52 thoughts on “Be careful — I almost got fooled by malware”

1. My takeaway from this is that I should expect to see a Tabletop Tokaido gag reel shortly.

   1. Yeah, Wil really buried the lead there.

2. But that nice Nigerian Prince is cool…right?

   1. Oh yeah! He’s a stand-up guy. I’m going to retire as soon as the money is wired to my account. I’ve already told my boss to f*** himself. Can’t wait!

      1. Me too! We should fly our private jets and meet up! Any day now…any day…

         1. Well actually I have a deposit down an a nice boat. Only 134′, but it will do for starters. Maybe you can fly to Tahiti for the meet?

3. I’ve been seeing those everywhere the past few weeks now. Links off reputable sites even bring me to it. It’s getting around that’s for sure.

   1. I’ve seen it, too. Argh.

4. snicker “…not everyone…” Heh. Almost no one.

5. “When the son of the deposed king of Nigeria e-mails you directly asking for help, you help!”

6. I hate when I typo a site and get somewhere else. Years ago, I was new at a job and tried going to Barnes And Noble’s website so I typed “BarnesNNoble.com.” Let’s just say that the women on that page were NOT reading books! These being the days before pop-up blockers, the site kept opening up new pages of women-not-reading as I closed each page. I began to worry that my boss would walk in at any moment and see what was on my screen. Luckily, I was able to close one window before the JavaScript loaded and kept more not-reading-women from appearing. It taught me a valuable lesson, though: Always be careful what you type in your browser bar.

   (By the way, don’t bother trying to replicate this. The URL has since been bought by the book store Barnes And Noble so you’ll just be taken to BN’s actual website.)

7. Point of fact: It’s a myth that it’s easier to infect Windows than it is to infect OS X. It’s easier to infect 3rd party applications meant to run on Windows framework than it is to infect OS X – of which there are many, many opportunities, but it is significantly easier to infect the OS X base operating system than it is to do so on Windows.

   Source: I’m one of the world’s foremost experts on network and digital security. No, seriously.

   1. Yeah. On this kind of attack, the malware people weren’t using an exe because Windows are easier to infect, but because it’s more likely that any random victim will be using Windows. If they had made a Mac version of their malware, you’d have been just as infected as on Windows, assuming you don’t notice in time.

      It doesn’t matter what security any OS has when you can convince the user to let you through the front door.

8. DownThemAll! … AllYourBaseAreBelongToUs.

9. Thanks for the warning, Wil.

10. Just saw this on a PC a few days ago. In that case, they were redirected to the malware from a supposed Facebook video posted by a friend. You would think that this would be something that antivirus would block, but apparently not.

11. I have seen that same screen pop up due to ads on safe sites being hacked or encoded differently. It is certainly something to keep an eye out for.

    1. Me too! I’ve gone to legitimate blogs, sites, etc and have seen the above malware page. I clicked it, but stopped once I saw the install screen & the URL.

12. Really? That it was downloading from get.sad234.info wasn’t the red flag to you?

13. My clues that it was hinky were that I haven’t seen anywhere that Adobe gives away “pro” versions, and the address it wanted to download from. But it’s so easy to not notice this stuff. Thanks for the warning.

14. The thing anyone should have picked up on here, is “sad234.info”. In no reality would Adobe, or any other developer, send you to such an obviously unrelated site to download anything of theirs.

15. That’s why I do Linux. I am not going to say that there is no malware, but there is less.

16. I got trapped by the “Update Your Flash” pop up the other day [obvious malware as I had updated Flash the day before directly from Adobe] – it wouldn’t even let me close my browser and I had to use task manager to do it.

17. It’s not just URL typos! I’ve seen this exact thing pop up when served by malicious advertisements – often times when visiting otherwise-legitimate web sites.

18. Even updating legitimate Flash has other crapware with it these days. It says it’s supposed to update automatically so I close the ‘reminder’ popups when they occur.

19. For many, many, many videos you don’t need Flash on Youtube.

    http://youtube.com/html5

20. It’s almost as bad as typing an extra “L” in wilwheaton.net

21. We just got some sort of Russian virus on work main server. Almost wiped us out. Thanks, for the info, Wil! I will add those links you shared to my weapons cache. 😉

22. yotube.com used to do it until recently as well.

23. Fortunately, a nice Nigerian deposed prince warned me about this… 🙂

    More seriously, I’ve had this one pop up a few times. Always clicked away on the desktop and closed it down through windows task manager.

24. I’m usually pretty careful too, but I made an incredibly stupid mistake a few months ago when I meant to install the latest version of Firefox. I went to Google and clicked on the top result. Needless to say, it wasn’t actually the official site and I ended up having to do a system restore. Really kicked myself that time. My new rule: never try and download anything past two in the morning. I’m to sleep to make good decisions.

    1. On Firefox, help/about, if there is an update available there is a button to install it right there. No googling necessary.

25. I thought OpenDNS had typo protection built in? Did they get rid of that?

    1. Answering my own question – it looks like OpenDNS removed typo protection back in the summer. Frownface!

       1. They removed the OpendDNS Guide (no longer needing the ad revenue) making themselves RFC compliant, which also removed the typo correction service as this was just an extension of the guide. Instead they are now blocking known pishing sites, but they still need to become aware of those sites in order to block them.

