well this is an elaborate scam

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Thu Jul 22, 2010 9:44 am

i saw a commercial on Comedy Central for "maxmyspeed.com" which advertises services performed by technicians remotely, complete with actors who say OMG MY COMPUTER IS 200% FASTAR!!111

i made a fresh install of XP pro on a virtual machine, went to the website, and downloaded their FREE DIAGNOSIS tool (CyberDefender, which is probably the funniest "optimization tool" i've ever seen)....

attached is a screenshot of its findings. keep in mind this is a BRAND NEW INSTALL without so much as virtualbox guest additions installed. clicking 'fix' redirects the browser to a BUY NOW page.

anyone else lol?

edit:

i'ma run a few applications and see how much of a performance hit i take by not buying their software.

cyberdefender is made by a company [network dynamics] which makes and distributes known malware (spybloc)

don't fall prey yourself or let someone you know fall prey to this scam.

i don't understand why tv networks don't do any screening before they let people run ads.

Posted: Thu Jul 22, 2010 9:57 am

update (sorry for the double post):

the VM now locks up on shutdown and boots way slower, compared to how it did before i installed the 'diagnostic utility'.

these people should be ashamed.

the "trial version" of cyberdefender starts with XP (even though it isn't the 'purchased' version of their crap and does nothing but diagnose problems, i.e. has no reason to start before other apps)

the site it redirects to when you click purchase attempts to install an activex control.

when trying to close the app or the popups it opens, it produces the standard malware-type javascript response -- "ARE YOU SURE YOU WANT TO LEAVE? SPECIAL OFFER!"... etc... screenshot:

I'm going to write a letter to my TV provider once i've gathered some more evidence and ask them to pull the commercial. I'm considering contacting their registrar (GoDaddy) as well. Perhaps Igor

Quote:

Administrative Contact:
Barash, Igor [email protected]
Cyberdefender Corporation
617 W. 7th St
Suite 401
Los Angeles, California 90017
United States
+1.2136898631 Fax --

Technical Contact:
Barash, Igor [email protected]
Cyberdefender Corporation
617 W. 7th St
Suite 401
Los Angeles, California 90017
United States
+1.2136898631 Fax --

will find a real job.

Posted: Thu Jul 22, 2010 4:50 pm

Please try and contact Better Business or similar consumer protection outlets to let them know about this as well. If you are in the US maybe even the Consumer Protection Agency? Good find! I will warn all I know (there's a few "computer unsavvy" I know Smile

.

On a side note, maybe, just maybe...never mind ITP.

Posted: Thu Jul 22, 2010 6:02 pm

*bangs head against desk* GOD am i fucking tired of the 'backspace' key being a 'back' button. who the hell doesn't have arrow keys in this day and age? i just spent forever filling out a form and typing up a report to the FTC only to have it fucking lost when I hit backspace ><

i'll do it later.

T___T

BRUTALITY!

Posted: Thu Jul 22, 2010 6:14 pm

Good try! Now when you are all done clicking the boxes.... Laughing

Gov't forms do suck, I completely understand!

Posted: Thu Jul 22, 2010 7:01 pm

Update:

Randomly deleting a bunch of crap from the registry has droped my errors to 0!!! I amaze myself.

Baiting Guru Joined: 31 Jan 2007 Posts: 12237

Elaborate scam? No, it is a common Windows based scareware tactic.

Posted: Thu Jul 22, 2010 9:32 pm

<strike>I've</strike> My computer's been infected with those several times.

Baiting Guru Joined: 31 Jan 2007 Posts: 12237

With that .exe, what could go wrong?

Posted: Thu Jul 22, 2010 9:42 pm

@Frank - actually it IS an elaborate scam, since they have 800 numbers and a (pretty well filmed and edited) TV commercial that airs on several networks through Verizon.

that sounds pretty elaborate, since you don't see any 419ers using tv commercials. or maybe i just missed the airtime.

Baiting Guru Joined: 31 Jan 2007 Posts: 12237

Well, it's nothing we deal with here. IE in a VM? What the hell, it's fun to play with.

