How computer viruses use word of mouth to infect systems!

Social Networks Hype Cycle (Photo credit: fredcavazza)

Social Network is Culprit!

I remember some very interesting Facebook, Twitter, and other social media sites used in the past to get people to click on an infected link.  This is one of the oldest techniques.   The virus post something on your twitter account or your Facebook account about something really interesting.   Even if you trust your friend, sometimes the friend or twitter account that you know aren't really in control of what they post.   This is the first line of trust that the virus makers use to spread their viruses until other computers and systems.   You should never click any link unless you know where it is going.  Although this is becoming less and less troublesome, I am sure it isn't going away but just biding it's time to come out and strike another day.

Some tips to remember when your using social media sites are to use url expanders such as:

• LongUrl - http://www.longurl.org/


• Where Does this URL Go - http://www.wheredoesthislinkgo.com/


• Clybs URL Expander - http://www.clybs.com/urlexpander


• URL X-ray Checker - http://urlxray.com/


• Link Peeler - http://linkpeelr.appspot.com/

These are some great little url expanders that if your have a question about what the URL is then by all means use these.   I also like to use Bit.ly extensions for Chrome but it won't expand all and is only available on Chrome.   I don't know if there are other apps for Firefox like this but at least you have a starting place!

Emails are Second!

It is just like Social Networks but in this case you are getting an email to you.  A few years ago, we had some really interesting emails with either warnings or saying you have a picture on the internet to click it.  There are a dozen or so ways someone could fool you into downloading malware or viruses but these are the most common because most users will click links and they feel safe because they have built up trust.   Lately though they haven't been doing this much but it could be a very good possibly, so you must be careful!

Some things to remember when using emails, if your not expecting a link don't click it!  If your thinking it was sent to you for that purpose, it might be high time to email your friend and ask them if the y knew they sent that to you.   Sometimes the person or account involved doesn't know that they sending links that might be infectious.

If you follow these steps and consider using Malwarebytes [Affiliate Link] you are less likely to get infected but that doesn't mean that you are a 100 percent immune to computer viruses.  No Operating system is immune even Linux but that is just my opinion others  have said that you can't possibly get infected on Mac OS or Linux!

Paul Sylvester

Try Malwarebytes, the Leader in Malware Removal

Related articles

• 20% of Facebook links lead to viruses (infographic) (zdnet.com)


• Where Are You Picking Up All Those PC Viruses? Facebook (businessinsider.com)


• What Is Ransomware and How to Protect Your Computer (techtools4us.wordpress.com)


• MyCuredComputer.com Combats the Ever-Changing Facebook Virus Koobface (prweb.com)

Malware Defender 2009 -- How to Remove it

[ad]If your noticed a new program on your system called MALWAREDEF.EXE, the filename is usually associated with Malware Defender 2009  sites. The interesting fact is that most of the time this is installed silently and should be removed Immediately. The program might of been installed by other adware or trojans on your system. The Good news SUPERAntiSpyware can block and remove MALWAREDEF.EXE and thousands of other harmful applications. So if you have this fakeware or I call it scareware, maybe it is time to Buy SuperAntiSpyware Professional which comes with Realtime Blocking of threats! Prrevent potentially harmful software (spyware, adware, worms, dialers, hijackers, keyloggers) from installing or re-installing.

[ad#Scarewaresitesrecommend]

[rating:4/5]

[ad#Scarewaresitesrecommend1]

[ad#SUPERAntiSpyware]

How to know if the scareware warning is real or not:

I got an email from someone who wants not to be named asking how do I know if these sites that I have talked about like [intlink id="4348" type="post"]Defenderpageblock.com[/intlink], [intlink id="4346" type="post"]Spywaredomainlist.com[/intlink], [intlink id="4328" type="post"]adwaredomainlists.com[/intlink], [intlink id="4344" type="post"]badwaredomainlists.com[/intlink], [intlink id="4342" type="post"]browserdefenderlist.com[/intlink], [intlink id="4339" type="post"]malicioussitesblock.com[/intlink], and [intlink id="4337" type="post"]browserliveprotection.com[/intlink] are fake warning sites because of how the site handles the URL presented.   Let me give you a few example urls to see what I mean:

http://defenderpageblock.com/block.php?id=2006-54&url=http://paulstechtalk.com/scareware-adviser-from-defenderpageblock-com/

http://browserliveprotection.com/block.php?id=2024-4&url=http://paulstechtalk.com/2008/12/microsoft-readys-to-layoff-around-15000-workers.html/

http://malicioussitesblock.com/block.php?id=2006-54&url=http://paulstechtalk.com/2009/08/list-of-malware-sites-for-aug-24-2009.html/

http://spywaredomainlists.com/block.php?id=2018-2&url=http://paulstechtalk.com/2009/08/scareware-adviser-from-spywaredomainlists-com.html/

http://adwaredomainlists.com/block.php?id=2031&url=http://paulstechtalk.com/2009/04/pc-speedscan-pro-a-bad-idea.html/

[ad]Now as you can see al these have an identification number probably like an affiliate link and then the url of the site that is supposed to be bad or have malicious in some way.  So what do you do when you see these types of warning pop up and you would like to know if this real.   Here are some things to try to see if it is real or not:

• change the url it is going to, try Google or some other site that you know isn't malicious and see what happens.   You will notice it will say the same exact same thing.


