Apparently he was getting a prompt for a anti-virus scanner called System Protector. The thing is that he never purchased it and it is telling him that he has to pay for it to get rid if all of viruses that it was finding. This is clearly a rogue application. Wikipedia defines a rogue application as:
Rogue security software is software that uses malware (malicious software) or malicious tools to advertise or install itself or to force computer users to pay for removal of nonexistent malware. Rogue software will often install a trojan horse to download a trial version, or it will execute other unwanted actions.
Pretty sneaky. I’ve dealt with a lot of this sort of thing over the years. Sadly, this is becoming more commonplace.
So I was pretty sure that my customer had somehow gotten a trojan horse (or more than one) onto his Windows XP computer, and it downloaded this rogue application. I made arrangements to look at it today as this isn’t the sort of thing that can wait.
Once I got my hands on the computer, it was worse than I thought. It disabled any security software that was on the computer, plus I couldn’t use basic Windows functions such as bringing up task manager. So this was very serious. I researched the rogue application that was on the computer (as in this situation Google is your best friend) and came up with a plan to deal with the situation:
- By using Google, I used instructions from a variety of sources to disable the rogue application. I always read a variety of sources to make sure that whatever method I use to kill stuff like this is the correct course of action.
- Once the rogue application was gone, I had to tackle the trojan horses that were on the system. I use at least three anti-virus scanners that are up to date to make sure that the system was clean. That’s no joke. I use three scanners because each will get stuff that the others will miss. By the time I was done, I had removed 30 trojan horses.
- I then had to fix Windows. The trojans had done some work to stop things like task manager from working. So I had to repair that damage.
- I then had to figure out how all this stuff got onto the system. Since the system was pretty much up to date in terms of security patches, I knew it came from an application that was installed on the system. From interviewing the customer, I was able to deduce that the likely source was a file sharing application that the customer’s son had installed as the issue started within 24 hours of the application being installed. I removed the offending application. I wouldn’t want to be that kid who installed that file sharing app tonight.
Total time: Four hours. I only charged the client 2 as most of my time was spent waiting for scanners to be finished. So in my opinion it isn’t fair to charge the client for that “waiting time.”
So as you can see, I had an interesting day. But far from atypical for me.
I wonder what the next phone call will bring?
Hacked Macs Create The First Mac Based Botnet…. Or Is That An iBotnet?
Posted in Commentary with tags Apple, virus on April 16, 2009 by itnerdZDNet has a story about a discovery by Symantec of an all-Mac based botnet that is actively involved in a DOS attack:
Writing in the current issue of Virus Bulletin (subscription required), researchers Mario Ballano Barcena and Alfredo Pesoli found two malware variants – OSX.Iservice and OSX.Iservice.B – using different techniques to obtain the user’s password and take control of the infected Mac machine.
The variants have been found inside bogus copies of iWork ’09 and Adobe Photoshop CS4 which were shared on the popular p2p torrent network. The author of the malware downloaded the original/trial versions of each program and introduced a copy of the malicious binary into the packages. Users who then downloaded and installed the applications from the torrent download would have been infected. It is estimated that thousands of people have downloaded the infected torrent files.
While this proves that Macs are not immune to being hacked, there are some things to consider. This requires user intervention in the form of installing pirated software, rather than it sneaking on to the Mac which tends to happen with Windows machines. This is a great time to mention that downloading pirated software is a dumb thing to do on ANY platform. But I digress. The hackers can’t take control of the computer the virus is running on, rather it attacks other computers. So while this is a threat, it’s not as bad as some of the stuff that you see on the Windows platform.
At least not yet.
1 Comment »