Posted: Thu Jul 22, 2010 9:48 pm

that's why i posted it in GENERAL CHAT Razz

i was under the impression that anything non-obscene could go in general chat. guess i was wrong.

anyhow, i was running it in a VM on my Hackint0$h to avoid getting their malware crap installed on my windows PC while gathering proof to report them to the proper agencies (since advertising on TV would probably attract more official attention than internet 'marketing', since it reaches a wider and less savvy audience. just thought i'd share a warning and some info. guess i'll keep it to myself from now on.

Confused

Baiting Guru Joined: 31 Jan 2007 Posts: 12237

Yes, you can post damn near anything here in General. That scareware shit is prolific, and those that click on it need some basic computing classes.

@puckettgw, I wasn't trying to flame you, it is a good warning for all.

Posted: Thu Jul 22, 2010 10:01 pm

i'd have to agree with you there, but would argue that having a commercial on several TV channels through a major provider would afford them some 'credibility' with more gullible people.

interesting development: after going through the VM's registry and randomly deleting entries without so much as looking at the screen (literally, i was talking to a friend of mine next to me while hitting Delete and Enter) the "errors" have magically disappeared! xD

@frank: it's cool. i'm too used to 4chan. Razz

sorry to snap at you.

Baiting Guru Joined: 31 Jan 2007 Posts: 12237

@puckettgw

No worries, I'm too old for 4chan and that's not the way we play here.

Posted: Fri Jul 23, 2010 6:19 pm

I have to admit that Virtual Machine is the most fun tool I've gotten to play with all year!

Posted: Fri Jul 23, 2010 8:02 pm

I do computer repair on the side, most if not almost all of my business is going to people homes and removing all of the "Crap" that these people download to "Speed Up" or "Clean Up" their systems. If people would just go to the fucking Microsoft website and read it, it tells you exactly how to maintain a windows pc to run at peak efficiency (LMAO) sorry the words peak efficiency and Microsoft in the same sentence was funny.

I once had a lady that had literally spent over $1000.00 on these bullshit programs and all it did was make her computer a brick, and she had a top of the line HP like $2800.00 system... It took me four days to get it all out and some of it fought back !!!!

Posted: Fri Jul 23, 2010 9:48 pm

hahaha oh man Tommy.. i had a lady (i do the same thing) who had some expensive gateway (complete with plastic intake box over CPU fan!!!) with a bunch of scareware and crap on it.. one of them was a rootkit... i had to use linux to tar up her files and then low-level the drive 'cause it was in the boot sector.

well, after i reset the SATA controller that her single hard drive was connected to from RAID to IDE. Gateway sure has some funny ways of setting their BIOS. if they even set it at all.

all in all, scareware p's me tfo!

@ chrysis -- hold on, i'ma let you finish, but Sun definitely has the best VM solution of all time!

Posted: Fri Jul 23, 2010 9:51 pm

^^^

Posted: Fri Jul 23, 2010 10:02 pm

puckettgw wrote:

@ chrysis -- hold on, i'ma let you finish, but Sun definitely has the best VM solution of all time!

I'll let you finish as well, but Virtu--ahh, wait, that is the Sun one. Bah.

Bochs has the slowest VM solution of all time! OF ALL TIME! Very Happy

... anyway. I've seen those too, and they really bother me. If you manage to get one of those commercials pulled I'll make you a custom icon myself and award it to you. Never occurred to me to try it.

About the backspace key: If you're on Firefox, open about:config, search for browser.backspace_action, and set it to 2.

Posted: Fri Jul 23, 2010 10:06 pm

Foo --- I love you Very Happy

I knew there was a way to change that from within Firefox :]

sidenote: tryin' to get the commercial pulled is rough... Verizon apparently doesn't give two shits about anything but commercial revenue.

double sidenote: wow, i just looked at the Bochs website. at least they're trying. :]

Posted: Sat Jul 24, 2010 6:29 am

^^ Bochs really has different goals in mind and does its virtualization with a completely different technique that's host-independent but slower. I wouldn't say it's better or worse, just useful for different things.

