<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: New York Times pushes Fake AV malvertisement.</title>
	<atom:link href="http://countermeasures.trendmicro.eu/new-york-times-pushes-fake-av-malvertisement/feed/" rel="self" type="application/rss+xml" />
	<link>http://countermeasures.trendmicro.eu/new-york-times-pushes-fake-av-malvertisement/</link>
	<description>Rik Ferguson blogs about current security issues.</description>
	<lastBuildDate>Sat, 13 Mar 2010 14:55:58 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
		<item>
		<title>By: Malvertisements in NYTimes.com Lead to FAKEAV &#8211; Security Threat Research News</title>
		<link>http://countermeasures.trendmicro.eu/new-york-times-pushes-fake-av-malvertisement/comment-page-1/#comment-3997</link>
		<dc:creator>Malvertisements in NYTimes.com Lead to FAKEAV &#8211; Security Threat Research News</dc:creator>
		<pubDate>Mon, 07 Dec 2009 04:42:23 +0000</pubDate>
		<guid isPermaLink="false">http://countermeasures.trendmicro.eu/?p=1309#comment-3997</guid>
		<description>[...] reported in detail by Trend Micro researcher Rik Ferguson in the Counter Measures blog, the New York Times issued warnings through both Twitter and its website&#8217;s front page about [...]</description>
		<content:encoded><![CDATA[<p>[...] reported in detail by Trend Micro researcher Rik Ferguson in the Counter Measures blog, the New York Times issued warnings through both Twitter and its website&#8217;s front page about [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Rogue AV on the rise - /gg FTW!</title>
		<link>http://countermeasures.trendmicro.eu/new-york-times-pushes-fake-av-malvertisement/comment-page-1/#comment-3886</link>
		<dc:creator>Rogue AV on the rise - /gg FTW!</dc:creator>
		<pubDate>Sun, 18 Oct 2009 02:31:39 +0000</pubDate>
		<guid isPermaLink="false">http://countermeasures.trendmicro.eu/?p=1309#comment-3886</guid>
		<description>[...]  [...]</description>
		<content:encoded><![CDATA[<p>[...]  [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Noch ein Grund für Paid Content: Hacker knacken Ad-Server der &#8220;New York Times&#8221; &#124; Basic Thinking Blog</title>
		<link>http://countermeasures.trendmicro.eu/new-york-times-pushes-fake-av-malvertisement/comment-page-1/#comment-3883</link>
		<dc:creator>Noch ein Grund für Paid Content: Hacker knacken Ad-Server der &#8220;New York Times&#8221; &#124; Basic Thinking Blog</dc:creator>
		<pubDate>Fri, 16 Oct 2009 14:51:26 +0000</pubDate>
		<guid isPermaLink="false">http://countermeasures.trendmicro.eu/?p=1309#comment-3883</guid>
		<description>[...] Sicherheitsteam von TrendMicro berichtet, dass die Viren, vor denen gewarnt wurde, reine Erfindungen seien. Noch etwas wurde herausgefunden: Die falschen Virenscanner, die zum Verkauf angeboten [...]</description>
		<content:encoded><![CDATA[<p>[...] Sicherheitsteam von TrendMicro berichtet, dass die Viren, vor denen gewarnt wurde, reine Erfindungen seien. Noch etwas wurde herausgefunden: Die falschen Virenscanner, die zum Verkauf angeboten [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: New York Times pushes Fake AV malvertisement. AV hongkong 香港</title>
		<link>http://countermeasures.trendmicro.eu/new-york-times-pushes-fake-av-malvertisement/comment-page-1/#comment-3785</link>
		<dc:creator>New York Times pushes Fake AV malvertisement. AV hongkong 香港</dc:creator>
		<pubDate>Fri, 25 Sep 2009 18:16:02 +0000</pubDate>
		<guid isPermaLink="false">http://countermeasures.trendmicro.eu/?p=1309#comment-3785</guid>
		<description>[...] here:  New York Times pushes Fake AV malvertisement.          By admin &#124; category: av model &#124; tags: install-the-application, japanese, machine, [...]</description>
		<content:encoded><![CDATA[<p>[...] here:  New York Times pushes Fake AV malvertisement.          By admin | category: av model | tags: install-the-application, japanese, machine, [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Malvertisements in NYTimes.com Lead to FAKEAV - All About Virus</title>
