If the day should ever come when anti-malware applications achieve a 100% effective rate in the detection of malware, or software developers develop operating systems and applications that are fully malware resistant, I’ll have to find something else to Blog about!
It doesn’t look like that day is likely to happen any time soon, however. In the meantime, Internet users will continue to download and test/tryout the latest, greatest, and newest anti-malware tools. Knowing this, Cyber crooks are blitzing the Internet with “rogue security software”, often referred to as “scareware”.
Scareware is a particularly vicious form of malware, designed specifically to convince the victim to pay for the “full” version of an application in order to remove what are, in fact, false positives that these program are designed to display on the infected computer in various ways; fake scan results, pop-ups, and system tray notifications.
Dialogue boxes, like the ones below, can be a powerful motivator. It’s no wonder then, that unaware computer users will often respond by clicking on the link which will take them to the product download site.
Using techniques such as the ones described earlier, cyber criminals are infecting more than 35 million computers with scareware/rogueware each month (roughly 3.50 percent of all computers), and earning more than $34 million monthly, through scareware attacks.
Generally, reputable anti-spyware software is capable of detecting rogue software if it attempts to install. But this is not always the case. Anti-malware programs that rely on a definition database can be behind the curve in recognizing the newest threats.
A good partial solution to this problem is – ensure you have installed, and are running, an anti-malware application such as ThreatFire Version 4.7.0, free from PC Tools. This type of program operates using heuristics, or behavioral analysis, to identify newer threats.
Additional steps you can take to reduce the chances of infecting your system with rogue software.
Consider the ramifications carefully before responding to a Windows Security Alert pop-up message. This is a favorite vehicle used by rogue security application to begin the process of infecting unwary users’ computers.
Be cautious in downloading freeware, or shareware programs. Spyware, including scareware, is occasionally concealed in these programs. Download freeware applications only through reputable web sites such as Download.com, or sites that you know to be safe.
Consider carefully the inherent risks attached to peer-to-peer (P2P), or file sharing applications, since exposure to rogue security applications is widespread.
Install an Internet Browser add-on such as WOT (Web of Trust), an Internet Explorer/Firefox add-on, that offers substantial protection against dangerous websites.
Always remember of course, that you are your own greatest line of defense against malware. STOP. THINK. CLICK.
If you are infected by scareware/rogueware, the following free resources can provide tools, and advice, you will need to attempt removal.
Malwarebytes, a very reliable anti-malware company, offers a free version of Malwarebytes’ Anti-Malware, a highly rated anti-malware application which is capable of removing many newer rogue applications.
Bleeping Computer – a web site where help is available for many computer related problems, including the removal of rogue software.
SmitFraudFix, available for download at Geekstogo is a free tool that is continuously updated to assist victims of rogue security applications.
If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.
Pingback: Rogue Security Software Continues It’s Rampage – Some Solutions | Group51.org
Hey Bill,
Threatfire has been running on my system for ages now, I can’t imagine life without it. It is absolutely essential for anyone serious about their computer security. Again I say, thank God I have never had to put up with these rogue programs, I would be tearing what little hair I have left out lol.
Cheers
Hey Mal,
Have to agree – “It is absolutely essential for anyone serious about their computer security.”
Listen, if you ever need the name of a good head-rug maker let me know. 🙂
Best,
Bill
These type of scareware/rogue programs are usually installed by accident through drive by downloads but not always.Threatfire is good but not the answer, the only way you can actually provide defence for yourself is to isolate your browser with Sandboxie or GeSwall (Both free).
You can use threatfire with any of the products mentioned above, layered security is the only answer.These products (sandboxie/threatfire for example) will stop any rogue software being installed on your PC.
Andy
Manchester England.
Hey Andy,
You’re right – the best defense against this type of threat is a sandbox, or isolator. In fact, we have covered this issue many times here including:
Secure Browser A Sandboxed Firefox 3.6 ( https://billmullins.wordpress.com/2010/07/21/secure-browser-a-sandboxed-firefox-3-6/ )
For Added Internet Protection Virtualize Your System with Free Wondershare Time Freeze ( https://billmullins.wordpress.com/2010/06/14/for-added-internet-protection-virtualize-your-system-with-free-wondershare-time-freeze/ )
Download Free Returnil Virtual System 2010 Home ( https://billmullins.wordpress.com/2010/03/16/download-free-returnil-virtual-system-2010-home/ )
Download Shadow Defender Virtualized Intrusion Prevention ( https://billmullins.wordpress.com/2010/03/15/download-shadow-defender-virtualized-intrusion-prevention/ )
Tips On A Layered Security Approach To Internet Safety ( https://billmullins.wordpress.com/2010/09/11/tips-on-a-layered-security-approach-to-internet-safety/ )
Free GeSWall Isolates You From Cybercriminals ( https://billmullins.wordpress.com/2009/12/30/free-geswall-isolates-you-from-cybercriminals/ )
Sandboxie A Freeware Sandbox App Protect Your PC on the Internet ( https://billmullins.wordpress.com/2007/11/23/sandboxie-a-freeware-sandbox-app-protect-your-pc-on-the-internet/ )
But, here’s the problem – while power users have no difficulty understanding the benefits of virtualization, average users do have difficulty. One reason for this is, virtualization apps require user engagement, and some level of technical understanding.
In a perfect world, all users would run virtualized. In the meantime, getting average users to install an application like ThreatFire, while less than a perfect solution, is a step in the right direction.
Great comment – thanks.
Bill
Nice article Bill,when i used to work in a tech support company most of the calls i used to get for virus problems few days back many of my clients asked me to write a step by step guide and here it is
http://www.expertsgalaxy.com/2010/08/how-to-remove-virusmalwaresroguefake.html
Thanks Neeraj.
Great article – I appreciate the link.
Bill