http://googleonlinesecurity.blogspot.com/2010/04/rise-of-fake-anti-virus.html

This looks suspeciously like what happened to one of the computers here 
at work the other day. The AV software insists that there's nothing 
wrong even after multiple scans, but when a certain user logs in, 
windows pop up all over the place warning of a dire malware infection.

Now I can understand visiting a website and getting a browser window pop 
up rendered to look like the Windows Security Center (although isn't the 
titlebar supposed to indicate it's a browser window?), but I am 
mystified as to how this software can open windows just because somebody 
logged into the PC. This surely indicates that something has been 
installed locally. And yet repeated AV scans detect nothing...

In the end, erasing the user profile silenced the popups forever. But 
I'd still wondering how the hell it got this way in the first place.

Post a reply to this message

> logged into the PC. This surely indicates that something has been 
> installed locally. And yet repeated AV scans detect nothing...

You could just use one of those "spy" tools (forget which one now, but 
former SysInternals probably have something) to check which process owns the 
fake AV alert window.  Then just see where it's running from, or google the 
name or whatever.

Post a reply to this message

scott wrote:
>> logged into the PC. This surely indicates that something has been 
>> installed locally. And yet repeated AV scans detect nothing...
> 
> You could just use one of those "spy" tools (forget which one now, but 
> former SysInternals probably have something) to check which process owns 
> the fake AV alert window.  Then just see where it's running from, or 
> google the name or whatever.

Obviously the first thing I did was run Process Explorer to see what 
processes are running. I found nothing unusual. I hadn't thought of 
using it to check which process owns the window though; it's not a 
feature I usually have call to use. (I have a sneaking feeling the 
answer would just be IEXPLORE.EXE, which seemed to be running directly 
after login...)

Then again, I also crawled around in the registry and found nothing 
unusual. But deleting the registry hive fixed the problem, so clearly 
there *was* something interesting in there that I didn't see.

The problem is fixed now, so I can't investigate further. I did find it 
rather alarming however that our AV system that we pay a lot of money 
for could apparently find nothing wrong...

Post a reply to this message