• Check out Stopbadware.org --  Google uses this service for there search results so this would be more reliable and check out the warning domain to see what it says then also check out the domain and website in question.


• Check out Phishtank.com --  Firefox likes to use this resource for reporting fraud, fake, or Phishing sites and also for sites that are dangerous to  the people who use Firefox.

Most of the time, you will see this happen when you are search for the site like [intlink id="4348" type="post"]Defenderpageblock.com[/intlink] it will use a key word and pop up because they don't want you to remove this scareware or sometimes called badware.   So if you do a search for the site that keeps popping up and you click on a link the site in question will sometimes try to prevent you from figuring out how to remove it.    All these sites mentioned are associated one way or another to [intlink id="3607" type="post"]Personal Antivirus Scareware Site[/intlink] and should be removed.

So if your getting these types of warnings, I would recommend downloading:

[ad#SUPERAntiSpyware]

List of Malware Domains for Aug 29. 2009

[ad#Google 486x60]

Looks like the fake AV software authors are gearing up for next month here is the list of domains.

[intlink id="3607" type="post"]Personal Antivirus Scareware Sites[/intlink]:

• antimalwarescanner-v4.com


• web-software-payments.com


• websecurepayments.com


• totalspywarescan1.com


• antivirus-online-scan7.com


• best-antivirus9.com


• warningmalwarealert.com


• securedvirusproscan.com


• megaspywarescan.com

[intlink id="4217" type="post"]Internet Antivirus Pro Scareware[/intlink] sites:

• pohsoft.info (Fake Antivirus Scanner Page)

[intlink id="3977" type="post"]Rogue Antivirus scareware sites[/intlink]:

• koliopewaqs.com


• pcscanneronline.net


• mysystemdefender.com

[ad#Scarewaresitesrecommend]

[rating:4/5]

[ad#Scarewaresitesrecommend1]

[ad#SUPERAntiSpyware]

Malware List for Aug 17, 2009

These just came on my radar. I will keep updating this blog post if I find more:

• best-spyware-scanner.com ([intlink id="3607" type="post"]Personal Antivirus Scareware Site[/intlink])


• secure-virus-scannerv5.com ([intlink id="3607" type="post"]Personal Antivirus Scareware Site[/intlink])


• securitysupplycenter.com (Similar to [intlink id="4217" type="post"]Internet Antivirus Pro Scareware[/intlink])


• expuls.info ([intlink id="4217" type="post"]Internet Antivirus Pro Scareware[/intlink])

[ad#Scarewaresitesrecommend] [rating:4/5]
[ad#Scarewaresitesrecommend1]

[ad#SUPERAntiSpyware]

Personal Antivirus Stash of Sites!! All Scareware

I went exploring and found some sites that are linked back to each other and here are a few sites that have the same "[intlink id="3607" type="post"]Personal Antivirus[/intlink]" scareware that do the same thing.  These are all just waiting to be used for the purpose of selling you the fake stuff.

Sites that are on this IP BLOCK (83.133.123.109) and are exactly the same:

• [intlink id="3607" type="post"]purchuasebestsoftwareonline.com


• buypremiumsubscription.com


• ieprotectionlist.com[/intlink]

[ad]Sites with the Site advisers are:

• [intlink id="3607" type="post"]ieprotectionlist.com[/intlink]


• networksecurityadvice.com


• [intlink id="3913" type="post"]browsersecurityinfo.com[/intlink]


• [intlink id="3872" type="post"]securitybrowseradviser.com[/intlink]

And are all active and just waiting to start selling this fake scare at moments notice each one looks like either have or will be used in the future to host the content waiting for people to buy this fake product.  You should check out the other articles in this series and be ready for them when they become active.

It is time to install some [intlink id="2205" type="page"]real Antivirus Software[/intlink] and get these fakes off your system if your infected if not it is still a good idea to have them installed.    I would recommend [intlink id="3884" type="post"]SUPERAntiSpyware[/intlink] to help get rid of these infections if you have them or Keep yoru system from getting these infections.

Spam Messages go out with Fake Conficker Alerts

Sopho's blog is reporting:

This past weekend, SophosLabs noticed a new “Conficker” theme in the content of these spam messages. Instead of saying there is a critical windows update that needs to be applied, they say that “your Internet company” believes you to be infected, and to click the link to scan your computer

[Via Sophos]

[ad#cricket-right-ez]As in [intlink id="3114" type="post"]previous post about fake Anti-virus Software[/intlink] sites trying to scare you into sending them free money.  You should always be cautious when it comes to these sites that make you think you have a virus.  Some things to consider when you visit sites that are claiming you have a virus:

• Is this a true anti virus company?  If your unsure you can always google the company to better help you determine if this a fake site.


• You also should consider going to the real deal on anti-virus there are several different companies that I know of off the top of my head but it should always be one that is not a fly by night type of anti-virus company.   The real companies have people and resources watching for the latest viruses, and other Maleware.

According to Sopho's the Maleware site is detected as Mal/FakeAV-AH with there system.  Remember you don't always have to buy anit virus software there are [intlink id="2205" type="page"]several good free versions[/intlink] out there that do a pretty good job at defending against a virus, Trojan, or a Computer Worm.  If you feel you might have a virus you can do a free anti-virus scans to make sure you are not infected.   I also suggest having a firewall installed if you have not done that yet, that will also greatly help prevent a virus or worm but remember you are the last line of defense with Maleware!!