		<link>http://countermeasures.trendmicro.eu/new-york-times-pushes-fake-av-malvertisement/comment-page-1/#comment-3781</link>
		<dc:creator>Malvertisements in NYTimes.com Lead to FAKEAV - All About Virus</dc:creator>
		<pubDate>Thu, 24 Sep 2009 04:40:14 +0000</pubDate>
		<guid isPermaLink="false">http://countermeasures.trendmicro.eu/?p=1309#comment-3781</guid>
		<description>[...] deta&amp;#105l by &amp;#84re&amp;#110d M&amp;#105&amp;#99ro resear&amp;#99her R&amp;#105k Ferguso&amp;#110 &amp;#105&amp;#110 the Counter &amp;#77easures &amp;#98&amp;#108og, &amp;#116he Ne&amp;#119 Yo&amp;#114k T&amp;#105&amp;#109es iss&amp;#117&amp;#101d warnings &amp;#116&amp;#104ro&amp;#117g&amp;#104 [...]</description>
		<content:encoded><![CDATA[<p>[...] deta&amp;#105l by &amp;#84re&amp;#110d M&amp;#105&amp;#99ro resear&amp;#99her R&amp;#105k Ferguso&amp;#110 &amp;#105&amp;#110 the Counter &amp;#77easures &amp;#98&amp;#108og, &amp;#116he Ne&amp;#119 Yo&amp;#114k T&amp;#105&amp;#109es iss&amp;#117&amp;#101d warnings &amp;#116&amp;#104ro&amp;#117g&amp;#104 [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Marlene</title>
		<link>http://countermeasures.trendmicro.eu/new-york-times-pushes-fake-av-malvertisement/comment-page-1/#comment-3749</link>
		<dc:creator>Marlene</dc:creator>
		<pubDate>Sun, 20 Sep 2009 13:35:16 +0000</pubDate>
		<guid isPermaLink="false">http://countermeasures.trendmicro.eu/?p=1309#comment-3749</guid>
		<description>Unbelievable that people believe these ads. They used to pop up all the time on our computers. Everyone here knew they were malware. Why would any company who uses computers in their business click to download these?</description>
		<content:encoded><![CDATA[<p>Unbelievable that people believe these ads. They used to pop up all the time on our computers. Everyone here knew they were malware. Why would any company who uses computers in their business click to download these?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Jason</title>
		<link>http://countermeasures.trendmicro.eu/new-york-times-pushes-fake-av-malvertisement/comment-page-1/#comment-3736</link>
		<dc:creator>Jason</dc:creator>
		<pubDate>Thu, 17 Sep 2009 19:05:02 +0000</pubDate>
		<guid isPermaLink="false">http://countermeasures.trendmicro.eu/?p=1309#comment-3736</guid>
		<description>I recommend the removal of this threat. Instructions for removal can be found here: http://www.helpmyos.com/removal-guides-f41/how-to-remove-personal-antivirus-t1119.htm</description>
		<content:encoded><![CDATA[<p>I recommend the removal of this threat. Instructions for removal can be found here: <a href="http://www.helpmyos.com/removal-guides-f41/how-to-remove-personal-antivirus-t1119.htm" rel="nofollow">http://www.helpmyos.com/removal-guides-f41/how-to-remove-personal-antivirus-t1119.htm</a></p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Anti-Virus &#38; Anti-Malware website. &#187; Malvertisements in NYTimes.com Lead to FAKEAV</title>
		<link>http://countermeasures.trendmicro.eu/new-york-times-pushes-fake-av-malvertisement/comment-page-1/#comment-3731</link>
		<dc:creator>Anti-Virus &#38; Anti-Malware website. &#187; Malvertisements in NYTimes.com Lead to FAKEAV</dc:creator>
		<pubDate>Wed, 16 Sep 2009 21:20:40 +0000</pubDate>
		<guid isPermaLink="false">http://countermeasures.trendmicro.eu/?p=1309#comment-3731</guid>
		<description>[...] reported in detail by Trend Micro researcher Rik Ferguson in the Counter Measures blog, the New York Times issued warnings through both Twitter and its website&#8217;s front page about [...]</description>
		<content:encoded><![CDATA[<p>[...] reported in detail by Trend Micro researcher Rik Ferguson in the Counter Measures blog, the New York Times issued warnings through both Twitter and its website&#8217;s front page about [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: JMan</title>
		<link>http://countermeasures.trendmicro.eu/new-york-times-pushes-fake-av-malvertisement/comment-page-1/#comment-3729</link>
		<dc:creator>JMan</dc:creator>
		<pubDate>Wed, 16 Sep 2009 17:03:21 +0000</pubDate>
