Anti Virus 2009 and other nasty stuff

The browser/phishing wars keep getting harder to beat. Now we have bogus "session expired" screens popping up when you're legitimately logged into your bank's web site. We also have nasty trojans that stop your system from getting help by blocking access to Microsoft Update and your favourite anti-virus sites.

Even if you really are logged into your own bank's web site, it is possible that the "bad uglies" have installed software into your browser that will pop up a window that IS NOT THE BANK'S COMPUTER CONTROLLED WINDOW.

This "session hijacking" or "session phishing" will make the popup look like it came from the bank's site but in fact it is running locally on your computer. It may ask you to "again" enter your account and password "because your session has expired". They also may ask you to complete a customer satisfaction survey (and again ask for your account and password to "complete" the form) or other misleading things like some sort of promotional scheme.

If a "session expiry" window pops up - ignore it and see if the underlying screen is still responsive. If the main screen is still responsive you should immediately close your browser completely. A real session expiry window will freeze the underlying screen until you reply to it.

I generally ignore the satisfaction or promotion windows in any case - and you should too, especially in light of this new attack strategy.

------------

On another note: My son and my nephew have both come to me lately with tales of woe and a computer that pops up browser windows on its own, has locked them out of Windows Update and their anti-virus update, and generally is misbehaving. It also may pop up windows (anti-virus 2009 - which does not exist) telling you that you have a virus and it must scan - will go through a bogus scan and then tell you you need to pay for a remover package.

This is a new threat that goes by a number of names. I found a great tool that eventually managed to get rid of the problem and it was free for the first 30 days. Simply Super Software has Trojan Remover 6.7.5 at http://www.simplysup.com/

I'm recommending that both kids purchase this out of their own pockets. It updated itself daily so the company is actively making it better and it did the trick, finding registry items that were bogus, reinstating access to the AVG update and Windows Update sites and generally getting things back to normal on these Windows XP boxes.

I'll note that it took several re-boots to get the system to the point where the popups stopped - and then it took several passes by the updated anti-virus software to get the actual infected files removed but this is better than re-installing the operating system and all programs from scratch.

Hope the New Year is treating you better than most

richard