The Legacy Sunbelt Software Blog

There’s a lot of hot downloading action taking place at the moment in relation to the earthquake / Tsunami in Japan…most of it related to helping, sharing information, bits of media offered up for free by artists and other things.

And by other things, I mean “random videos that are useless scams”. Nestled in between a collection of “Help Japan” videos / downloads is a “World mask art” download – advertised as “free”, naturally.

Click to Enlarge

Do you think this is going to end well, dear reader?

Click to Enlarge

Our uploader (called, er, “Porkballer12”) has lobbed 300+ videos onto Youtube in the space of a day or so, and all of them point to the same link – doesn’t matter if it says “World mask art”, “free finance powerpoints” or various kinds of security software. The shortened URL will bounce you from freecracksoftware(dot)com/software to a download site, complete with – you’ve guessed it – a survey.

Click to Enlarge

Hitting the frontpage of that website instead of visiting the redirection link will also pop a survey:

Click to Enlarge

Call me crazy, but I don’t think you’re going to end up with whatever advertised product brought you to the land of eternal surveys.

Christopher Boyd

There’s a lot of hot downloading action taking place at the moment in relation to the earthquake / Tsunami in Japan…most of it related to helping, sharing information, bits of media offered up for free by artists and other things.

And by other things, I mean “random videos that are useless scams”. Nestled in between a collection of “Help Japan” videos / downloads is a “World mask art” download – advertised as “free”, naturally.

Click to Enlarge

Do you think this is going to end well, dear reader?

Click to Enlarge

Our uploader (called, er, “Porkballer12”) has lobbed 300+ videos onto Youtube in the space of a day or so, and all of them point to the same link – doesn’t matter if it says “World mask art”, “free finance powerpoints” or various kinds of security software. The shortened URL will bounce you from freecracksoftware(dot)com/software to a download site, complete with – you’ve guessed it – a survey.

Click to Enlarge

Hitting the frontpage of that website instead of visiting the redirection link will also pop a survey:

Click to Enlarge

Call me crazy, but I don’t think you’re going to end up with whatever advertised product brought you to the land of eternal surveys.

Christopher Boyd

Researcher Patrick Jordan put together some statistics on the various Rogues he sees on a daily basis, and I thought it made for some interesting reading.

How are the rogue AV products shaping up in terms of monthly / yearly numbers? Let’s take a look at what Patrick has pulled out of a fiery lake of evil through the years:

Click to Enlarge

No surprises that the new finds keep coming, with the foot really hitting the gas pedal in 2008 and never really letting up. In terms of rogues from various families doing the rounds in 2011 (from the 1st of January to the 31st of March), we have a clear winner:

The PrivacyCenter rogue sweeps all aside, and probably accepts some sort of award for services to scamming people out of their money (Patrick tells me that “MSE stands for Microsoft Security Essentials which is the fake alert used with the MSE extension”). While I’m not a huge fan of long lists, the following long list gives you an idea of the overwhelming nature of so many fake products hitting the net every other day:

