OT:Malware

[Roger Chapman]

I have just had a telephone call from someone sounding as though he came from the Indian subcontinent who claimed to be from "Windows" who had being getting several reports over the last week that my computer was infected by malware and wanted me to open up my computer so he could rectify the problem. He denied any association with Microsoft and affected not to know what McAfee was.

Was this a scam or have I passed up a genuine opportunity to get rid of some malware that has escaped McAfee's attention?

[The Nomad]

100% scam!

[Jeff Gaines]

It's a scam, and if you didn't keep the caller going for 25 minutes before he started swearing at you then you must try harder :-)

[Roger Chapman]

My patience is in very short supply so I am sure the conversation didn't go on that long but the man's closing shot was "your computer is going to crash then" as he hung up on me, and he did sound a bit angry.

[Derek G.]

(Snip)

Yes !

I recommend Avast free antivirus - in addition to Spybot search and destroy.

McAffity is payware and is nowt special although it is at least safe. Better to use the "stinger" tool downloadable FOC from McAffity.

I've had the feeling recently that most malware infections come from bogus antivirus programmes or "fakealert" trojans, indeed some I've had can't be explained any other way. I suspect your Indian friend maybe a semi-human equivalent.

I find it can take several iterations with 2-3 different antivirus programs (so best if they're all free).

Derek G

[DavidM]

Definately a scam - been around for quite a while. I had just such a call only yesterday - hung up on the guy.

They eventually try and get your credit card details so they can charge you for online support, but god knows what mischief they might have done to your PC in the meantime!

[Andrew May]

Only 25 minutes. I had them going for over an hour and at the end they were still so sure they were going to get some money from me that they promised to call back the following day. And they did.

Andrew

[Paul - xxx]

Scam.

He would have, if you'd played him a little, asked you to check the event log, taking you through how to do it, then say something along the lines of {1]

"look at all the errors, now go to

and download this file to clean it all up and get your computer running sweetly again".

If you'd done that you would henceforth have 'issues' ... ;)

[1] Generality .. some sites you don't have to download anything from if your security settings are low, or you click the "Allow ActiveX to run" etc

[Bernard Peek]

It's definitely a scam. Well done.

[Stephen]

The funniest "Malware" I've seen was on a Linux box, browsing a website.

Then a popup window comes up... an animation starts where its "Scanning C drive...." This pop up window actually looks like one you'd get on a Windows Xp/Vista/7 box.

It then claims to have found a number of infections on your C drive, then it offers a website link where you can download a piece of software for free to clean up your machine.

The software download is really a trojan horse designed to allow remote access to your PC to steal usernames/passwords and /or banking details or to create a Botnet (for a DDOS attack)

Now, the Linux users amongst you will know that there is no such thing as C drive on a linux box.......

It would be interesting to know what would happen if a Linux user did really download the Malware concerned (clearly designed for a windows box) onto their linux system and tried to install it

Stephen

[Bernard Peek]

It's quite possible for a web site to identify the browser and OS being used and to deliver a suitable payload. Linux and OSX are more resistant than Windows but they aren't immune, and the browsers running on them certainly aren't.

[Stephen]

The person concerned was actually using a LiveCD at the time as the spare PC didn't even have a hard drive connected, which made the Malware popup window even more hilarious...... There was no /mnt/hda to speak of let alone any C Drive

He was trying out various LiveCDs to decide which distribution he wanted to install. He settled on Ubuntu.

So if the payload had been installed, it would have been to the ram drive rather than a physical hard drive at the time..... a pull the plug at the wall would nuke the infection instantly, no AV software required.

Stephen

[Frank Erskine]

How did he get your telephone number, and how did he associate that with _your_ computer?

[Tim Downie]

Where have you been?? ;-) This scam has been all over usenet (and the rest of the internet) for ages.

Tim

[Tim Streater]

You do see these under OS X too (the browser assuming I'm a Windows box, I mean), although I've recently seen one suggesting similar nonsense for my Mac.

Of course, if the user sitting there is invited to click "download" for something and actually does so, they're risking giving the store away on any platform, as I think has already been mentioned.

You do get a last chance under OS X: anything you download from the Internet, on your first attempt to run it, will cause a warning panel to be displayed with OK/Cancel type buttons.

[Peter Crosland]

It is a scam, it is always a scam! Neverthless you might want to download , install and run Malwarebytes and Spybot from

and respectively. These can stop you picking up a lot of things that some other packages miss.

Peter Crosland

[Jules Richardson]

Yes, I stumbled across one of those a couple of weeks ago (I'm also running Linux) - it looked to be quite well done (and got me wondering if it might also exploit browser flaws which might be independent of OS)

cheers

Jules

[Jules Richardson]

Yes, I stumbled across one of those a couple of weeks ago (I'm also running Linux) - it looked to be quite well done (and got me wondering if it might also exploit browser flaws which might be independent of OS)

cheers

Jules

[Tim Watts]

It is fair to say, that even under *nix (including Apple), a browser flaw could potentially let it grab/delete your data subject to unix permissions.

You'd be very unlucky if it combined that with a root exploit to own your machine, but it's not impossible.

The plus point is that the trojan is obviously attempting to fool Windows users so the chances that it would carry a nix exploit (or even any runnable binary payloads that could actually run) would be fairly small.

[Roger Chapman]

He had my name as well so could have got both that and my telephone number from one of the many internet purchases I have made over the years. I can't remember now whether he had my first name as well but if he had the source couldn't have been the BT telephone directory as that only gives my initials.