You have probably seen a popup on your computer screen informing you that your computer is infected with a virus or some other malware, and that they can eliminate the problem by buying the virus scanner and removal program.
Most of you know that this is a scam.
(http://i43.tinypic.com/e96d6w.jpg)
ExploitJavaBlacole.BX11
So earlier this month, the FTC announced a malware victim compensation plan that the victims of a bogus scareware scam would be receiving checks as settlement for the deceptive practice perpetrated by several virus scanner defendants.
FTC to send checks
The FTC would be sending checks to more than 300,000 consumers who were victims of a “scareware” scam. The settlements involving the FTC and with the company Innovative Marketing and other parties taking part in the scheme meant that defendants agreed to surrender more than $8 million total in scam gains. “Winfixer,” “Drive Cleaner,” and “XP Antivirus” were sold to “fix” their non-existent problem.
Microsoft Malware Protection Center (http://blogs.technet.com/b/mmpc/archive/2011/12/14/ftc-to-refund-rogue-security-software-victims.aspx)
Microsoft was involved in the protection action because some of the programs invoked the Win32 system. The following programs were linked to the “Winfixer” family of programs.
• Program:Win32/AdvancedCleaner (http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Program:Win32/AdvancedCleaner)
• Program:Win32/Antivirus2008 (http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Rogue:Win32/Winwebsec)
• Program:Win32/Antivirus2009 (http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Program:Win32/Antivirus2009)
• Program:Win32/SpywareIsolator (http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Program:Win32/SpywareIsolator)
• Program:Win32/WinFixer (http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Program:Win32/Winfixer)
• Program:Win32/WinSpywareProtect (http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/WinSpywareProtect)
• Trojan:Win32/Antivirusxp (http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Antivirusxp)
(http://i41.tinypic.com/w03ms9.jpg)
Rogue programmers brand their programs with legitimate sounding names to appear as legitimate security scanners. The following is a (partial) list of some names that are associated with the rogue security software detection programs:
AdvancedCleaner
AntiMalwareGuard
AntiSpywareExpert
AntiSpywareMaster
Antispywaresuite
Antivirus 2008
Antivirus XP 2008
AV XP 2005
Bestsellerantivirus
Data Doctor
DriveCleaner
ErrClean
ErrorSafe
Exterminadordevirus
Gubbishremover
MalwareAlarm
NetTurboPro
Power Antivirus 2008
Power Antivirus 2009
SpyGuarder
SpyKiller Pro
SpywareIsolator
SwiftCleaner
SystemDoctor
SystemErrorFixer
Microsoft has its own security analysis unit, which has been instrumental in bringing down several botnets over the course of the last year. Now they are also involved in helping consumers recover money from scam security artists and programmers.
According to the Microsoft blog site (http://www.microsoft.com/security/portal/Shared/WhoAndWhat.aspx):
“The Microsoft Malware Protection Center (MMPC) provides anti-malware research and response capabilities that support the Microsoft range of security products and services. With laboratories in multiple locations around the globe, the MMPC is able to respond quickly and effectively to new malicious and potentially unwanted software threats wherever and whenever they arise.”