Windows 7: Rogue Antivirus Victims Seldom Fight Back

JMH · 28 Jul 2010

Quote:

Recently I came into possession of a series of documents showing the financial books of an organization that orchestrates the distribution of rogue anti-virus attacks or “scareware,” programs that hijack victim PCs with misleading security alerts in an effort to frighten the user into purchasing worthless security software. I found many interesting details in this data cache, but one pattern in the data explains why scareware continues to be a major scourge: Relatively few people victimized by it dispute the transaction with their bank.

The documents list the amounts charged to more than 2,000 people around the world (the screen shots show the distribution of victims globally and in the United States). Victims paid anywhere from $50 to $100 for the fake anti-virus software. The file lists the amounts charged, partially obscured credit card numbers, and the names, addresses and e-mails of all victims.

More importantly, they show that only 367 victims — fewer than 20 percent — bothered to contact their bank or the scammers to reverse the fraudulent charges after the fact.

A second wave of attacks apparently conducted by the same malware gang in early April shows that only 163 out of 1,678 victims – fewer than 10 percent — initiated chargebacks or disputed the sales (the geographic distribution of victims of this second wave is not included in the Google Maps graphics shown here).

I interviewed more than a dozen victims of the first scareware attack, which occurred between April 12 and April 15. All said their computers became unusable and that the only way they could figure out how to regain control of the machine was to surrender and purchase the software. In each case, immediately after the victims submitted their payment information, the hijacking program disappeared, leaving no trace of itself, and no hint of any fake security program on the victim’s machine.

More -
Hacked Companies Hit by the Obvious in 2009 — Krebs on Security

Layback Bear · 29 Jul 2010

I think the answer is the price. It's cheaper to pay the bad guys than a I.T. person to clean out the bug. Of course one should try to find out how the program got on the computers in the first place.

chev65 · 29 Jul 2010

This fake A/V scanner has been hiding all over the internet under fake links with different names that have no indication that it's a bad link. I can't say why anyone would actaully believe this is a real scanner. If it does make it into your machine it's easily removed with Malwarebytes. I can't imagine how much money is being made with this bogus software but it's a huge scam that needs to be stopped.

Petey7 · 30 Jul 2010

Quote: Originally Posted by chev65

. I can't imagine how much money is being made with this bogus software but it's a huge scam that needs to be stopped.

According to this, these programs make about $150000 a month in the US alone.

Also, I have seen many a rouge AV that could keep MalwareBytes from running properly. In those cases, someone, somewhere on the net has made a complete list of files, their locations, and registry keys for every rouge AV that has been out for more than a month. A quick trip in to safe mode is how I've removed them from dozens of PCs.

Tews · 30 Jul 2010

Another prime example of why a robust backup plan, including system imaging, is the most important key in system security. Unfortunately, it is the most overlooked, and thus the weakest link in the security chain...

Windows 7: Rogue Antivirus Victims Seldom Fight Back

Rogue Antivirus Victims Seldom Fight Back problems?