Spyware/SmitFraud Infection and Phishing Attempt

Video download from http://www.websense.com/videos... showing a real-time infection of a spyware trojan on a computer caused by visting a website that hosts a spyware installer. This is just a demonstration of how dangerous spyware is if you don't have the right protection software installed. The computer was more than likely wiped and formatted after being at the mercy of this infection.If you can't see the video well, this is what it does:1) The user who is controlling the computer types in a website address into Internet Explorer and hits enter. The file he downloads automatically opens up and starts opening up with Windows' Picture viewer - but the file he download wasn't a picture.2) Immediately the file runs a batch command (the black screen) which is basically like an installer for the virus. Suddenly a whole load of new icons appear on the desktop. 3) An icon also appears in the system tray and the balloon tip says "Your computer is infected!". In fact, this is not a message from the Windows OS, but it is a fake message from the virus that asks the user to run a fake anti-virus software to "remove" it from your computer. In actual fact, the message is true, but what users don't realise is that the message itself is the virus.4) Suddenly the desktop changes (you notice by now that the computer is running much slower due to the virus infecting the whole computer) to a picture the virus put on there.5) A new icon appears on the desktop called WinHound and the program starts running (you can see the splash page with the picture of the leopard/tiger).6) WinHound then "pretends" to scan the computer for viruses and it makes a lie about there being a different virus on the computer. It makes the user think that WinHound is an antivirus product by scanning the computer, but it actually isn't.7) When the scan is complete a dialog appears (notice that it's called "Microsoft Internet Explorer" :D ) that tells the user there is a "fake" infection.8) Another dialog is opened up which asks the user to visit a website where they can "pay" for a removal tool for the "fake" virus. In fact, the website is actually a phishing website which asks for credit card details. This makes the user think that they have to pay for a removal tool, but what they actually get is their money stolen.Just so you know, this is *not* my own video. I did not create it. I downloaded it from the link above. My own computer is perfectly fine, thank you!

Channel: Howto & Style
Uploaded: November 30, 1999 at 12:00 am
Author: rjcuk

Length: 01:41
Rating: 4.20
Views: 27830

Tags: adware  badware  balloon  computers  desktop  icon  install  internet  protection  security  spyware  website  windows  winhound  

Video Comments