(The quickest way to register)

Forum

  1. User picture
    • g7w on Sat 04 Feb 2012
    • 09:23:27 PM UTC

    Security Shield ransomware

    Security Shield 2011 - FAKE AV / Ransomware
     

    Browsers which have the Java plug-in installed and enabled will become infected if visiting these domains

    BleepingComputer
    Security Shield is a computer infection from the same family as MS Removal Tool. This infection is also categorized as a rogue anti-spyware program as it pretends to be an anti-virus program, but is actually a program that displays fake security alerts and scan results in order to make you think your computer is infected. Security Shield is installed through the use of malware that will install the program onto your computer without your knowledge or permission. When installed, the infection files will be created in a random named folder in c:\Documents and Settings\\Local Settings\Application Data\, in XP, or C:\Users\\AppData\Local\, in Windows Vista and Windows 7. It will then be configured to start automatically when you login to your computer.

    images hosted courtesy of: http://imageshack.us/

    [edit]
    removed
    85.25.116.188
    kino24you.com
    humorwhole.com
    6aa.info

    The malware was transferred through a 3rd party advertising site (Malvertising)

    cataloged on wiki: Forum discussion: Threats:Fake Antivirus scanners

    ------- WOT Services Ltd. - gives us safety through Web of Trust. WOT Community - gives us security through unity. ∞

Comments:

  2. User picture
    • David Henr on Sun 05 Feb 2012
    • 03:44:44 PM UTC

    RE: Security Shield ransomware

    dear g7w;

    isn't it funny that you have scanned your computer, found some viruses and you belame 6aa.info because of that? maybe you got this viruses from somewhere else? how can you and i know that you got these 13 viruses from 6aa.info?

    As you see google says it safe "http://www.google.com/safebrowsing/diagnostic?site=6aa.info" but your computer scanner it is unsafe? isn't it conflicting?

    i am sure of my website humorwhole.com that is safety but you are not sure of your claimings? please be fair!
  3. User picture
    • Jazspeak on Sun 05 Feb 2012
    • 05:27:47 PM UTC

    RE: Security Shield ransomware

    @ David Henr

    Originally posted by: David Henr
    "...found some viruses and you belame 6aa.info because of that? maybe you got this viruses from somewhere else? how can you and i know that you got these 13 viruses from 6aa.info?"

    You have only been a registered member of WOT for less than a month, whereas g7w is a very experienced member with a strong track record for investigating and rating sites. Whilst nobody is 100% accurate for 100% of the time, and I have no doubt that g7w would agree with that, if g7w says that he got the viruses from that site then I am more inclined to believe him than you. When you have developed a strong track record for investigating sites accurately then I might be be inclined to take more notice of your protestations.

    ~Music is not just for the Masses~

  4. User picture
    • kayi on Sun 05 Feb 2012
    • 08:29:05 PM UTC

    RE: Security Shield ransomware

    of course you dont have to notice my protestations and of course you should believe to him. but if someone represent a thing to blame something, he must prove it. but there is no evidence that these viruses belong to the website. i am not saying that he lies, because it is clear that he has some viruses on his computer.

    can you say that even g7w could be sure that these viruses belong to website? No. because there is not no evidence.
  5. User picture
    • g7w on Sun 05 Feb 2012
    • 09:23:09 PM UTC

    RE: Security Shield ransomware

    Originally posted by: David Henr
    dear g7w;

    isn't it funny that you have scanned your computer, found some viruses and you belame 6aa.info because of that? maybe you got this viruses from somewhere else? how can you and i know that you got these 13 viruses from 6aa.info?

    As you see google says it safe "http://www.google.com/safebrowsing/diagnostic?site=6aa.info" but your computer scanner it is unsafe? isn't it conflicting?

    i am sure of my website humorwhole.com that is safety but you are not sure of your claimings? please be fair!

    When visiting an unknown domain or "website"
    I use a secondary browser which runs through a sandbox

    Merely typing 6aa.info into the browser's address bar, in this case IE
    While the site was loading...
    Windows Media Player opened stating it's loading hcq_asx which resulted with nothing loaded in the player
    however, Java was initiated as well - all before the pornographic "movie" link images loaded.

    Java is required for Security Shield 2011 to install; hence the visit with Internet Explorer, my Firefox does not allow Java, nor or Java plug-ins installed.

    I have been in private conversation with another member, who could not reproduce receiving infection.
    I revisited again with no results.

    However, I assure you, I would not create such a topic without legitimacy.
    Simply visiting 6aa.info initiated installation of Malware without the need to "click" or open links.

    This could have resulted from Malvertising
    Or the site could have been compromised
    It's not my domain, it's not under my control; I only proffer warnings from experience.

    As with any topic in these forums, people are not to blindly rate sites without visiting / confirming - we are human, we can make mistakes.
    It is suggested that visiting malware domains or domains which act as an intermediary, through the use of a VM or sandbox; ie:
    https://www.virtualbox.org/
    http://www.sandboxie.com/

    Also understand, I am 1 of millions of WOT users - my ratings are not "final"
    Any WOT user who disagrees with a site's reputation is encouraged to rate it based on their trust with the site
    Any registered WOT user has the option of creating a comment on the scorecard and/or dis/agree with existing comments when the facility is available.

    ------- WOT Services Ltd. - gives us safety through Web of Trust. WOT Community - gives us security through unity. ∞

  6. User picture
    • kayi on Sun 05 Feb 2012
    • 10:06:07 PM UTC

    RE: Security Shield ransomware

    dear g7w;

    noone but you (mcafee,google etc) say that there are viruses on the website. i have virus scanner and does not find any viruses that you found on "your computer". look at the google result : http://www.google.com/safebrowsing/diagnostic?site...

    of course, people are not blindly rate sites without visiting / confirming and you are just on of millions of WOT and your ratings are not final. although all of these, can you stiil open a thread and write that this website have viruses without any proof. do you think is it fair to blame something so easily. as jazspeak said; do people believe you or a week ago-registered user?

    i think this topic should have been deleted, to be intended for being a fair user. these all are my last words.

    Thank you.