And finally, standard user malware

re: And finally, standard user malware

Eric Eskam — Sat, 03 Oct 2009 17:48:02 GMT

I too am surprised it has taken this long for something like this to appear. If Firefox can install in usermode, why not malware?

BTW - a handy flowchart to help users decide if they really should click to see the dancing naked pigs:

www.intac.net/a-flowchart-to-help-you-decide-when-to-click-past-the-security-warning

re: And finally, standard user malware

Hilton Travis — Thu, 10 Sep 2009 21:21:34 GMT

G'day Jesper,

All theswe filth are doing is following Microsoft's lead with Microsoft Live Mesh and Microsoft Vine which don't install into Program Files, but into AppData\Local, therefore not requiring elevated rights.

Now, this is a huge security vulnerability to me - allowing non-Admin users the ability to install applications. WTF was Microsoft thinking?

Have you tried installing Live Mesh with "Run as Administrator"? What does the error message "Live Mesh: Product does not support running under an elevated account. This class is not configured to support Elevated activation. Error: 80080017". Now, is that an error message, as a Security professional, that scares the pants off you, or what?

re: And finally, standard user malware

Simon — Thu, 03 Sep 2009 20:02:56 GMT

Hey Jesper

Sorry to hear about your friend being duped into the scam. I had to fix dozens of computer with that stupid malware but luckily, every user just got frustrated instead of giving in to the demand (could also be because they were broke!). But $5,000? I believe the user themselves also have the responsibility to make sure that everything is legit before giving away that much money.

re: And finally, standard user malware

Larry Seltzer — Tue, 01 Sep 2009 11:54:34 GMT

When you think about it, how is anti-malware supposed to detect user malware such as this? If they don't have a signature for it then there's nothing in the behavior of the program that could be determined heuristically to be malicious. All the program does is put on a show.

I'm also told by anti-malware companies that these rogue anti-malware programs are particularly aggressive about their obfuscation techniques.