1/4/2011            Palladium.FakeRean
1/4/2011            HDDFix.FakeSysDef
1/5/2011            MemoryFixer.FakeSysDef
1/9/2011            DiskOK.FakeSysDef
1/12/2011          GoodMemory.FakeSysDef
1/12/2011          FastDisk.FakSysDef
1/12/2011          WindowsSystemOptimizator
1/15/2011          DiskOptimizer.FakeSysDef
1/17/2011          WindowsOptimization&Security
1/18/2011          MemoryOptimizer.FakeSysDef
1/18/2011          WindowsSecurity&Control
1/20/2011          WindowsUtilityTool
1/21/2011          WindowsScan.FakeSysDef
1/25/2011          WindowsUniversalTool
1/26/2011          Antivirus.Net.FakeSpyPro
1/26/2011          WindowsRiskEliminator
1/27/2011          SmartInternetProtection2011.FakeVimes
1/28/2011          WindowsDisk.FakeSysDef
1/28/2011          AVG-Antivirus.FakeXPA
1/28/2011          WindowsAntispywareSolution
1/28/2011          WindowsShieldCenter
1/31/2011          WindowsHealthCenter
2/1/2011            WindowsProblemsRemover
2/2/2011            WindowsProblemsProtector
2/3/2011            WinDisk.FakeSysDef
2/4/2011            DiskRecovery.FakeSysDef
2/4/2011            InternetSecurity2011.RTK
2/5/2011            WindowsSafetyProtection
2/6/2011            WindowsSoftwareProtection
2/7/2011            PCSecurity2011.FakeSpyPro
2/7/2011            WindowsSoftwareGuard
2/8/2011            WindowsWiseProtection
2/9/2011            AntiViraAV.FakeSpyPro
2/9/2011            WindowsCareTool
2/10/2011          WindowsOptimalSolution
2/11/2011          WindowsOptimalSettings
2/11/2011          AntivirusSystem2011
2/11/2011          InternetSecurityDefender2011
2/14/2011          WindowsProblemsSolution
2/15/2011          WindowsUserSatellite
2/17/2011          WindowsExpressHelp
2/18/2011          WindowsAVSoftware
2/20/2011          WindowsSafetyGuarantee
2/21/2011          InternetSecurityEssentials.FakeVimes
2/21/2011          WindowsOptimalTool
2/22/2011          WindowsExpressSettings
2/22/2011          MegaAntivirus2012
2/23/2011          InternetDefender
2/25/2011          WindowsTool.FakeSysDef
2/25/2011          WindowsPrivacyAgent
2/26/2011          WindowsProcessesOrganizer
2/28/2011          WindowsTroublesAnalyzer
3/1/2011            WindowsPerformanceManager
3/2/2011            AntiMalwareGo.FakeSpyPro
3/2/2011            WindowsEfficiencyManager
3/3/2011            AntiVirusAntiSpyware2011
3/3/2011            XPHomeSecurity.FakeRean
3/3/2011            WindowsDebugSystem
3/5/2011            AntivirusMonitor.FakeSpyPro
3/7/2011            WindowsErrorCorrection
3/8/2011            WindowsDefenceCenter
3/9/2011            WindowsServantSystem
3/10/2011          SystemDefender
3/10/2011          WindowsTroublemakersAgent
3/11/2011          WindowsTroublesRemover
3/13/2011          WindowsDiagnostic.FakeSysDef
3/14/2011          WindowsRemedy
3/16/2011          BestMalwareProtection.FakeVimes
3/16/2011          E-SetAntivirus2011.FakeXPA
3/16/2011          WindowsThreatsRemoving
3/17/2011          WindowsEfficiencyMagnifier
3/18/2011          WindowsSafeMode.FakeSysDef
3/18/2011          SystemDiagnostic.FakeSysDef
3/18/2011          WindowsEmergencySystem
3/21/2011          CleanThis.FakeRean
3/21/2011          WindowsSupportSystem
3/22/2011          WindowsLowlevelSolution
3/23/2011          WindowsRecovery.FakeSysDef
3/23/2011          WindowsBackgroundProtector
3/24/2011          WindowsSimpleProtector
3/25/2011          WindowsPowerExpansion
3/26/2011          MSRemovalTool
3/28/2011          WindowsExpansionSystem
3/29/2011          WindowsRepair.FakeSeysDef
3/30/2011          WindowsProcessRegulator
3/31/2011          WindowsStabilityCenter

Pretty crazy. As always, if you happen to find yourself on a website with flashing infection alerts and constant offers to download a “security program”, ignore the prompts, don’t fill in any information and run the other way.

Thanks Patrick.

Christopher Boyd

Researcher Patrick Jordan put together some statistics on the various Rogues he sees on a daily basis, and I thought it made for some interesting reading.

How are the rogue AV products shaping up in terms of monthly / yearly numbers? Let’s take a look at what Patrick has pulled out of a fiery lake of evil through the years:

Click to Enlarge

No surprises that the new finds keep coming, with the foot really hitting the gas pedal in 2008 and never really letting up. In terms of rogues from various families doing the rounds in 2011 (from the 1st of January to the 31st of March), we have a clear winner:

The PrivacyCenter rogue sweeps all aside, and probably accepts some sort of award for services to scamming people out of their money (Patrick tells me that “MSE stands for Microsoft Security Essentials which is the fake alert used with the MSE extension”). While I’m not a huge fan of long lists, the following long list gives you an idea of the overwhelming nature of so many fake products hitting the net every other day:

