Safety Center

[Malekal_morte]

Safety Center est un rogue (faux anti-spyware) qui s'installe sans permission, le malware affiche de fausses alertes vous indiquant que vous êtes infecté par un spyware et vous recommande d'acheter ce faux anti-spyware pour soit disant désinfecter votre ordinateur.

[Malekal_morte]

fake alert :

Code : Tout sélectionner

1254661382.585   1095 192.168.1.120 TCP_MISS/200 11261 GET http://lastspy.info/hitin.php?affid=02919 - DIRECT/95.211.27.166 text/html

Code : Tout sélectionner

1254661394.840    427 192.168.1.120 TCP_MISS/200 32045 GET http://bfichgfqjqrtkwrsegoj.cn/02919.exe - DIRECT/91.207.116.44 application/octet-stream
1254661458.337    438 192.168.1.27 TCP_MISS/200 32045 GET http://bfichgfqjqrtkwrsegoj.cn/02919.exe - DIRECT/91.207.116.44 application/octet-stream
254661465.597    737 192.168.1.27 TCP_MISS/200 219433 GET http://91.207.116.44/1.dll - DIRECT/91.207.116.44 application/octet-stream
1254661467.874   1144 192.168.1.27 TCP_MISS/200 982313 GET http://91.207.116.44/u5.exe - DIRECT/91.207.116.44 application/octet-stream

[Malekal_morte]

L'infection proposant ce rogue/scareware hijack la page de Google en incrustant une image donnant le message : "Google search has detected an unregistered version of PrivacyCenter and recommends updating to the full version of safe web browsing

Le but étant de faire croire à l'internaute que Google a détecté une version non enregistré du faux antivirus.



Les recherches peuvent aussi ne pas fonctionner et afficher un faux messages "Access Denied" :

Google search has detected an unregistered version of PrivacyCenter and recommends updating to the full version of safe web browsing.

Internet Explorer was unable to link to the Web page you requested.
Page
http://xxxxx
returned this response:

We are sorry but your query looks similar to requests from a computer infented by viruses or spyware applications.
Unfortunately, for the protection of our users, we are not able to proceed with your request at the moment.We will restore your access as quickly as possible,so try again later.
Meanwhile, if you suspect that your computer or network has been infected,you might want to run a virus checker or spyware remover to makesure that your system is free of viruses and other malicious software.


--------------------------------------------------------------------------------

Please try the following:

Make a full scan of your computer.
Click Scan Now- Internet Explorer will try to find and run the antivirus software.
For information about spyware protection, click the Help menu, and then click Contents and Index.

La cause étant soit disant une infection, le lien "Scan Now" (pointant vers une adresse locale http://127.0.0.1/RunAntivirus) ouvre tout simplement le rogue.

Encore une fois le but est de tromper l'internaute pour faire la promotion du rogue.