Tech support scammers bring back FakeAV

Posted: April 22, 2016 by Jérôme Segura
Last updated: May 16, 2016

Some of you may remember the golden age of rogue antivirus software (AKA FakeAV) circa 2008. These programs that were often pushed via aggressive advertising and bundlers were designed to look like security scanners. However, they were stuffed with intentional fake detections for all sorts of Trojans and Worms.

The business model was simple but yet effective. By using scare tactics to trick people into believing their computers were severely infected, the crooks were able to make millions of dollars selling license keys for the bogus software.

Fast forward to 2016 and some tech support scammers are using the same lure, although there is no actual fake software installed on the machine, simply a screenshot of it on a webpage, displaying those made up infections.

The image was ripped off from rogue AV Antivirus System 2011, so you could say that it is slightly outdated.

Rather than enticing people to buy a license key to remove the fake infections, this one instructs users to call a toll-free number for assistance. What happens next is classic tech support scam text book, with online crooks taking remote control of the victims’ PC and selling a ‘tech support plan’ for hundreds of dollars.

While we may have a chuckle seeing this, it’s good to remember that it is nonetheless a scam and that people will fall for it. The majority of these pop ups are harmless and closing the browser normally or forcefully will get you back on your feet.

IOCs:

A good reference for fakeAVs: siri-urz.blogspot.com

Phone numbers:

1-877-920-3895
1-888-211-1702
1-888-994-8829

IP address:

93.95.229.26

Domain names:

system-error-alerts-583.com
verifymycomputerstatus.xyz
verifymycomputerstatus.club
message-system-notice-219.com
systemsmessage3390.com
monitorthecomputerstatus.xyz
system-message-alert-32.com
systems-alerts-9127.com
system-message-1238.com
computerstatuserror.club
systemalerts-218.com
system-alert-message-1389.com
systems-alerts-453103.com
systemsalert-322241.com
systemsalert6134.com
systems-kb-8712.com
systems2189-212.com
systems-08192.com
samurbondi.com
systems-1238.com
systems323-16.com
systems-1247.com
monitoracomputerstatus.com
systems-kb3291.com
system-alerts05103.com
system-messages-21.com
system-alert-2348.com
specialcare2017.com
monitorthecomputerstatus.com
monitormycomputerstatus.com
monitoryourcomputerstatus.com

COMMENTS

tuscany73

Twice in one month I have forwarded two emails that each replicated itself at the next inbox. Yet neither Webroot, Malwarebytes, CCleaner and Firefox caught it, nor stopped whatever it is that is “leeching” (my word) onto outgoing emails, but had to have come in on one. I emptied the Outbox several times, then deleted the emails out of the Deleted File, ran the systems – what else can I do????
I no longer know how to protect my computer or the people to whom I forward emails.
Werwa

Maybe you have something that changed the signature at the end of your email to something malicious? Like how if you send an email from your iPhone it says “sent from my iPhone” at the bottom.
I’m no expert at this (far from) so it could also be something else entirely.
What exactly is it sending, anyway?
Omar Rachman

I had the same problem before, and some of it was due to/ and solved by –
send the spam email to your ISP and see if they figure out where the mail is coming from and if they can give advice or shut it down for you.
If you are running a plan that gives you webspace, you could try changing the password.
Lastly, change your email password cuz your password may have been compromised.
The zombie PCs out there, run based on existing passwords.
Hope it helps.
ExposeDEMLiars

If there’s phone numbers to reach these crooks, then they can be found and arrested. Why aren’t they?
Richard

Because, they are usually not in the same country as their victims. You have to get foreign cooperation to arrest them. The ones I’ve personally seen done to a friend and one of my brothers; is that the phone number connects to someone who gives you another number to call. The second number is a burn number. Can be called only once. The first phone records the number that called before and puts it on the block list. So you can’t call back to complain. It’s elaborate, and set up so the authorities can only find the scapegoats, not the authors of the scam.
Glennfriend67

I actually got this message on my laptop a few months back. Called the number and they wanted me to buy their software. I said I have a very sophisticated software package on my system that catches stuff like this. He tried to tell me it can’t catch everything and I need to waste hundreds of dollars to buy his software. I’d said I’ll have to check with my security records first and hung up. Sure enough, my security records showed it was a virus and was already being isolated. Double checked with the tech who’d installed the software, and he confirmed, and advised me if I ever saw anything like this again to call him asap. Between Malwarebytes and my security nothin’ gets through to mess up my stuff anymore. I love you guys, Malwarebytes!
IanRM

Because they are using purchased virtual telephone numbers. Literally anyone in the west can rent them making their telephone location and ID covert.

RELATED ARTICLES

Cybercrime | Malware

Intentional PE Corruption

April 30, 2012 - Malwarebytes Anti-Malware is under constant attack. 24 hours per day, 7 days per week, 365 days per year. If you read my recent blog post about the development of Malwarebytes Chameleon, you know that we at Malwarebytes have big red ‘X’s on our chests; the bad guys are always out to get us. Malwarebytes Anti-Malware...

CONTINUE READING 16 Comments

Cybercrime | Malware

The Cat-and-Mouse Game: The Story of Malwarebytes Chameleon

April 24, 2012 - The fight against malware is a cat-and-mouse game. It is constant and constantly escalating. They make a move, you counter it, they counter your counter, lather, rinse, repeat. What’s more: malware almost always has the advantage. Our software Malwarebytes Anti-Malware earned a reputation for having a high success rate in combating new in-the-wild malware infections:...

CONTINUE READING 8 Comments

Cybercrime | Hacking

Cybercrime at $12.5 Billion: The Great Underreported Threat

May 7, 2012 - From the outside looking in, it may appear that the press regularly reports stories when a company’s website, database or intellectual property has been hacked, stolen or compromised. The more eye-opening fact of the matter is that the scale and scope of the cybercrime problem is much, much larger and the actual incidences of these...

CONTINUE READING 3 Comments

Cybercrime | Hacking

DDOS, Botnets and Worms…Oh My!

May 14, 2012 - The recent attack on the Serious Organized Crime Agency (SOCA), most likely in response to the 36 data selling sites shut down a few weeks ago, lead to the admission by high ranking SOCA officials that the Ministry of Defense networks need to “beef up their security.” In response to this we would like to...

CONTINUE READING 1 Comment

Cybercrime | Exploits

“The Sky is Falling… Are You at Risk from the Flame Malware?”

June 1, 2012 - The last time I checked with Google News this morning there were over 19,100,000 results for “flame malware”. You may have heard many stories this week about this complex trojan. Here are links to three of my current personal favorite articles on “Flame”. Powerful ‘Flame’ cyberweapon tied to popular Angry Birds game – (Fox News)...

CONTINUE READING 3 Comments

ABOUT THE AUTHOR

Jérôme Segura
Lead Malware Intelligence Analyst

Security researcher with a focus on exploits, malvertising and fraud.

CATEGORIES

101 Cybercrime Malwarebytes news PUP Security world

SEARCH LABS

TOP POSTS