1/4/2011            Palladium.FakeRean
1/4/2011            HDDFix.FakeSysDef
1/5/2011            MemoryFixer.FakeSysDef
1/9/2011            DiskOK.FakeSysDef
1/12/2011          GoodMemory.FakeSysDef
1/12/2011          FastDisk.FakSysDef
1/12/2011          WindowsSystemOptimizator
1/15/2011          DiskOptimizer.FakeSysDef
1/17/2011          WindowsOptimization&Security
1/18/2011          MemoryOptimizer.FakeSysDef
1/18/2011          WindowsSecurity&Control
1/20/2011          WindowsUtilityTool
1/21/2011          WindowsScan.FakeSysDef
1/25/2011          WindowsUniversalTool
1/26/2011          Antivirus.Net.FakeSpyPro
1/26/2011          WindowsRiskEliminator
1/27/2011          SmartInternetProtection2011.FakeVimes
1/28/2011          WindowsDisk.FakeSysDef
1/28/2011          AVG-Antivirus.FakeXPA
1/28/2011          WindowsAntispywareSolution
1/28/2011          WindowsShieldCenter
1/31/2011          WindowsHealthCenter
2/1/2011            WindowsProblemsRemover
2/2/2011            WindowsProblemsProtector
2/3/2011            WinDisk.FakeSysDef
2/4/2011            DiskRecovery.FakeSysDef
2/4/2011            InternetSecurity2011.RTK
2/5/2011            WindowsSafetyProtection
2/6/2011            WindowsSoftwareProtection
2/7/2011            PCSecurity2011.FakeSpyPro
2/7/2011            WindowsSoftwareGuard
2/8/2011            WindowsWiseProtection
2/9/2011            AntiViraAV.FakeSpyPro
2/9/2011            WindowsCareTool
2/10/2011          WindowsOptimalSolution
2/11/2011          WindowsOptimalSettings
2/11/2011          AntivirusSystem2011
2/11/2011          InternetSecurityDefender2011
2/14/2011          WindowsProblemsSolution
2/15/2011          WindowsUserSatellite
2/17/2011          WindowsExpressHelp
2/18/2011          WindowsAVSoftware
2/20/2011          WindowsSafetyGuarantee
2/21/2011          InternetSecurityEssentials.FakeVimes
2/21/2011          WindowsOptimalTool
2/22/2011          WindowsExpressSettings
2/22/2011          MegaAntivirus2012
2/23/2011          InternetDefender
2/25/2011          WindowsTool.FakeSysDef
2/25/2011          WindowsPrivacyAgent
2/26/2011          WindowsProcessesOrganizer
2/28/2011          WindowsTroublesAnalyzer
3/1/2011            WindowsPerformanceManager
3/2/2011            AntiMalwareGo.FakeSpyPro
3/2/2011            WindowsEfficiencyManager
3/3/2011            AntiVirusAntiSpyware2011
3/3/2011            XPHomeSecurity.FakeRean
3/3/2011            WindowsDebugSystem
3/5/2011            AntivirusMonitor.FakeSpyPro
3/7/2011            WindowsErrorCorrection
3/8/2011            WindowsDefenceCenter
3/9/2011            WindowsServantSystem
3/10/2011          SystemDefender
3/10/2011          WindowsTroublemakersAgent
3/11/2011          WindowsTroublesRemover
3/13/2011          WindowsDiagnostic.FakeSysDef
3/14/2011          WindowsRemedy
3/16/2011          BestMalwareProtection.FakeVimes
3/16/2011          E-SetAntivirus2011.FakeXPA
3/16/2011          WindowsThreatsRemoving
3/17/2011          WindowsEfficiencyMagnifier
3/18/2011          WindowsSafeMode.FakeSysDef
3/18/2011          SystemDiagnostic.FakeSysDef
3/18/2011          WindowsEmergencySystem
3/21/2011          CleanThis.FakeRean
3/21/2011          WindowsSupportSystem
3/22/2011          WindowsLowlevelSolution
3/23/2011          WindowsRecovery.FakeSysDef
3/23/2011          WindowsBackgroundProtector
3/24/2011          WindowsSimpleProtector
3/25/2011          WindowsPowerExpansion
3/26/2011          MSRemovalTool
3/28/2011          WindowsExpansionSystem
3/29/2011          WindowsRepair.FakeSeysDef
3/30/2011          WindowsProcessRegulator
3/31/2011          WindowsStabilityCenter

Pretty crazy. As always, if you happen to find yourself on a website with flashing infection alerts and constant offers to download a “security program”, ignore the prompts, don’t fill in any information and run the other way.

Thanks Patrick.

