Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've had a lot of employees lately come to me with issues on their home PCs where they have had Fake Alert/Rogue viruses. I was planning on sending out a warning to users explaining to them that these are actually viruses. I was also planning on informing them that in order to help prevent occurrences like this they should be sure to have an antivirus w ith an up-to-date subscription. I'd also recommend if they don't have a subscription to download MSE or another free antivirus.

However, I wasn't sure exactly how to instruct them to differentiate between a legitimate windows or antivirus alert and one from a fakealert program. Does anybody have any suggestions?

UPDATE

This is the message I ended up sending. I figured I should probably stay away from even mentioning their personal computers.. mostly to avoid requests to fix them. However, by sending this message, they will at least be slightly more aware of fake alert viruses out there.

Over the last year, there have been an increasing number of computer viruses spreading that actually pretend to be antivirus software. These viruses very closely mimic legitimate windows and mac software, so it can be hard to tell whether or not virus warnings that appear on your screen are legitimate or not.

While we do have virus protection on company computers, it is still possible to get a virus by simply visiting a website… even reputable ones. If you ever have a popup that tells you that you have multiple viruses and that you need to scan your computer immediately (or do anything else), please shutdown your computer by holding down the power button until the screen turns black and contact the IT staff immediately. If you aren’t sure whether a message is genuine or not, please contact us immediately as well.

Below are some images of some of the more popular “fake alert” viruses out there.

My Computer Online Scan

Antivirus 2010

41 Infections Found

Antimalware

Antimalware

share|improve this question
5  
Be careful how much you help your users outside of the office. Just trying to do something nice like this could backfire in a major way. Just wait until everyone now needs your help removing the newly identified virus on their machine. –  DanBig Dec 30 '09 at 21:57
    
If you're going to do something, do something that will really help... half-hearted attempts with no plans may very well end up like Dan hints ^^ Going all-out however might generate large returns. –  Oskar Duveborn Dec 30 '09 at 23:10
    
Good compromise Brett. Well done. +1 for the update. –  John Gardeniers Dec 31 '09 at 21:31
    
Man I'm genuinely impressed by some of those fake alerts. How can the average joe be expected to spot them as a fake!? Also I wish our graphic designers could make stuff that looked that good... –  Mark Henderson Dec 31 '09 at 22:43
    
The one thing that stands out for me is the logo. Notice all but one in the images have the same one. I've also seen it on many other variations. –  John Gardeniers Jan 2 '10 at 4:16

7 Answers 7

up vote 3 down vote accepted

You really can't. Users don't care enough to delve into the topic of viruses, trojans, malware, etc...

The best you can do is have them run an up-to-date AV (AVG, MSE, etc.) along with a couple tools (with updates applied frequently) of anti-malware programs like Spybot Search and Destroy and AdAware.

Warn them also that multiple AV installed don't play nicely.

Last, be careful how far you go in playing sysadmin to home user system. You may end up taking responsibility for their home computer issues, and if you're not making it clear that this isn't pro-bono work you may be held responsible for fixes and updates (and BROKEN SOFTWARE PROBLEMS) that you and your advice may have had absolutely no connection to, but to the users...it's all "computer stuff", they did what you said to do, so it's your fault.

Trying to be the nice guy has backfired on people I know more than once...so be careful to qualify your advice with disclaimers.

I'd otherwise just tell them to keep scanning their system and keep anti-malware up to day, and whenever something pops up (or do it once a week) run the manual checks with spybot/adaware in addition to the on-access antivirus. NO ANTIVIRUS WORKS 100%. They need to know that.

share|improve this answer
    
great-minds eh ;) –  Chopper3 Dec 30 '09 at 21:56
    
Yeah that's the exact reason I've been hesitant. At the same time, some users access company resources from outside the company (chiefly e-mail via OWA). If an attacker captured their login credentials, they might be able to leverage that into something that could potentially affect the company. I think I'll have to preface the email with a disclaimer explaining that we do not fix employees' PCs and have had a lot of requests to do so, However...here is some advice that will probably help prevent (but not guarantee) an infection... but that we can't help or be liable if they still get one.. –  Brett G Dec 30 '09 at 22:07
    
Brett-that's a risk no matter what when you allow outside access in. You can only protect by mitigating risk. AV on mail servers, etc...as for stealing credentials, that's again a risk that comes with access. Many users will give up access to anyone, or a stranger for a chocolate bar (google it). Password cycling/aging will mitigate it to an extent, as will allowing access from particular IP ranges (depending on your circumstances). –  Bart Silverstrim Dec 30 '09 at 23:36
3  
Our practice has always been to warn when there's a popular hoax/myth floating around our userbase (AGAIN), and we'll offer general advice. My boss does consulting work for home users on the side as a business. Otherwise,...don't touch with a ten foot pole. "What computer do you advise we get?" I can say Dell...they get it, have a bad experience, and it's MY fault. I tell them to search google for advice, Amazon, EPinions, etc. for reviews. Send them to test sites. I don't get into it too deep because usually, they are looking for simple answers to complicated questions. –  Bart Silverstrim Dec 30 '09 at 23:40

Harsh answer possibly but I would stay well clear of making any recommendations to your professional users about what they do with their computers or IT at home.

