US shuts down 'scareware' sellers

[Don't care]

The US government has moved to shut down sellers of fake security software.

http://news.bbc.co.uk/2/hi/technology/7779223.stm

[Manedwolf]

And random series of driveby posts why?

[RocketMan]

aka: Rogue Antispyware.  This is the first time I have seen it called "scareware".

I have lost track of the number of machines I've had through my shop whose owners have fallen for these scams.  I have seen every one of those listed multiple times except for ErrorSafe.  I don't recall seeing that one.

I also hold no hope that the .gov's action will stop them.  They will just move their operations offshore, change the names to protect the guilty, and continue to march.  It is far too lucrative a scam for them to do otherwise.

[K Frame]

I still don't know how I did it, but I was working late one night while exhausted and must have clicked something I shouldn't have, because I got one of these on my computer.

Thank God Mtnbkr knows his way around computers and was able to flush it off my system.

[lupinus]

good, hack the bastards back IMO.

I've been working all day and gone through about a dozen scans trying to get rid of personal defender 2009.  They didn't get far enough to get my money, but being it looked exactly like a windows alert did get me to click a button.

This thing just. wont. die. 

It wouldn't even let me open spybot.  It wouldn't let me go to the websites of several anti viruses and anti spywares.

I was finally able to get through to counterspy which cleaned enough of it out to get started, stil lworking on it and I was hit last night.

[RocketMan]

Mike, some of those are very good at getting by any protection you have on your system.  Their sophistication has increased over time, too.
When they first appeared, clicking on "No" closed the window, and that was that.  Then it changed to clicking on "No" was the same as clicking on "Yes". Then clicking anywhere on the window was the same as a "Yes".
And, of course, any "Yes" response started loading the target system with the malware. 
I even ran across one that, when I right-clicked on the corresponding tab in the taskbar to select "X Close Alt+F4", started downloading its package to my machine.  I had to quickly pull the power plug to kill it.

[Lennyjoe]

I don't care about drive by posts that have no input from the original poster.   

[RocketMan]

Maned and Lenny, don't get too bent out of shape.  I'm sure Don't Care was just trying to be informative.  Truthfully, the OP doesn't require much in the way of comment.

[taurusowner]

You know, sometimes one might just want to make others aware of an event or story but not necessarily have an opinion on it themselves.  The whole "drive by posting" thing doesn't both me one bit.  So long as the thread title tells me what the thread is about, I couldn't care less whether or not the OP has something to add to the story.

[lupinus]

Mike, some of those are very good at getting by any protection you have on your system.  Their sophistication has increased over time, too.

Yep, like I said above.  Wouldn't even let me open the spybot or let me onto any site having to do with anti spyware or it's removal.  Was a pain in the rear trying to get through to one, dl it, and run it.

[RocketMan]

MalwareBytes install file is only about 2.25 MB.  The includes file with the latest updates is less.
It could be emailed in a pinch, assuming your email still works.

[K Frame]

Chill out, guys.

We'll police the forums.

Yes, Don't Care has been drive by posting a few times today.

Is it that much of a problem in the instances where he posted?

No.

Why?

Because he's posting INFORMATIVE topics, not hot button topics.

That's the differentiator, as far as I'm concerned.

You want to drive by post a hot button topic that's going to serve to get a lot of people arguing back and forth? You'd better weigh in with your opinion on the matter, or the thread will likely go bye bye.

If, however, you've got an informative drive by, which this one certainly is, the admins and mods aren't going to get nearly as bent out of shape if you just post the article and don't say anything about it.

Get the difference?

Drive by posting to inform = neutral to good.

Drive by posting to stir up a hornet's nest = we're going to come down on you like a ton of bricks with a seriously bad attitude.

[zahc]

And, of course, any "Yes" response started loading the target system with the malware. 

How does it get root permissions? Wouldn't that only work if you were surfing the internet as root?

[RaspberrySurprise]

With windows most people are logged on as the administrator all the time, which is the same as root.

[TF_FH]

It wouldn't even let me open spybot.  It wouldn't let me go to the websites of several anti viruses and anti spywares.

I found that on some systems affected by that problem, if you go into the spybot directory, set it so you can see hidden and system files, then copy the spybot exe file and give it a new name (in my case SpyBotCopyTest.exe) and run it, it will run fine, apparently only the specific name is blocked.

Also, although it has provided additional income for myself from time to time by fixing it, I hope those <expletive deleted> bastards get jail time for this crap.

I say for each infection they gave out, they should get one nice whack with a baseball bat to non-vital organs and bones.

[lupinus]

Why non-vital?  I'm just glad I had the good sense to verify before even considering spending fifty bucks.  Someone like my mother, who knows diddly about computers, would have been out fifty bucks, probably had more and worse spyware from the "full version", and had her card numbers God only knows where.

At least if you realize you still have a big problem its easy enough to call the CC company, reverse the charge, and get a new number issued.  Pain in the ass but it seems stupid for them to be so in your face that something is wrong.

Something quite in the back ground (like, as I understand it, the trojan that downloads it ITFP) would seem much more likely at getting your credit card number and therefor, your money.