Christopher Boyd

Kabay apologies (elegantly) this afternoon.  Forensics completely vindicate Samsung.  

There really is no keylogger installed on Samsung laptops.  Period.

Alex Eckelberry

A “market” based approach to getting companies to fix vulnerabilities.

Vulnarb.com is an idea I’ve had for a while but only recently figured out how I might do it. The problem it solves is allowing security researchers to responsibly release vulnerabilities they find, but still publicly report that a company has a vulnerable product.

It’s worth noting that Zed Shaw, the guy who is starting this, is a legendary programmer in the world of open source web frameworks.

Link here.

Alex Eckelberry
(Thanks Matthew)

On that whole SQL injection thing, here’s an interesting one I found while stumbling around researching today.

Hmm…What’s that all about? Any more pages like this? Let’s see!

Well, yeah. There’s err, a few.

I found a some more, and it doesn’t seem like a huge amount, but something that Apple should certainly clean up.

itunes.apple.com/us/podcast/turkish/id161320202
itunes.apple.com/pl/podcast/cuneyt/id152442304
itunes.apple.com/kr/podcast/belgesel-title-script-src/id206817953

These pages have live malware on them…

(There may be more but it’s Saturday evening and I have a life.)

Alex Eckelberry

Alas, the news was published on April 1^st. But it is not a joke.

Curious, I spent a bit of time today researching it (when I really was supposed to be doing other things), and while the “lizamoon” url is down, there are still a number of other URLs active on this one.

Without a lot of effort, I found infections using other URLs, which include

t6ryt56.info/ur.php
tadygus.com/ur.php
milapop.com/ur.ph
books-loader.info/ur.php

(These are all malicious, so obviously don’t go to them unless you know what you’re doing, etc.)

However, I doubt the infection is as massive as is being stated. For unique sites, perhaps a few thousand. More pages than that, but in terms of unique domains, not a million, as might have been inferred from articles.  

What’s curious is I found something else that was interesting —  encoded View State with malicious URLs injected into the site.

For example, here’s a screenshot of an example encoded View State that I found on one of the injected sites.

First, an infected page (with VIPRE yelling away that there’s a problem in the corner — sorry, can’t help the shameless self-promotion).

So let’s take a look at the page source:

Yuck! What’s all that? It’s encoded View State.

So we go to a handy-dandy decoder, paste the offending text, do a little “where’s Waldo” and there you have it:

How cool is that?

And yes, that is really painfully sloppy stuff.

Alex Eckelbery
(Obligatory hat tip to Jose)

Peter Kleissner has published a rather tasteless April fools joke, a supposed article that states he has been convicted of selling Ikarus source code.  Ikarus is his former employer, and is the subject of a current squabble.  

Kleissner, a brash and very smart Austrian 20–year old, gained notoriety as a teenager at Blackhat 2009 by releasing Stoned Bootkit, an MBR rootkit he created.  This created all kinds of messiness, being banned from the AV community and fired from his job at Ikarus.  Things got uglier when he published a site, avtracker, which tracks what IP numbers antivirus companies use (hence, assisting malware authors in avoiding detection).  Not good. There’s much more to say about Kleissner, whose antics are sometimes dizzying.  I’ll leave that story for someone else.

Alex Eckelberry

Network World has published a retraction of the original story on the Samsung non-kleylogger.

Alex Eckelberry

I think we all know the answer to the question of whether or not I’ll be watching a movie involving a giant robot Samurai waving a chaingun around this weekend, but it’s worth noting that – as with anything movie related – the “fill in the survey / download a program to watch the content” sites are out in force. Step up to the plate, eleventy billion promos for Sucker Punch:

Click to Enlarge

Example site:

Click to Enlarge

Click to Enlarge

As usual, you’re being asked to install something or (elsewhere) fill in a survey:

The Leechtv(dot)com site interested me because unlike the majority that throw up a fake Youtube player screenshot, this one teases the viewer by playing the first ten or so seconds in a real clip player before “freezing” the clip then launching the popup. I guess that could potentially lure someone into jumping through the required hoops to view the content (if the rest of the content is even there in the first place, that is).

As you might expect, there’s also the usual collection of adf.ly links that generate money for the link creator but send the user to cookie-cutter spamblogs, and “movie sites” that actually just want to sign up to recurring credit card charges for monthly membership.

Don’t waste your time with any of them.

