Fighting ‘Scareware’ One List at a time

Techworld has published an article that describes how the AV Vendors are compiling a Whitelist of AV Vendors who are really trying to keep there users safe and not trying to ‘[intlink id=”3805″ type=”post”]Scare[/intlink]’ the user into buying a rogue look a like.  They’ve published a Preliminary set of real Antivirus Softwares along with there Company:

CCSSParticpiation

As you can see there are at least to that are not listed.  I’ve contacted [intlink id=”3884″ type=”post”]SUPERAntiSpyware[/intlink] about this and they turned right around and started to ask to be added and should be Added in the coming months.   The other is [intlink id=”3851″ type=”post”]Malwarebytes[/intlink] and I am hoping they jump aboard and get in contact with this forum.

The Guys over at [intlink id=”3884″ type=”post”]SUPERAntiSpyware[/intlink] were really grateful that I came across this.   This list will soon help fight the [intlink id=”3918″ type=”post”]SCAREWARE Tactics[/intlink] of the Cyber Criminals.   Truth of the matter is educating oneself and doing a little bit of research can help you determine if the program or company is real or just another rogue company out there.   If your looking for some good Antivirus Software check out my [intlink id=”2205″ type=”page”]Antivirus Page[/intlink] and see some of the FREE Antivirus Software out there that can help protect your system.

Why you can’t run Antivirus or Taskmanager!

Photo by : Kristi Evans Photo by : Kristi Evans

As you know there has been more and more virus writers and scammers who don’t want you to interfere with the ultimate plan.   You see the two major plans these people have are:

  1. [intlink id=”2811″ type=”post”]To use your computer as a Botnet[/intlink] —  This is most common because the Command and Control server is where they tell these other computers what to do weather send spam or do a denial of Service attack on a website.  Although this is the most common it isn’t however the easiest to get rid of rid.   Far be it from being easy these virus writers want to keep a foot hold on your system.   This is like the SG-1 the “Foothold” Situation, they try to look like there is nothing wrong.
  2. [intlink id=”3805″ type=”post”]Fake Antivirus software[/intlink] — This is the other common reason why you can’t load up Taskmanager or SUPERantispyware/Malwarebytes.   It could even prevent AVG,  Norton Antivirus, and Other Antivirus software from being loaded at boot up.  Because most Antivirus software can detect this type of scareware.   The scammers want to make as much money as they can so they don’t want the End user to be able to stop the program from scaring you into buying the fake product.  It could also have a [intlink id=”3872″ type=”post”]Scareware Adviser[/intlink] trying to get you to buy the fake product!

As you can see these are what I call the Prime “2” reasons why you can’t run your Antivirus software, although there is a way around this.   I have found loading up in Safe Mode to be the easiest way to run antivirus scans on an infected system.   Although this can be difficult to do it, however it helps prevent these programs from loading up in more ways then one.  If you can go download the Antivirus programs from another computer and have them to install once you load up in safe mode.   You should also think about installing other software like a [intlink id=”2205″ type=”page”]Firewall even the Free firewalls[/intlink] are the better than Microsoft’s Firewall.

[ad]The other options for those tech savy people who know what a hard drive is and how to remove it, is to mount it onto another system as a slave and then run your antivirus software on the hard drive in question.   This however shouldn’t be done unless two conditions are met:

  1. You Know what you doing —  Again if you don’t know what your doing please don’t try this.  It could hurt your system far more than you can know.   If you don’t know how to do this you should take it to a professional and let them do the work for you.
  2. Out of Warranty — Yep that is right if this has a 2 year or longer warranty and you open up the hardware you automatically void the warranty on anything to do with your system.  So it is best to have someone who is qualified warranty specialist to open it up.  This way you still have your warranty on the system and if something does go wrong in the shop, they can fix it easier than a novice.

If you know what your doing this can be an easy process or it can be a hard process it only depends on how knowledgeable you are and how far you are willing to go.   Although there are [intlink id=”2955″ type=”post”]some viruses that require you to just start over[/intlink].  This is because they have embedded so deeplyinto the system that removing them will ruin your Windows system and prevent it from booting in the first place.  This is the last option, if you have a system who has been overrun with virus and spyware it might be time to reinstall the Operating system.  This is what I call the end all way to get rid of the Virus, Trojan, Or spyware on your system.   If you do this you will need to make sure to install all the Microsoft updates before you do anything else.  Also you will need to [intlink id=”2205″ type=”page”]re-install any Firewalls and Antivirus[/intlink] software to better protect your system from having the virus in the first place.

