PDA

View Full Version : Anatomy of a Web Based PC Attack


LarryFlowers
09-15-09, 09:17 AM
I was able to document a recent attack on a client's PC from the latest iteration of a very agressive fake anti virus software scanning program.

No web site seems to be immune from this attack and it appears to be finding it's way onto the web sites via advertising. CNN, MSNBC, The New York Times and hundreds of other legitimate sites have been affected.

This particular attack was the result of a Google search...

In pictue attack1, the user was searching for dol sized football helmets for a promotional item they were working on.

In picture attack2, note 2 things.. McAfee site advisor is installed and is placing green checkmarks next to search results it has determined are safe... and look at the 5th result on this page "Doll-baby prince william doll..." and note the lack of a green checkmark, replaced by a question mark. The user clicked on it anyway...

In picture attack3, this is what happened when the user clicked on the google link. No matter what you click on... ok, cancel or the red X.. you get picture attack4.

This is a very realistic looking page that appears to be scanning your PC, which of course it is not doing.

In picture attack5, you see the very official looking Windows Security Alert pop-up listing your supposed infections.

If you attempt to cancel, or close the window, it won't. Any attempt other than to click on "remove all" delivers no result.

In attack6 you see the only thing you can do at this point... open the Task Manager and shut down all of the browser related processes that are running.

In attack7 you see the results of a Malwarebytes scan that was run immediately after this attack. Vista and Windows 7 machines will not have any changes made to them, the Malwarebytes scan of an XP machine will show results which Malwarebytes will successfully remove.

harsh
09-15-09, 09:32 AM
I was dinged by this one this past weekend on my XP box using Firefox 3.5.3. I recognized what it was right away, but I have to say that I'm glad I don't depend on XP for anything important.

Somewhere along the line, Avast! picked up on it and squashed something.

My adventure was also the result of what appeared to be a legitimate Google link.

I get the sneaking suspicion that is has to do with some sort of hole in Flash-based ads but I haven't delved into it to find out for sure.

ncxcstud
09-15-09, 10:06 AM
the church secretary's computer got hit with a virus like that the first full week i was here...

What made it even more malicious is that it prevented the opening of ANY anti-virus or malware removal program (apart from the one that it kept trying to make me download/install). It was easy to fix...just change the name of the program to XXX or something else and malwarebytes ran fine...

wingrider01
09-15-09, 10:43 AM
the church secretary's computer got hit with a virus like that the first full week i was here...

What made it even more malicious is that it prevented the opening of ANY anti-virus or malware removal program (apart from the one that it kept trying to make me download/install). It was easy to fix...just change the name of the program to XXX or something else and malwarebytes ran fine...

Had to rebuild my wife's machine this past weekend for this exact issue, and she was looking for the local humane society website. Ended up restoring the image from Windows Home Server on it, so she was not out a lot of data.

Not sure if it was flash or not, I had just updated it recenlty on her machine to the lastest released version of it.

Just got this from Trend Micro's RSS feed

http://blog.trendmicro.com/malvertisements-in-nytimes-com-lead-to-fakeav/

rudeney
09-15-09, 02:47 PM
My mother-in-law had this on her PC a few weeks back. I was able to remove it fairly easily. It was a matter of stopping some processes and deleting some files. It seems to be fairly benign (i.e. no damage to data), but it makes the computer practically unusable as everything you click on starts a "scan" and reports infections. Apparently, it's a ploy to get unsuspecting users to pay to "upgrade" to their Internet security software.

Greg Alsobrook
09-15-09, 03:09 PM
Very nice documentation Larry.

These faux anti-virus programs are becoming very prominent these days... Personal Antivirus, Antivirus 2009, etc. I feel very sorry for anyone that inputs their credit card numbers into one of these.

rudeney, some may very well be benign, but I promise you they can get very nasty. I've seen them lock down internet access, selectively restrict internet access, and set various "permissions" all over the computer... Not allowing you into the task manager or msconfig, not allowing you to install or run programs, etc... even in safe mode!

Unfortunately, as Larry pointed out, these things are starting to sneak their way onto what may seem like (and should be) "harmless" sites. These days, you don't have to be doing anything "you shouldn't be doing" to obtain one.

SayWhat?
09-15-09, 03:54 PM
Very nice documentation Larry.



Would be better if the images had been optimized down to 50K or so instead of around 200K each.

Marlin Guy
09-16-09, 06:53 AM
Ha ha! :lol:

I see these all the time.
On average, I remove it from 10 PC's a month. It's a simple fix, but it does confuse the average clueless Windows user.
Safe Mode, Autoruns Utility, then a complete scan with Malwarebytes.

Most antiviruses don't nip it in the bud, because it's a socially engineered "program" rather than a virus. The user authorizes it when they click the screen.

Alt+F4 kills the screens without infecting the PC.

Drew2k
09-16-09, 07:45 PM
Would be better if the images had been optimized down to 50K or so instead of around 200K each.My browser resized the images for me, so I had no problems, but I could see how it's easier to complain about Larry's work. :rolleyes:

Tom Robertson
09-16-09, 08:20 PM
the church secretary's computer got hit with a virus like that the first full week i was here...

What made it even more malicious is that it prevented the opening of ANY anti-virus or malware removal program (apart from the one that it kept trying to make me download/install). It was easy to fix...just change the name of the program to XXX or something else and malwarebytes ran fine...

I cleaned our Pastor's computer recently. McAfee almost protected against it, but it was socially engineered very well.

At that point in time, malwarebytes was the only scanner that cleaned it up. McAfee didn't have it in their database yet.

By the way, this one disabled taskmanager (and many other programs) by putting them in the Windows debug list.

Cheers,
Tom