Christopher Boyd

A Slovenian language directory for Windows Live is causing us considerable headaches this morning, and we have no one to blame but ourselves. 

A Network World article has alleged Samsung laptops of having a keylogger.  Unfortunately (and to our dismay), the evidence was based off of a false positive by VIPRE for the StarLogger keylogger. 

The detection was based off of a rarely-used and aggressive VIPRE detection method, using folder paths as a heuristic.  I want to emphasize “rarely”, as these types of detections are seldom used, and when they are, they are subject to an extensive peer review and QA process.  (It’s not common knowledge, but folder path detections are actually used by a good number of antimalware products, but are generally frowned upon as a folder that looks clearly like one for malware has the potential of generating just this kind of result — a false positive.)

The directory in question was C:WINDOWSSL, and is the Slovenian language directory for Windows Live.  This same directory path is used by the StarLogger keylogger.

How does this happen?   A researcher has a number of tools at his or her disposal to detect a piece of malware.  These include a broad range of detection types based on the malware in question. Sometimes, a simple signature is fine; other times, a more carefully crafted detection is needed.  In VIPRE, among some of the detection types are heuristic (meaning, using a method of pattern analysis on the file); behaviorial  (looking at the behaviour of a file in VIPRE’s emulator to see if it does anything malicious) or signature-based (simply creating a file signature for the file).  Part of the heuristic toolkit used might be any number of types of analyses, and these can include looking at the contents of the file for specific patterns that indicate malware.  A researcher can also (but rarely) use a folder path as part of a more comprehensive detection set.  Imagine you’re a researcher:  You see the folder name “C:windowssl”.  This is, indeed, something one would never find on a Windows system at the time the detection was written, so the researcher added this folder path to his heuristics for this keylogger.  It was peer-reviewed and tested against a broad range of Windows platforms, including every foreign language set.  Everything is fine and dandy… except that at some point several years after the original detection was written, Windows Live started using that directory to install Slovenian language files for Windows Live.  Samsung started pre-installing Windows Live, including all the languages, and there you have the problem we’re having today.

We apologize to the author Mohamed Hassan, to Samsung, as well as any users who may have been affected by this false positive.

False positives do happen, it’s inevitable and like all antivirus companies, we continually strive to improve our detections, while reducing any chance of a false positive.  This one (admittedly, an incredibly embarrassing one) made it through our processes, and I have met with the senior managers in the area this morning to handle what happened and to continue to improve our processes. 

The false detection is fixed in definition set 8878.

Alex Eckelberry
General Manager, GFI Security

Well, this is pretty interesting:

GNU Free Call is a new project to develop and deploy secure self-organized communication services worldwide for private use and for public administration. We use the open standard SIP protocol and GNU SIP Witch to create secured peer-to-peer mesh calling networks, and we welcome all participation in our effort.

Our goal is to make GNU Free Call ubiquitous in a manner and level of usability similar to Skype, that is, usable on all platforms, and directly by the general public for all manner of secure communication between known and anonymous parties, but without requiring a central service provider to register with, without using insecure source secret binary protocols that may have back-doors, and without having network control points of any kind that can be exploited or abused by external parties. By doing so as a self organizing meshed calling network, we further eliminate potential service control points such as through explicit routing peers even if networks are isolated in civil emergencies.

More (quite a bit more, actually!) on the official announcement page.

Christopher Boyd (Thanks Alex)

It looks like we have yet another facebook profile tracker doing the rounds, this time called “Profile Watch” (how original).

Visiting any of the links currently being spammed results in websites such as the one below promising to tell you who keeps checking out your profile:

Click to Enlarge

As usual, it’s all total nonsense – they just want you to fill in surveys and generate some affiliate cash. If you want, you can install the related App and go spamming walls:

Click to Enlarge

Of course, it’s probably better if you don’t do that.

Some of the stats make for depressing viewing:

Click to Enlarge

164,431 clicks with the bulk coming from the UK and the US. Check out the day by day clicks, where this particular site is pulling in close to fifty thousand clicks per day from the 27th to the 29th of March. I wonder how many of those went ahead and filled in a survey?

I know there’s certainly a lot of people spamming walls with the promotional text (do a search for “WH0 CHECKS YOUR PR0FILE” on one of the many Facebook search engines and watch how many result come flying back at you). There’s a number of URLs involved, including 5d(dot)thehabsurs(dot)info, fbprofilespynow(dot)info and jilba1(dot)info.