		<guid isPermaLink="false">http://countermeasures.trendmicro.eu/?p=1309#comment-3729</guid>
		<description>And as I said above, we should be able to prosecute these folks, not just with &quot;fines,&quot; but with JAIL TIME!</description>
		<content:encoded><![CDATA[<p>And as I said above, we should be able to prosecute these folks, not just with &#8220;fines,&#8221; but with JAIL TIME!</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: JMan</title>
		<link>http://countermeasures.trendmicro.eu/new-york-times-pushes-fake-av-malvertisement/comment-page-1/#comment-3728</link>
		<dc:creator>JMan</dc:creator>
		<pubDate>Wed, 16 Sep 2009 17:01:58 +0000</pubDate>
		<guid isPermaLink="false">http://countermeasures.trendmicro.eu/?p=1309#comment-3728</guid>
		<description>This is ALL OVER THE PLACE - MySpace has been infected with this forever (8+ months) - quite a number of MySpace advertisers either have been subverted, or they are &#039;fakers&#039; posing as valid advertisers. 

Several of us have tried to assist MySpace in eradicating it but, due to MySpace&#039;s very dynamic advertising, it&#039;s difficult to catch all instances - plus the fact that there are various &#039;morphs&#039; of the original &quot;fake scanner virus&quot; (the one shown in 1st screen shot).

As long ago as 8 months, I saw this exact fake scan on several large-name sites - all but Facebook. - I saw it on Yahoo, eBay, NetworkSolutions and MySpace - those are the ones I specifically recall and tried to trace via IE cache, but it&#039;s dicey at times.

And a couple of them are able to download spyware / malware, even to protected systems, because the perpetrators keep changing the code to evade the &#039;real&#039; scanners and anti-malware vendors.

Again, I say PROSECUTE the perpetrators to the fullest extent! Just like &quot;Patient Zero&quot; - in determining the VERY FIRST patient of an oubreak, we need a &quot;Victim Zero&quot; initiative, to find the first happenings of such things like conficker and these fake scanner programs.  Ultimately, for the most part, they eventually can be traced back to their originators, either via &#039;money trail&#039; where someone purchased ADs and then infected those ads, or via diligent tracking back to the source via other hard-core investigative techniques.</description>
		<content:encoded><![CDATA[<p>This is ALL OVER THE PLACE &#8211; MySpace has been infected with this forever (8+ months) &#8211; quite a number of MySpace advertisers either have been subverted, or they are &#8216;fakers&#8217; posing as valid advertisers. </p>
<p>Several of us have tried to assist MySpace in eradicating it but, due to MySpace&#8217;s very dynamic advertising, it&#8217;s difficult to catch all instances &#8211; plus the fact that there are various &#8216;morphs&#8217; of the original &#8220;fake scanner virus&#8221; (the one shown in 1st screen shot).</p>
<p>As long ago as 8 months, I saw this exact fake scan on several large-name sites &#8211; all but Facebook. &#8211; I saw it on Yahoo, eBay, NetworkSolutions and MySpace &#8211; those are the ones I specifically recall and tried to trace via IE cache, but it&#8217;s dicey at times.</p>
<p>And a couple of them are able to download spyware / malware, even to protected systems, because the perpetrators keep changing the code to evade the &#8216;real&#8217; scanners and anti-malware vendors.</p>
<p>Again, I say PROSECUTE the perpetrators to the fullest extent! Just like &#8220;Patient Zero&#8221; &#8211; in determining the VERY FIRST patient of an oubreak, we need a &#8220;Victim Zero&#8221; initiative, to find the first happenings of such things like conficker and these fake scanner programs.  Ultimately, for the most part, they eventually can be traced back to their originators, either via &#8216;money trail&#8217; where someone purchased ADs and then infected those ads, or via diligent tracking back to the source via other hard-core investigative techniques.</p>
]]></content:encoded>
	</item>
</channel>
</rss>
