, with the syndicates themselves earning loads of dollars in the process.

What is a Scareware?

Scareware, also known as rogueware or fake security software, is a legitimately looking application that is delivered to the end user through the internet traffic derived from compromised web sites, malicious advertising, or keywords hijacking in order to serve scareware. It’s objective is to trick the user into believing that their computer is already infected with malware, and that by purchasing the application will help them get rid of it.

Once executed on a computer, some scareware will not only prevent legitimate security software from starting, but it will also prevent it from being updated. This is to ensure that the end user will not be able to get the latest anti-virus updates. To worsen the situation, it will also make its removal a cumbersome process by blocking system tools and third-party applications from executing.

There had also been cases where scareware with elements of ransomware that encrypt an infected user’s files, and demanding a purchase in order to decrypt them.

How to spot Scareware?

As scarewares are usually used by syndicates, they tend to use a standard template for distribution. Hence, scareware sites all share a very common set of deceptive advertising practices, which can easily help you spot them before making a purchase.

For instance, most scareware sites try to make their sales pitch more realistic and credible by using “non-clickable” icons of reputable technology web sites and performance evaluating services, such as PC Magazine Editors’ Choice award, Microsoft Certified Partner, ICSA Labs Certified,  Westcoast Labs Certified, Certified by Softpedia, CNET Editors’ Choice, and ZDNet Reviews. None of the real services are aware of the scareware’s existence.

Another popular social engineering tactic are the fake comparison tables or charts, where the scareware clearly outperforms some of the leading security companies’ software.

Since most end-users won’t really go about double-checking these claims, and with the impulsive buying urge created by a potential warning of data loss, most end-users fall into the trap of installing the fake security software. The attached screenshot shows how three different scareware brands (Virus Shield 2009, Windows Security Suite and Malware Destructor 2009) are all using the same template claiming their superiority over legitimate security software.

The wide range of tactics used leads us to the most common fear-driven social engineering tactic of simulating a real-time antivirus scanning in progress dialog, which in reality is nothing else but a static script pretending to be running a real virus scan.

The scanner’s results are fake and in fact the software had absolutely no access to your hard drive. Therefore the claims that “You’re Infected!; Windows has been infected; Warning: Malware Infections founds; Malware threat detected” should be treated as a fear generating tactic.

Another key trait of a scareware site is the professional site layout, as well as the persistent attempts to rebrand the template and divert the end user’s attention from the previous brand’s increasing bad reputation across the web. When combined, these would result in an efficient social engineering scam that continues entrapping thousands of victims on a daily basis.

What can I do to avoid Scarewares?

1. Use legitimate internet security softwares. TotalVirus.Com is a good website that maintains a list of recognised legitimate security softwares. Never use a security software that you’ve never heard before, regardless of its price or recommendation on the Internet. My personal choice is Norton 360 which you can also get online ( USA version | South Asia or Singapore version ).
2. Always reject an offer from the Internet or email to scan your hard drive for malicious codes or viruses. If you have installed a legitimate security software, you have full control on when you want to do a scan. There is no necessity to accept any offer to have your hard drive scanned.
3. Always make sure your legitimate internet security software has its real-time auto-protect scanning feature turned on. This is one way to ensure stoppage of 99.9% of scareware infections as no one internet security software is perfect.

What can I do if I have been attacked by Scareware?

1. If you managed to realise it at the point of time when the fake security scanning just started, shut down your web browser immediately and unplugged your network cable ( if on wireless, turn the WiFi switch off ). Chances are the infection may not have commence.
2. If you are not able to shut down your web browser, or your apps aren’t responding, you might be infected by the scareware already. Try typing the keys [Alt] (holding the key down) and [F4] together on your web browser. If this doesn’t work, download and unzip this Windows shortcut onto your Windows desktop. It can be a handy tool to force shutdown your Internet Explorer when you suspect an infection in progress.
3. The following free resources can provide tools and advice you will need to attempt removal.
   • Malwarebytes, a very reliable anti-malware company, offers a free version of Malwarebytes’ Anti-Malware, a highly rated anti-malware application which is capable of removing many newer rogue applications.
      
   • 411 Spyware – a site that specializes in malware removal. I highly recommend this site.
      
   • Bleeping Computer – a web site where help is available for many computer related problems, including the removal of rogue software. This is another site I highly recommend.
      
   • SmitFraudFix, available for download at Geekstogo is a free tool that is continuously updated to assist victims of rogue security applications.