Don’t bother going anywhere near this one.

Christopher Boyd (Thanks to Wendy and Matthew).

Thanks to the person who sent this over but wishes to remain anonymous – appreciated!

Below, we have a rather interesting twist on the 419 scam mail (and of course, it’s related to the Japanese Earthquake / Tsunami). They don’t ask you to jump onto a phish page and sign your life away – instead, they ask you to send your information to the actual Red Cross but also ask you to CC whatever you send to their alternate scam email address.

Seeing as how the Red Cross will probably take a while to get back to you while in the middle of dealing with the Japanese disaster relief, by the time they’re asking you why you sent them endless emails involving Western Union money transfers the 419 scammer has probably cleaned out your bank account.

Here comes the mail, with important bits highlighted in bold:

From: British Red Cross(Donation Board) [mailto:relieffortsATredcross.org.uk]
Subject: Donate to Japan Tsunami Relief Efforts

British Red Cross

Japan Tsunami Appeal

British Red Cross

44 Moorfields

London

EC2Y 9AL

The massive earthquake and resulting tsunami that struck Japan on 11
March have caused widespread destruction and suffering, relayed on
television screens around the world.

More than 4,300 people have died in the disaster, thousands are
injured or missing, and more than 440,000 people have had to leave
their homes.

The British Red Cross has already deployed 11 disaster-response teams
with medical personnel providing medication, food items, blankets,
clothing and many more relief assistance to the Tsunami victims in
Japan.

Similar to its efforts in the aftermath of the Haiti Earthquake, the
Red Cross is accepting donations online.

We hereby appeal to you individuals, public, families and companies,
to assist us with an online fund raising to enable us treat and render
our services to over one million people affected with the tsunami
disaster across Japan.

Help give shelter to the homeless in Japan, treatment to the injured,
cloths, food items, blankets and many more to the needy here in Japan.
No amount of donation is small; send us your donation in London, UK
through Western Union Money Transfer for amounts less than $10,000 USD
and for amounts above the $10,000 USD, on your request account details
shall be provided.

If you cannot assist us financially, you can also help by forwarding
this message to all your friends and contacts.

We will have the names of our donors appeared in our relief magazines
and websites on their approval while there will be space for photos,
names and business adverts for company donors in our
magazines/websites on their approval.

Donations should be made via any of the following means;

– Western Union Money Transfer

– Direct deposit into Correspondent Bank Account (For donations above
$10,000 USD)

We shall provide you with our payment details and directives upon the
confirmation of your desired means.

Kindly send us your Names and Phone Number so we can reach you for
further information on how to assist the needy in Japan.

Note: Whenever you send us an email, endeavor to CC every message to
our alternate email address: uk.redcross@blumail.org in any case our
spam filters reject your messages.

Sincerely,

British Red Cross
Email: relieffortsATredcross.org.uk
Alternate: uk.redcrossATblumail.org

Pretty clever. As always, don’t reply to blind mailshots asking for your information even when it appears to be totally legitimate.

Christopher Boyd

Below we have a rather fetching page located at helpjapan(dot)co(dot)tv:

Click to Enlarge

“Japan Earthquake Relief: Help raise money for disaster relief in Japan with a few clicks of your mouse”.

That’s great, except hitting the Connect with Facebook button reveals an app called “your age pic” located at apps(dot)facebook(dot)com/youwilllooklike – at least, it would if it wasn’t currently offline due to an “issue with its third party developer”.

Click to Enlarge

Check out the reviews, which mention friend spamming. Here’s someone having problems with rapid fire messages being sent out.

The message posted to Facebook pages looks like this:

Click to Enlarge

“YOUR 1 click = $0.5 for Japan Relief Fund !!  Guys ! Japan needs ur help real bad !! People are suffering,lost their homes,friends,family and more  Please Support the earthquake victims @ helpjapan(dot)co(dot)tv/”

There’s quite a few off those knocking around in public Facebook searches right now. Given that the whois info for the website looks fake (“the almsn ddsfg Afghanistan”?) and it is hosted alongside what look like Call of Duty Facebook scam sites I doubt we’ll be seeing this app reactivated.

Below, you can see a continuation of the popular “girl commits suicide on cam” scam, sitting on a Facebook app page located at apps(dot)facebook(dot)com/hollevideo.

 Click to Enlarge

Click to Enlarge

The app for this one is currently offline, but alongside the surveys and profile editor pages you could also allow the app to “access your basic info, post to your wall and access your data anytime”.