The reason is that people often don't care about work systems but care a hell of a lot about things they've spent their own money on - if they perceive you've somehow given them 'bad information' it will affect their professional opinion of you - yet they won't appreciate it when you do give them good advice.

It's an easy thing to dodge too, just state that the company uses pro-quality software that you wouldn't recommend for home use and that they're better speaking to someone at a consumer IT store for advice.

Like I say, harsh answer but why risk all your good work to give someone free advice they could get elsewhere.

share|improve this answer
    
Part of the problem with this solution is that many users access some (or even all) network resources from home via a VPN. Protecting your users from viruses at home also helps protects the corporate servers/network in these instances. –  Beep beep Dec 31 '09 at 0:56
    
But those VPN-concentrators should be protected by corporate anti-virus measures, doing so shouldn't be an option. So my argument stands. –  Chopper3 Dec 31 '09 at 1:54
1  
If you're not in control over the home system, if you're not providing a corporate system for use at home, etc...you can't control the home system's config, and by trying to force updates/advice/free work, etc., you're opening yourself up to resentment and problems when and if something goes wrong. Protect your own assets. It's the difference between putting padding on the baby and putting padding on everything in the house the baby can bump into instead.It's more work, but you need to put protective padding on everything in the corporate network, not the user's stuff. Not yours, hands off! –  Bart Silverstrim Jan 1 '10 at 14:38

Trend Micro has a pretty good writeup (Trend Micro) as well as the Internet Crime Compaint Center (IC3). This should give you a good start.

However, the problem I have faced with attempting to do exactly what you are is giving enough information to be descriptive without giving so much that people's eyes just glaze over.

With so many possible configurations of AV's and PC's out there, you can never cover all the ways to differentiate between the two types of windows. Do the best you can to make it "human readable" and please post back what you might have decided. It can only help others in your situation.

share|improve this answer

Your greatest asset in fighting malware is your users! They're the weakest link but also the strongest defense - you just need to configure them properly! ^^

Arrange seminars for them, preferably with some skilled speaker who specialises in this area (ok I might have been lucky finding such niched speakers who were also very fun to hear/watch and could step way down to the right level to get normal non-IT people's attention for a half-day)... or hold them yourself.

Go through some basic malware and fake virus warnings and educate the users in how to keep their computers a bit safer. Combine this with a walk-through of the company IT structure and policies to help get funding and also show what a complex thing it is and what can go wrong and why.

Also point out the differences between home computers and the machines on the company network - and how this applies to security (ie security policies must be followed and why but also that a lot of things are handled by IT so the users doesn't have to worry as much at work and of course that you can not be held responsible for their home systems).

Generally educating the users in IT security is to me a pretty basic necessity to help evade malware and discover targeted attacks and attempts at social engineering.

There's a pretty good presentation by Jesper Johansson called Anatomy of a hack 2008 that should give a lot of ideas in this exact regard as it deals with the infamous Antivirus 2008 varieties (or could be used in its own depending on the IT maturity of your users but it's aimed at IT Pros).

Teach them a bit that will be helpful at home as well and they'll most likely stay a bit more alert at work too. Obviously write off any responsibility for their home environment but help them get a clue and they'll help you. Help them identify what could substitute home support for them as well, like how to figure out where to go when in trouble (which shouldn't be "to the company IT staff" ;)

Make it a mandatory and reoccuring "class" to catch new users and remind old ones of the company's IT security policies, general structure, how to file support tickets and this added spice of teaching about malware for both work and home use with the latest updates in the area. I used to do this for a small non-IT company with ~150 users and it was generally well-received for a few years before I moved on. They especially enjoyed getting to ask all sorts of questions about their IT environment at large in a class-room-like set and getting answers on the spot. Oh and never forget the morning coffee.

share|improve this answer

Your best bet is to recommend a specific home antivirus (AVG is my personal preference) then show them screen shots of a valid virus warning (i.e. download a virus from online and do a screen print).

share|improve this answer
1  
Quite the contrary, never recommend any specific software. Doing so will make you liable for any problems stemming from that recommendation, at least in their eyes. Who needs that kind of hassle? –  John Gardeniers Dec 30 '09 at 23:44
1  
I disagree ... it's far more hassle to teach each user how to differentiate between a real virus warning and a internet popup than it is to just recommend software. –  Beep beep Dec 31 '09 at 0:55

As stated by others, I avoid giving direct advice. But you can give general advice yet let someone else do the heavy lifting i.e. redirect staff to magazine or websites articles.

such as this article about fake antivirus at PCWorld. Or this article on security software

You've helped people by giving relevant information but not told them to buy a specific product.

share|improve this answer

On rare occasions, and only when I believe the threat is severe enough to warrant it, I'll issue a warning but will keep it as general as possible. By all means advise the users to have proper AV protection but never make a recommendation. If they ask what to use I'll direct them to Google. If you recommend anything they will hold you responsible for whatever happens. While that carries no weight, none of us need the problems brought about by the animosity this can create. Been there, done that, learned the lesson!

share|improve this answer
    
This is one of those lessons that living once lets you learn a hundred times over! I tend to find that techs/admins who think otherwise tend to have less field experience (or no experience interacting with users directly)...that's just my experience though. –  Bart Silverstrim Jan 1 '10 at 14:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.