<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>The Techinator Blog &#187; FakeAlert</title>
	<atom:link href="http://thetechinator.com/blog/tag/fakealert/feed/" rel="self" type="application/rss+xml" />
	<link>http://thetechinator.com/blog</link>
	<description>Thompson Computer Services Tech Blog</description>
	<lastBuildDate>Thu, 12 Jul 2012 00:09:34 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.1.4</generator>
		<item>
		<title>Drive-By and Rogue Malware Infections</title>
		<link>http://thetechinator.com/blog/2011/01/drive-by-and-rogue-malware-infections/</link>
		<comments>http://thetechinator.com/blog/2011/01/drive-by-and-rogue-malware-infections/#comments</comments>
		<pubDate>Mon, 10 Jan 2011 21:28:12 +0000</pubDate>
		<dc:creator>Kelly</dc:creator>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[Adware]]></category>
		<category><![CDATA[Drive-By]]></category>
		<category><![CDATA[FakeAlert]]></category>
		<category><![CDATA[Rogue]]></category>
		<category><![CDATA[Spyware]]></category>

		<guid isPermaLink="false">http://thetechinator.com/blog/2011/01/drive-by-and-rogue-malware-infections/</guid>
		<description><![CDATA[What are Drive-By and Rogue Malware Infections and how do you protect against them?&#160; For the answers, watch the video below: We’re seeing more Rogue malware infections from Drive-By Downloads and Fake Alerts. Find out what they are and how to protect against them by watching this video. Here are the notes and links discussed [...]]]></description>
			<content:encoded><![CDATA[<p><font color="#000000">What are Drive-By and Rogue Malware Infections and how do you protect against them?&#160; For the answers, watch the video below:</font></p>
<div style="padding-bottom: 0px; margin: 0px; padding-left: 0px; padding-right: 0px; display: inline; float: none; padding-top: 0px" id="scid:5737277B-5D6D-4f48-ABFC-DD9C333F4C5D:cf377bc5-485b-47be-ab12-3c2f38437516" class="wlWriterEditableSmartContent">
<div><object width="448" height="252"><param name="movie" value="http://www.youtube.com/v/jlsCPMD2tPM?hl=en&amp;hd=1"></param><embed src="http://www.youtube.com/v/jlsCPMD2tPM?hl=en&amp;hd=1" type="application/x-shockwave-flash" width="448" height="252"></embed></object></div>
<div style="width:448px;clear:both;font-size:.8em">We’re seeing more Rogue malware infections from Drive-By Downloads and Fake Alerts.  Find out what they are and how to protect against them by watching this video.</div>
</div>
<p><font color="#000000">Here are the notes and links discussed in the video above:</font></p>
<h3></h3>
<h4>Drive-By:</h4>
<p>The “AdShufffle” (with 3 f’s instead of 2) attack aimed at ad networks from Google and Microsoft to spread the “HDD Plus” malware.&#160; More information from <a href="http://www.securitynewsdaily.com/google-microsoft-ads-spreading-malware-0351/" target="_blank">Security News Daily</a>.&#160; AdShuffle is a legitimate advertising network, the perpetrators of this attack added an “f” to their domain name and fooled the Google and Microsoft ad networks into allowing the ads.&#160; Users who visited pages that displayed the malicious ad would have their computers infected if Internet Explorer, Java, or Adobe Reader products were not up to date with patches.</p>
<h4>Fake Alert:</h4>
<p>Here are some examples of an actual Fake Alert that I observed recently:</p>
<p>The first pop-up looked like this (<strong>Click on the picture to see the full-size image, which is easier to see</strong>):</p>
<p><a href="http://thetechinator.com/blog/wp-content/uploads/2011/01/01-Drive-by-1.png"><img style="background-image: none; border-bottom: 0px; border-left: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top: 0px; border-right: 0px; padding-top: 0px" title="01 Drive by 1" border="0" alt="01 Drive by 1" src="http://thetechinator.com/blog/wp-content/uploads/2011/01/01-Drive-by-1_thumb.png" width="528" height="97" /></a></p>
<p>After clicking the red close box, I received this second pop-up:</p>
<p><a href="http://thetechinator.com/blog/wp-content/uploads/2011/01/02-Drive-by-2.png"><img style="background-image: none; border-bottom: 0px; border-left: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top: 0px; border-right: 0px; padding-top: 0px" title="02 Drive by 2" border="0" alt="02 Drive by 2" src="http://thetechinator.com/blog/wp-content/uploads/2011/01/02-Drive-by-2_thumb.png" width="530" height="94" /></a></p>
<p>Even after closing that, this window popped up:</p>
<p><a href="http://thetechinator.com/blog/wp-content/uploads/2011/01/03-Drive-by-3.png"><img style="background-image: none; border-bottom: 0px; border-left: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top: 0px; border-right: 0px; padding-top: 0px" title="03 Drive by 3" border="0" alt="03 Drive by 3" src="http://thetechinator.com/blog/wp-content/uploads/2011/01/03-Drive-by-3_thumb.png" width="530" height="326" /></a></p>
<p><font color="#000000">Notice how the “Windows Security Alert” looks very legitimate.&#160; If you look closely at the screen, however, there are a few typos. </font></p>
<h4>What to do if your computer does get infected</h4>
<p>We highly recommend scanning with a product called Malwarebytes.&#160; <a href="http://www.malwarebytes.org/" target="_blank">Download the free version here</a>.&#160; You may want to reboot into safe mode with networking to run your first scan, if you need assistance with that, let us know.&#160; You may want to run another scan after rebooting normally, and then scan with your antivirus software as well.&#160; Be sure to update Malwarebytes and your anti-malware software prior to running the scans.</p>
]]></content:encoded>
			<wfw:commentRss>http://thetechinator.com/blog/2011/01/drive-by-and-rogue-malware-infections/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