You know, if you really wanted to…

Christopher Boyd (Thanks to Wendy for the webcam app link)

I guess people are reporting many Japan disaster donation websites to Paypal, because we’re seeing a lot of sites with their payment screens disabled, blocked or just plain fired into the heart of the Sun. Here’s a fresh one on Myspace (you remember Myspace, right?) with Red Cross imagery and the ever-present donate button:

Click to Enlarge

Try to reach the payment screen, and you’ll see this:

Click to Enlarge

Here’s another one that was lurking under a .tk “Red Cross” URL, promoted heavily on video sharing websites:

Click to Enlarge

The payment screen for that one was a Romanian Paypal account screen tied to a ymail (Yahoo) Email address. At time of writing, that has also been disabled. Note that people are apparently leaving real Facebook comments, and it has 80+ likes. I wonder how many gave money?

The one below – located at helpdonatejapan(dot)com – was taken offline sometime last night from the looks of it. Once again, it’s a “nonprofit organization” with no credentials on display and a lot of “donate now” buttons everywhere. They claim they’ll send people who donate a “Make a change” bracelet – nice of them.

Click to Enlarge

Payment screen:

Click to Enlarge

We’re also seeing cut and paste profiles popping up on sites such as Netlog. Here’s a couple:

Click to Enlarge

All of these profiles are clearly made by the same person, yet they all sport different information (one is female, two are male, they’re all different ages yet all three were supposedly born on the 19th of March).

There are no donation buttons yet but it does seem rather peculiar, doesn’t it?

As always, if you want to make a donation you should go here.

Christopher Boyd (thanks to Steven for sending over the helpdonatejapan website!)

Looks like they’re starting early with these scams, seeing as Easter isn’t until April 24th.

Patrick Jordan came across some dubious links while digging around for printable Easter Cards on .pl domains. These redirect links are lurking at the top of search results, and there seem to be quite a few URLs involved.

Click to Enlarge

Click to Enlarge

In the above examples, end-users would hit one of the “it’s a trap” landing pages, then be redirected to sites pushing the System Defender rogue.

Click to Enlarge

Cue Patrick:

“1. Site/url changes almost every 24 to 48 hours.
2. Can make only one run as it then rotates to ad site for 24 hours unless you change your IP.
3. Also, for the last two site/urls they are in the #1 position in the Google results”

If you accidentally hit one of these scam sites, don’t panic and DON’T open up any executable files presented in the middle of an entirely fake system scan. Just close the prompt, leave the site (shut down your browser with CTRL+ALT+DEL if you have to) and walk away – whistling optional.

Christopher Boyd (Thanks Patrick)

Here’s a freshly minted scam mail doing the rounds – this time, claiming to be a victim trying to escape Japan and needing a cool $1,600 to do it.

From: jamainelecottATyahoo.com
Subject: Please Help Life, From Jamaine Lecott

Hello Dear Friend

My Name is Jamaine Lecott

i am in hurry writing you this message and i hope you get it on time, there was very hard quake here in my country northeastern coast in japan. It has been a very sad and bad moment for me and my family here, the present condition that we found myself is very hard for me to explain.i want us to be out of the country immediately i am asking for help of ($1,600 ) only to raise our ticket charge and some other expenses to leave here I will appreciate whatever you can afford to assist me and my family so that we can have food and eat to be out of the country i will be very happy for that , we lost every thing we have Please send the money via Western Union money transfer channel because that is the only way we could be able to get the money fast and leave. which country are you transferring the money from please help us with thanks GOD will help you also and bless you…

ADDRESS.NO A14 Tokyo. northeastern coast japan
My Honest Regard,
Jamaine Lecott

Needless to say, you should not get involved in this.

Christopher Boyd

There’s falling on your sword, and there’s using Skype to call security researcher Adam Thomas then trying to sell him some fake AV.

This is an example of the latter.

The site involved was sosdl(dot)com (currently offline) and here’s a screenshot:

Click to Enlarge

The payment account is still live:

Click to Enlarge

Not sure I’d pay $19.95 for “instant repair”, but I’m sure somebody will find it tempting.

Read more about the fun people are having with rogue AV phonecalls over on the Brian Krebs blog., and keep an eye out for random URLs being thrown around Skype with “sos” in them.

Christopher Boyd (Thanks Adam).