26. I’ve actually been taken to that by unscrupulous ads on some otherwise reputable sites. It just means that I’ve given in and am using ad blockers now.

27. If you Use Safari or Chrome you can Ignore such things as Phishing. At least on The Mac. On Windows, Using Chrome, you can also ignore such attempts, as Chrome uses it’s own Flash variant.

28. Web of Trust will have given you a stern warning before you got to click on anything on that site…..

29. I work in IT, and I see these kinds of fake updates all the time… it’s really quite sad.

30. Fucking Bono

31. We’re at a low point in the history of computing when you can’t even trust Adobe or Oracle not to install malware along with Reader or Java. And two days ago I downloaded a screen video capture utility to help out a friend and fell for the camouflaged “install something else along with what you wanted” trick. Clicked “Install”, didn’t look directly at the image and was fooled into thinking the click didn’t register. Did one of those things where time goes into slow motion, you tell your body to stop what it’s doing but your mind goes into shock when it realizes it can’t reverse your action in time and watch in horror while something bad happens. In this case, installed a browser hijacker. Normally I don’t use removal utilities and can remove even the worst virus manually in a relatively short time. This time I spent 10 hours and was still stumped. Chrome made it back from zombieland fairly quickly, but IE and Firefox were both still redirected to mystart.vi-view.com (DO NOT CLICK ON THAT OR EVER GO THERE FOLKS!!!!!) on start no matter what I did. Finally resorted to Spybot – Search & Destroy and AdwCleaner and was relieved to have success.
    So yeah, even experts can have a weak, distracted moment and suffer from a moment’s inattention. Never let your guard down, and never download or install anything you don’t know everything about, and NEVER let anybody fool you into thinking your device has already been compromised and you need to install something to fix it. That is ALWAYS a scam.
    While I’m on my soap box, NEVER, EVER use any of those utilities – even from well-known big names – that claim to automatically solve problems or make your device work better in any way. All they are is an extra layer of crap between your hardware and you. If it has to run constantly to “protect” you then it’s sitting there constantly spinning its wheels, hogging resources and creating conflicts. Any claims they make are outright lies. Don’t fall for it.

32. Thank you so much for not taking the cheap shot at the PC v Mac debate people love to fuel. I sincerely appreciate the information as a local computer retail/repair salesperson looking out for my average customer. This is definitely something everyone needs to read, even those who think they’re more savvy with a computer than most.

33. I wonder if this is what my mom is complaining about. I updated her flash from the adobe site last week. After that, a site she visits often told her she needed to update her flash. Now she is complaining that a popup keeps telling her she needs to be signed in as admin to ‘install this program’ every time she turns it on.
    That’s why I set up her computer with a limited account for her to use for the web.

34. If your browser is leting you auto run .exe on download then its not doing its job… as far as I know none of the big 3 let you auto run .exe (or equiv.) on any platform, in fact some stop you from clicking the run button for 3 or so seconds just to make sure you read the box….

    but good catching Wil and thanks for the PSA 🙂

35. Am I just too friday-night-at-work tired to be right or doesn’t youtube default to an HTML5 player rather than flash, pro or otherwise? Either way, it’s well past time for flash to go the way of realplayer and fuck off forever.

36. You missed using K9 Web Protection. It had the mistyped domain blocked and the malware EXE blocked.

37. “To get.sad, click here.” I imagine anyone who agrees to get sad would be sad. I wonder what the success rate is for get.happy234.info vis a vis get.sad234.info . Let’s not find out.

38. hey will Thanks For your Warning Buddyro about malware if you have any advice For me about other things Let me know.

39. Pingback: OTR Links 11/22/2014 | doug — off the record

40. Thanks for the tips, Wil. I didn’t know about WoT or Ghostery. NoScript doesn’t exist for Chrome, but it turns out the same functionality is built into Chrome itself, so I’ve turned that on as well. Feeling ever so slightly safer.

41. First People posting saying that Adobie and Oracle are installing the malware are clueless.. Adobie and Oracle are not installing malware, It’s other people that want to steal your information or use your computer to comit crimes there the ones that are setting fake sites to download the malware …

    Wil, just as an FYI, It’s not the type of OS the user has that makes prevents them from getting malware it’s all on the User becuse i have seen whole Mac OSx systems Having to be compleatly wiped and reloaded.. and i have seen whole Windows systems come in so clean that it looks like it never touched the Internet. the One OS i never see any Malware problems is Linux and most likely its becuse the Linux comunitty is genruly of a smarter more Intelagent and insightfull Bread of people.

    I’m not saying that you’re wrong about the .exe, just to be aware that malware can and will infect any device that has an internet contection and all they have to do is get on facebook or any site that has advertisements.

42. Thank you for sharing about the malware thingy. I am not my wisest when on a computer. It is just a tool for me to play and talk to the people I love, and do not really understand much about the machine except am sure there is a small robot residing somewhere in it’s bowels that likes to give me a raft of shit and drive me crazy. K
    p.s. When is your show coming back on SciFi ? I miss my dose of laughter.

Comments are closed.