Using Malwarebytes to get Rid of Malware

Malwarebytes

I have been using Malwarebytes for quite some time.  I have the Installer for Malwarebytes in place on a  USB drive so i can use anywhere I go. I have seen several computers with very old Viruses and this actually detected them.

[ad]How Malwarebytes useful

  • Malwarebytes has a really good protection module to help prevent infections in the first place, but that requires you to buy it.  It should never be used without at least a [intlink id=”2205″ type=”page”]firewall installed[/intlink] but it is a good defense against what I like to call a Drive by install.
  • Automatically create logs of Malware that is found — This is good to for people who want to be able to check out what might be infected.   Also good to help identify the virus or Trojan, and find out how to uninfected it.
  • Cheaper than buying AVG — Cost $24.95 which is half of the cost of buying AVG.

As you can see buying Malwarebytes can be cheaper than buying AVG or Norton and protects your almost as if you have a brand name.   I think if a customer can’t afford $50 this would be the next best thing to suggest being that it will at least protect the system.   You can always install a [intlink id=”2205″ type=”page”]Free Anti-virus[/intlink] along with Malwarebytes to better protect your system.   This is one way to not have to buy expensive antivirus and yet still protect your systems from Malware.

No matter if you Buy Malwarebytes or use the Free version you are better off then not having it.  With the Free Version you can’t unlocks real-time protection, scheduled scanning, and scheduled updating.  These can be done manually without the having any Real time Protect.   You can scan manually and Schedule manually without buying the full version.  This is still a good buy, I recommend this to all my customers.

AVG detected trojan ; Generic11.BEOG

I had a Friend tell me his system detected  this Trojan GENERIC11.BEOG.  I did my research and right now.  It looking like Adobe added something to there recent updates *see updates below*.   I’ll  Have to check with some other sources but it looking like AVG over did it again and found something that might just be an AVG issue.  (correction)

[ad]

I usually wait before updating something like adobe.  It is sure to be some minor change to adobe but if your are worried here’s the link to watch and see what people are asking or talking about this false positive:

Malwarebytes Security Forums

It seems that AVG is calling this possible virus but yet it looks like it is a false positive.  So don’t you worry.  If it was a true virus you’d probably would never know!! 😉

[ad]

*UPDATE*

I installed Adobe 9.0 and updated the virus scan database for AVG.  It hasn’t found any thing yet but I am still scanning my system.  I’ll let you know if it finds this false positive on my Vista machine!!  I’m doing this to test it out!!!  Come back later to find out the results of the test.  (if you like this website by all means google this website so it too can be on google trends.   I want to see it be up on google trends for a day or two.)

*UPDATE #2*

Just did a whole system scan.  It did not find anything.  So I will be doing a reboot and scanning again.   It might be something that is attached to a PDF, if you went to a malicious website.   So I will do another scan.

*Update #3*

I just rebooted and almost finished scanning with AVG.  I still haven’t found anything wrong.   I have did some more digging into what might cause it.   I just did a look registry look up on {AC76BA86-7AD7-1033-7B44-A90000000001} and I found out something really interesting.   It’s a PDFFile_8.ico File.  This is tells me this is an Icon for the desktop.   I’m using one of the examples from Malwarebytes Security Forums to try to figure out what might be infected.

Here’s what AVG said after it finished scanning my system:

So I must assume that it is neither Adobe or AVG who have anything to do with this.  I will have to say that it must be a real infection as to not having any viruses after an install of Adobe.  How do you get this type of virus.  Check out my article on : Some Important programs to prevent yourself from having viruses and Malware!!

There you will find some useful tips on how not to get infected and other useful tools to help restore you system to it’s glory days.

So I will tell my friend to do a full virus scan and double check the results.  I can’t replicate the so called virus but I am sure there is something going on with the HASH files of the AVG Database and something might be coming back from the adobe install that has the same HASH files.  That also might be making AVG flag it as an Virus or Trojan.  I might never know though.