Phishing

The massive growth of gold farming – the exchange of real money for virtual goods – might result in an increase in gaming Trojans and other malware aimed at gamers in the future. A well-respected researcher has described the incredible growth of “gold farming,” an significant industry and source of employment in China and other parts of Asia. He estimates there are 400,000 people, working for gold farming companies. They spend as much as 12 hours per day playing online games in order to accumulate virtual goods which can be sold to some of the 50 million on-line game players world wide for real cash. ...

This is an interesting sample, caught by our honeypots. The file comes as a zip archive from qtpom{removed}.tripod.com/codec.zip, which once extracted looks like this: It is almost undetected. Virus Total report here. Truth be told, no blatant sign of malware activity is noticed at first until this: What the heck? This is not my Google home page. And what are those tabs up there: “Pharmacy”, “Casino”? The malware modifies the Windows hosts file to redirect popular sites to glike.net (IP: 92.241.164.9, Russian Federation). ...

Antivirus PC 2009 is the latest rogue security software to hit the internet. Antivirus PC 2009 is a complete scam designed to harass PC users into buying the corrupt software. Antivirus PC 2009 will try to trick people into thinking that their PC is infected with malware and recommends purchase or registering the software to remove the malware. Antivirus PC 2009 will show false scan results that report numerous infections. Antivirus PC 2009 will also display annoying popups and system alerts that stat the PC is infected, under attack or not protected with antivirus software and recommends buying Antivirus PC 2009. Antivirus PC 2009 will also prevent other programs from opening, even the web browser making it impossible to use the internet, rendering the PC nearly useless. ...

Cybercriminals love to use social engineering techniques to trick users into installing their malware. One of the latest fake-alert variants attempts to trick users into believing the software is related to or hosted by McAfee:mcafeevirusremover.com. The script hosted by the domain can attack the Windows browsers Internet Explorer, Mozilla Seamonkey, and Chrome. The script also affects browsers on Linux platforms. This fake-alert variant is hosted on at least 13 other known domains. McAfee’s Trusted Source blocks the IP addresses and the domains (including DNS and mail servers) associated with this Trojan. For example: ...

From a site that is hacked and serving phishes: What’s mildly interesting is the types of phishes — “speciality phishes” that are not your typical banking/finance scam. These are phishes that are highly targeted, in this case at email systems of tiny Hamiltom College (not the first time I’ve seen this), the religious site cfaith.com, Saginaw Valley State University, and Villanova. cfaith: SVSU and Villanova ...

GreatDefender is a great big scam. GreatDefender is the latest rogue antispyware software, or phony security program that rips people off. If GreatDefender has infected your computer, do not buy the software, you should remove it immediately. GreatDefender uses scare tactics to frighten people into buying this corrupt software. These scare tactics include: System scans that report numerous infections, yet requires purchase of GreatDefender before it will remove the infections (These are fictitious scan results) Alerts and Pop-Up system warnings stating the PC is infected and recommend purchase of GreatDefender (These warnings are fake) Web browser redirecting to random websites (these websites are owned by cyber thieves and will further infect your PC) GreatDefender will prevent other programs from opening, stating they are infected (The programs are not infected) If your windows is infected with this malware you should remove it as soon as possible, Click Here to learn how to remove it.

For those of you that are having to put up with looking after your parents over Christmas: Would you much rather selfishly indulge yourselves with partying? A kindly spammer has a very seasonal Christmas Eve message offering to make this the last year that you will have to “put up” with the burdens of family elders. But be careful that your own children don’t read this. Free Help Finding Senior Care for Mom or Dad ...

APCProtect is a phony security program, designed to rip people off. APCProtect uses scare tactics including false security warnings and system scan results that are false to frighten people into purchasing it. If APCProtect is installed on your computer, you should remove it immediately. if your computer is infected with this malware, you must remove it soon, Click Here to learn how to remove it.

It’s the usual situation, with the bad guys exploiting the death of a famous person, just like they did with Michael Jackson. Yesterday we identified some Twitter accounts that are being used both to send “make money on the Internet” spam, and also to spread links to malware. In both cases, they used Brittany Murphy’s name. Here’s a couple of examples: The actual text of messages of this type can vary. What characterizes them is that the first link is genuine, i.e. it leads to a site which really does talk about the topic tweeted. The second link though, leads to standard spam advertising sites which tell you how to earn money on the Internet, offer various goods, etc. The second type of tweet we’re seeing is undeniably malicious. These tweets, like the first type, use Brittany Murphy’s name, but have a shortened bit.ly URL leading to malware: ...

This is the ‘12 scams of Christmas’ I mentioned in last post: Pipers tout fake gold rings as Maids are ‘a-phishing’ to milk bank accounts On what is traditionally the busiest online shopping day of the year (1), consumers are being warned not to become victims of the ‘12 Scams of Christmas’ and to take extra care with personal and IT security. The ‘12 Scams of Christmas’ developed by the National Fraud Authority (NFA), The UK Cards Association and the City of London Police (CoLP) highlight the greatest holiday fraud threats and how to spot them. ...

Crime traditionally increases during the holiday season, and cybercrime is no different. The malware writers, spammers and scammers are out in force. They’ve recently hit “Odnoklassniki” with this message: “Hi! I’ve got a New year surprise for you [emoticon] send 2133 279 (must be with a space) to 4460 and you’ll be pleasantly surprised! If you don’t take a look, I’ll be very grouchy with you [emoticon]” This message is clearly designed to make the bad guys a bit of holiday cash: an SMS sent to the number given in the message costs between $5 and $12 dollars, depending on the mobile service provider. ...

I was just looking at Facebook to check for spam and scams when I found this: I’ve blurred out a few things for privacy, and, most crucially, safety. The point of this post is the domain name. The spaces around the dot and the zero in “C0M” are just as they were in the original spam message. If spammers are going to the trouble to obfuscate their messages, it seems to show that Facebook’s spam filters are having some effect. Malformed links mean that you have to make an serious effort to actually go and visit the spammer site. And consequently, if someone’s going to go through all that trouble, they’re more likely to buy into whatever scam is at the other end. Click on the link, and you immediately get redirected, even though you won’t notice: ...

I ran into a few strange IMs over the weekend. When I was not shoveling out my driveway from the 15 inches of snow that covered it I was logged into Facebook telling people about it…. It was then that I started receiving some VERY interesting IMs from a friend extolling the virtues of a clean colon (yep – you read that right): This lead to the following questionable site, which had some very interesting comments on McAfee SiteAdvisor site: ...

Just a quick note – the sudden death of Hollywood celebrity Brittany Murphy last Sunday (BBC report here) has prompted a spike in searches on the subject – and of course, an SEO attack. Users who click on a poisoned search result link will be redirected to a website that will display a scare message trying to panic users into downloading rogue AV software: Screenshots of the rogue AV: ...

ProtectPC’s is a nasty rogue antivirus program, or phony security software, used to scam people out of their money. If your PC is infected with ProtectPC’s you should remove it immediately. ProtecPC’s poses a serious security risk for all PC users. Symptoms of a ProtecPC infection can include: Web Browser redirecting spontaneously System scans that result in reports showing multiple infections Pop-Ups and system alerts stating the PC is infected Programs being shut down or unable to open Click Here to learn how to remove these kind of malware.