{"id":695,"date":"2010-04-10T13:35:02","date_gmt":"2010-04-10T04:35:02","guid":{"rendered":"http:\/\/www.joewein.net\/blog\/?p=695"},"modified":"2010-04-12T09:07:45","modified_gmt":"2010-04-12T00:07:45","slug":"vir7remover_2009_b2-exe-defend6-pc-com-scareware","status":"publish","type":"post","link":"https:\/\/joewein.net\/blog\/2010\/04\/10\/vir7remover_2009_b2-exe-defend6-pc-com-scareware\/","title":{"rendered":"Vir7remover_2009_b2.exe \/ defend6-pc.com scareware"},"content":{"rendered":"

While researching some information, I came across a Google hit that looked like what I was looking for, but when I opened the page, none of the text in the preview paragraph was there. Somebody must have fed bogus contents to GoogleBot to attract searches.<\/p>\n

Instead of the expected information I found myself on a scareware site called defend6-pc.com that was then trying to coerce me into downloading and installing their fake security software. A pop-up dialog asked me whether I wanted to scan my computer with their software. It didn’t matter if I clicked OK or Cancel, a download would always start. Only by closing the browser Window could I get rid of their nasty popup dialogs.<\/p>\n

I’m using Mozilla FireFox, which does not offer to run downloaded EXEs directly. I did not click on the downloaded “Vir7remover_2009_b2.exe”, instead I ran it through the VirusTotal.com online malware scanner<\/a> (highly recommended!) and products by four companies diagnosed it as malicious or suspicious:<\/p>\n