Rogue:MSIL/Zeven wants a piece of the M S E's pie

[JMH]

A new rogue has started making its appearance from compromised websites: Rogue:MSIL/Zeven. We received a sample (70be8ca73142922fd78acf2aafa9f141a977f15a) and a URL and began our investigation.

Let us say from the beginning that the guys behind this rogue like to copy big-time. They start by auto-detecting what browser the user is currently using, and then faking the malware warning page if the browser is Internet Explorer, Chrome, or Firefox. This is meant to be a social engineering scheme in order to trick the user into downloading and installing the rogue, relying on the user’s trust of his day-to-day browser.

The similarity between the fake warning pages is so accurate that it can trick even highly trained eyes.

In the Firefox page, for example, you can see it’s not the real warning page because they misspelled ‘out’ and wrote ‘Get me our of here’.

But for all three browsers, a common indication that you are not looking at the actual browser warning is the offer of some sort of an “update” or “solution”. All the “updates” point to a copy of MSIL/Zeven that promises to provide “a new approach to windows detection”. Internet Explorer, Firefox, and Chrome do not offer such a solution when a website is blocked.

More -
Rogue:MSIL/Zeven wants a piece of the Microsoft Security Essentials pie - Microsoft Malware Protection Center - Site Home - TechNet Blogs

 

[G1LLY]

Thanks

I just came across this on another site & found this image as well, I find it very amusing that these people can create stuff like this but can't even spell simple words correctly, if you can see the image below they have written THREADS instead of THREATS, not once but 10 times LOL!