MalwareTeks Blog

I’m a little slow on the up take with this one; but I was reading the SunbeltBLOG last Sunday. When I came across this item of interest; New new security scam hijacker sites. So, I decided to visit one of the sites listed in the SunbeltBLOG article.

Why, would I do such a thing? The blog article says these are scam sites pushing “Rogue” Anti-Spyware applications. Those who work in the world of PC security and Malware Removal, know exactly why I would do such a thing. To find out exactly what is being pushed onto the unsuspecting, uninformed Internet traveler.

So, I paid a visit to uptodateprotection(dot)com; and this is what I found. Upon the page opening I was immediately greeted by a pop-up, see figure 1, warning me about the W32.Myzor.FK@yf virus. Which, I suspect is meant to lead one to believe that their system is infected by this little nasty.

What is W32.Myzor.FK@yf?

W32.Myzor.Fk is a threat detected by rogue antispyware program. It displays a warning: “W32.Myzor.FK@yf. is a virus that infects files with .exe extensions.”

It also hijacks your Browser and redirects the webpage.

Of particular note is the Systems Affected by this Trojan. It doesn’t say Windows 2000 (all service packs) is affected. That’s interesting since 2000 is an NT based OS. If all versions of NT are affected and every Windows version after 2000 is affected then it stands to reason that Windows 2000 would also be affected.

Make a note of the Systems Not Affected. I will revisit that item a little later in the article.

In the Technical Details it tells you that W32.Myzor.FK@yf creates files in the %Windir%\ directory. Which, by default is C:\Windows. %Windir% is the system variable for the Windows directory. Which can be C:\Windows or C:\Winnt. It depends on which OS is installed.

Adds values to the Registry Key: HKEY_LOCAL_MNACHINE\Software\Microsoft\Windows\CurrentVersion\Run.

This is not a valid Windows Registry Key. The correct Registry Key would be: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run.

Recommendations: Click “OK” to download officially approved security software. Always keep your patch level up-to-date.” ‘Officially approved’ by who? Microsoft? I don’t think so. The last part of that statement is actually good advice; always keep your OS and software updated

Clicking “OK” on the pop-up redirects to a new page, see figure 2.

Getting back to the information displayed about my system. The browser type detected is: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.7) Gecko/20060915 CentOS/1.0.5-0.1.el4.centos4 SeaMonkey/1.0.5. Looks a little cryptic, but really isn’t. The browser used during this session is Mozilla Sea Monkey 1.0.5 and my language setting is English (US). Now this is were it gets a little interesting. The site was not able to properly detect my OS. Well that information was transmitted by my browser; and if you look back at the information about my browser, you will see the OS. Which, in this case is Linux i686; specifically CentOS.

Let’s go back to the pop-up when I first opened the site. Do you remember which, OS’ were not affected by the W32.Myzor.FK@yf virus? Just so that you don’t have to scroll all the way back to the beginning of the article; I’ll list them here again. Systems Not Affected: DOS, EPOC, Linux, Macintosh, Novell Netwear, OS/2.

That’s funny, my OS is listed as VULNERABLE; but I’m running Linux. So, the author’s of this want me to believe my system is infected with a virus that will only execute on Windows; and that an intruder can gain access to:

- \Windows\System32
- \Program Files\Internet Explorer
- \My Documents
- Drive C:\ files

Files and Folders.

In all seriousness, I am running Linux on this system; but the vast majority of PC users are using Windows. Be it 98, ME, or XP; but it is Windows and is vulnerable to exactly this type of attack.

The people who create these sites and programs rely on “Social Engineering” to get you to click on one of the many links on this type of page and install a program that will not perform as advertised. These programs will install several Trojans on your system.

If you have fallen victim to this type of scam. Start a new thread in the Malware Removal Forum of this site.

(You must Register before posting anywhere on this board. Registering is 100% FREE)

We ask that you first complete all the steps outlined in our Malware Cleaning Guide before starting a thread in the Malware Removal Forum.

It is highly recommended that you read the article, Protect Yourself From Malware: Tools And Tips, and adjust your practices, software, and settings as necessary.

Before considering or installing an Anti-Spyware product, please check out this excellent resource: Spyware Warrior: Rogue/Suspect Anti-Spyware Products & Web Sites