Hmmm, must be a fake-av construction kit. The interior dialog box titled ‘Windows Security Alert’ is identical, word for word, letter for letter, except for a seemingly random display of the ‘threats’ found to a fake-av I dealt with at a client site a few months ago, that was triggered from momentecue4.com . Identical including the same heinous spelling and grammatical errors !
Erik Goldoff IT Consultant Systems, Networks, & Security ' Security is an ongoing process, not a one time event ! ' From: Jeff Bunting [mailto:[email protected]] Sent: Thursday, May 19, 2011 8:29 PM To: NT System Admin Issues Subject: Fake AV site Ran across a fake AV site this evening, with a faux-windows explorer web page. Anyone have favorite places to report this sort of thing? I sent the URL to Google's malware reporting, didn't know if there were other well-regarded places to submit these Here's a .png screenshot of the web page I took if anyone's interested (SkyDrive). The green progress bar was animated and completed its "scan" before the "windows security alert" popped up. The page was easily closed by killing the IE tab (the domain name appears in the image) http://public.blu.livefilestore.com/y1pHzOqf6GUpj4i-Jmq3CZd6VhkMg0yNK33pu-4P cTBzLjmkydC3bY_BUfYoKsbnH-a7DaUXp9fq8CyGwHEQAepWw/FakeAV.png?psid=1 Jeff ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin
