It’s probably happened to everyone at some point -- we’re working on our computer and suddenly a message pops up somewhere on the screen. Virus Alert! Malware Alert! Of course, it’s easy to get nervous; we just want our computer cleaned up as fast as possible so that we can get back to our work. We’re anxious to do whatever we need to do to remove, clean or do whatever needs to be done with this virus/malware/malicious code that is on our system.

The bad guys know this, and they’ve figured out how to trick us -- it’s called FakeWare (also known as ScareWare). Your computer displays a pop-up message telling you that you have a virus and that you should download and install some obscure anti-virus software in order to clear the problem. Sometimes, they even make you pay for the software. Unsuspecting of foul-play and eager to fix the problem, you download and install. In fact, you never really had a virus, but now that you’ve installed this mysterious program, you have a rouge program known as FakeWare -- fake software disguised to help you and one of the worst pests that you can have on your computer.

FakeWare is just a type of malicious program and it can take many forms. Lately, I’ve seen a lot of people infected by XP Anti-Spyware 2010 and another variant that even claims to be a “Microsoft Security Essentials Alert” -- this is especially problematic because there is a legitimate anti-virus application by Microsoft named Security Essentials. Removing these applications is sometimes pretty tricky, as there are a lot of “strains” of each specific type of FakeWare. To remove it, there may be a few free or paid applications that you can install (I’ve heard that Malwarebytes’ Anti-Malware is a good start), or If you’re an advanced computer user you can usually do some research on your own and remove the malicious software manually. Depending on its complexity, you may need to utilize removable media or a second computer.

A FakeWare alert for Microsoft Security Essentials

What can you do to prevent this problem? Leslie Knight from “Navigating the I.T. Minefield” wrote an article on the subject entitled FakeWare -- Be Aware! in which she mentions some preventative techniques:

• Block popups in your browser.
• Be careful when you visit unknown websites. Remember, anyone can create a website and provide bogus information or a bogus product.
• Don’t click on links from people you don’t know.
• If your business can afford it, invest in hardware and software that will limit the websites you and your employees can visit.

These are great ideas, and I also want to augment them with some common sense rules that are easy for everyone to follow:

1. Don’t wait to be infected with a virus before obtaining the right software. Make sure your security settings are in place NOW and get reputable, reliable anti-virus software (especially if you run Windows). Make sure you keep it up to date and the license is active (most software will take care of this for you automatically). That way, if you see a warning that tells you to download an additional piece of software, you can think to yourself, “don’t I already have anti-virus software?” and not fall for the trick.
2. When you are alerted of real viruses/malware, the alert message itself typically doesn’t ask you to download anything. If you’re getting an alert and the solution is to download and install something, you should immediately cancel and stop what you’re doing.
3. If you are not an advanced user, don’t worry. If you see an alert and don’t know what to do, take a screenshot and then contact a professional. It will cost a lot less for someone to look at the alert message and tell you not to worry about it than to inadvertently infect your computer and pay someone even more to get rid of the problem.

If you need assistance clearing your PC of malicious FakeWare, let us know. We help our clients with these types of problems all the time. Sometimes, we can assist remotely, but usually it involves shipping your computer to us. We typically get everything fixed up and shipped back to you within a day or so.

What’s the sudden hype with Conficker?

The reason why this strain of the virus is so highly publicized in the news is because it was only recently discovered, and is also somewhat mysterious. The worm itself has already infected millions of machines on the Internet, but none of them are showing symptoms. This is because it isn’t supposed to “wake up” and start doing harm until April 1st.

The truth is, not much is known about what Conficker-C is supposed to to do its infected hosts once it awakens. Most speculate that it will give a remote attacker control of your computer to do harm. Most dangerously, the attacker can take control of your computer and many others all at once and use them to attack other computers. This is known as a botnet.

How do I know if I’m infected?

The easiest way to tell is to try to access one of these websites:

• http://www.symantec.com/norton/theme.jsp?themeid=conficker_worm&inid=us_ghp_link_conficker_worm
• http://www.microsoft.com/protect/computer/viruses/worms/conficker.mspx
• http://www.mcafee.com

If your computer is infected, the virus will actually prevent you from viewing the site. In that case, you need to immediately take steps to remove it.

Websites with removal instructions:

• Microsoft - http://support.microsoft.com/kb/962007
• Symantec - http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-011316-0247-99

How to Prevent Infection

Infection can be easily prevented. First, ensure that Windows has the MS08-067 patch installed. It can be downloaded (both for XP and Vista) from Microsoft’s web site - http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx

Second, disable the autorun property. More instructions are available at http://www.us-cert.gov/cas/techalerts/TA09-020A.html

Third, it is reccomended that your computer have all of the latest software updates and your virus protection is up-to-date.

For More Help

More information regarding this virus is available from the US-CERT cyber alert database: http://www.us-cert.gov/cas/alerts/SA09-088A.html

If you require assistance with patching or removing the virus from your computer, please contact us or your computer administrator.