Posted: Sat Jul 24, 2010 6:41 am

you're pwobabwy white...

.. i'll stick with my virtualbox though Very Happy

Posted: Sat Jul 24, 2010 9:09 pm

After reporting the domain to GoDaddy, they told me that

Quote:

Dear Sir or Madam,

Thank you for contacting the GoDaddy.com Spam and Abuse Department.

We are not the hosting provider for this site. We are the domain name registrar only. We have neither access to, nor jurisdiction over the content on this site.

The web hosting provider for this website is the company responsible for policing any content that appears on this site. You can discover the identity of the hosting provider by performing a "WhoIS" lookup on the domain name in question. The results of your search will reveal both the domain name registrar and the name servers for the domain name. A "WhoIS" search on these name servers will reveal the web hosting provider where the domain name's website resides. Please submit your complaint to this company based on their AUP.

Which is bullshit, since a whois reveals their nameservers to be ns31.domaincontrol.com ... which according to some other research .. aka the "dig" command ..(since the nameserver isn't listed in the whois database) belongs to GoDaddy.
Grr.

Quote:

;; ANSWER SECTION:
ns31.domaincontrol.com. 2771 IN A 216.69.185.16

;; Query time: 19 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Sat Jul 24 14:08:21 2010
;; MSG SIZE rcvd: 56

georges-imac:~ george$ whois 216.69.185.16
#
# Query terms are ambiguous. The query is assumed to be:
# "n 216.69.185.16"
#
# Use "?" to get help.
#

#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=216.69.185.16?showDetails=true&showARIN=false
#

NetRange: 216.69.128.0 - 216.69.191.255
CIDR: 216.69.128.0/18
OriginAS:
NetName: GO-DADDY-SOFTWARE-INC
NetHandle: NET-216-69-128-0-1
Parent: NET-216-0-0-0-0
NetType: Direct Allocation
NameServer: CNS1.SECURESERVER.NET
NameServer: CNS2.SECURESERVER.NET
NameServer: CNS3.SECURESERVER.NET
RegDate: 2004-05-24
Updated: 2007-06-14
Ref: http://whois.arin.net/rest/net/NET-216-69-128-0-1

OrgName: GoDaddy.com, Inc.
OrgId: GODAD
Address: 14455 N Hayden Road
Address: Suite 226
City: Scottsdale
StateProv: AZ
PostalCode: 85260
Country: US
RegDate: 2007-06-01
Updated: 2009-09-16
Comment: Please send abuse complaints to [email protected]
Ref: http://whois.arin.net/rest/org/GODAD

OrgAbuseHandle: ABUSE51-ARIN
OrgAbuseName: Abuse Department
OrgAbusePhone: +1-480-624-2505
OrgAbuseEmail: [email protected]
OrgAbuseRef: http://whois.arin.net/rest/poc/ABUSE51-ARIN

OrgTechHandle: NOC124-ARIN
OrgTechName: Network Operations Center
OrgTechPhone: +1-480-505-8809
OrgTechEmail: [email protected]
OrgTechRef: http://whois.arin.net/rest/poc/NOC124-ARIN

OrgNOCHandle: NOC124-ARIN
OrgNOCName: Network Operations Center
OrgNOCPhone: +1-480-505-8809
OrgNOCEmail: [email protected]
OrgNOCRef: http://whois.arin.net/rest/poc/NOC124-ARIN

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#

Posted: Sat Jul 24, 2010 11:33 pm

I love going to sites such as that and they *scan* my Mac and tell me I have Windows problems.

I read somewhere a while ago that you're basically watching a movie. You click and they basically show looped stuff. I find it hilarious when they tell my directory is corrupt yet the Mac doesn't even have such a directory.

My brother (God rest his deceased soul) used to fall for that stuff all the time. And he spent more time reformatting his computer. Of course, the porn sites he loved didn't help Sad

well this is an elaborate scam	View next topic View previous topic