Check out this virus. Man, I'm impressed!

[DAE_JA_VOO]

So, my mum called me over, not knowing what the heck was going on with her PC. I got there and saw this:





Now, I don't know about you guys, but at first glance, I thought that was totally legit. Then a couple of things gave it away, like, you know, explorer being open in Chrome, two HDDs being missing, the HDD label being incorrect, the documents folder having the wrong name, etc etc etc It all fell apart after that, but at first, it had me going.

I've seen pop-ups similar to this, I think we all have, but this one was just so, so good. I can totally see how people would fall for this sort of thing.

In case anyone's unsure - in this case, the moment you click that "Remove all" button, the server send your PC a present that keeps your 23 year old son busy for the next few hours formatting and re-installing windows

("present" is a euphemism for "horrible, terrible virus" )

[Bladerunner]

I dunno about the rest, but it's fairly obvious to me that it's a scam.

It's running inside the web browser... Immediately red flags should be raised.

[DAE_JA_VOO]

I dunno about the rest, but it's fairly obvious to me that it's a scam.

It's running inside the web browser... Immediately red flags should be raised.

Yeah, I'm aware of that. But when you sit down at a PC and you see that, full screen, it's a little different. Like I said, the moment I saw that it was in a browser, I knew that it was something malicious, but before I saw that, it looked pretty real to me.

[KALSTER]

I fell for that thing once. It installed a program that could only be gotten rid of by downloading a special removal tool. Also fell for the "your the millionth visitor" thingy once. The fear of being revealed as an idiot has kept me pretty safe since then.

[Tribble]

I can see how that would have someone fooled. Get a pop-up blocker asap.

[rustypup]

meh... seen plenty of these... the number of users who fall for this is depressing...

[doo_much]

Pity 'mum' isn't a forumite. Epic Fail would've been epic...

[Studio Touch Visagie]

The big question is, how do you get to a fake antivirus websites by searching for cupcakes? And the answer is, they have selectively targeted mums and grandpa's (who will fall for the scam) cause those are probably the only ones that will search for pictures of cupcakes

[DAE_JA_VOO]

The big question is, how do you get to a fake antivirus websites by searching for cupcakes?

Right?! This is the one thing I didn't get. My mom uses the net specifically for baking related stuff (she bakes epic cakes as a hobby), and she landed at this pop-up from a cupcake google search

[Belix]

ah, the number of times someone at work has called me to say something along the lines of "see, i told you the company antivirus was ****, look how many viruses I have". as said, getting rid of it is a pain in the rear.

[Xiphan]

I've encountered this as well, my sister had it on her machine a while back, it was fairly easy to remove but still annoying nonetheless. I remember when I opened her browser again it was still there. So long as you close the tab you can't get infected or at least shouldn't. I've also had to remove it from a work machine once. The thing is it doesn't hide itself very well, but it does make it hard to open anything as it blocks most programs from running.

With regards to how people who look at innocent things can come across this it's all exploits on weak websites. I have a friend who played around with the exploits on some websites, he would do harmless things like change the name of the song currently being played on a local radio station or add products that don't exist to an online shop for a ludicrous amount of money. He also knew how to make legit websites load then redirect to another site which is most likely what happened to your mom, she clicked a link and saw her cupcakes load then the site redirect kicked in and came to what you see above.

To be safe make sure users know what the interface for the AV you have installed looks like, then tell them if it doesn't look like that then don' click on anything or just close the browser, knowing the Alt-F4 shortcut can also help them.

[andrekruger]

yip, that is a good ol trojan right there, and malwarebytes takes care of it.

[A_BULLET]

I got two of them one had something with a bee and said it was some antivireus, the other was the one shown at the top.
System restore worked on them!dunno why but after sys restore i could uninstall them normally!

[chowzen]

erm...get a MAC

[rustypup]

[Bladerunner]

I've heard good things about macs from several homosexuals...

[ryanrich]

I've heard good things about macs from several homosexuals...

Good to know you associate with several homosexuals...

[ADT]

I've heard good things about macs from several homosexuals...

~ LMPA

[Bladerunner]

Well certainly you have nothing against homosexuals?

[ryanrich]

No, but apparently you do as your statement was a clear attempt to insult Mac users by likening them to homosexuals. Allowing your computer to not be infected by a virus comes down to user prevention first and foremost and not the specific hardware or OS you're running, although obviously Windows is targeted more than Linux or Mac OS by malware attempts and viruses considering it has over 90% of the OS market share.

[DAE_JA_VOO]

I've heard good things about macs from several homosexuals...

Wow. Just wow.

[GreyWolf]

I've heard good things about macs from several homosexuals...

Wow. Just wow.

on the one hand: shame on you BR.

on the other: ha ha ha

[Bladerunner]

No, but apparently you do...

I do not.

[Xiphan]

erm...get a MAC

Right... That's why the following exists:



Because Macs are the perfect example of an OS that doesn't fall victim to viruses.

[DAE_JA_VOO]

erm...get a MAC

Right... That's why the following exists:



Because Macs are the perfect example of an OS that doesn't fall victim to viruses.

The fact that an anti virus app exists for the Mac doesn't mean it's necessary. 99.9% of Mac users are "unprotected" and have never had a virus.