Tech support scammers use fake Norton scans to dump unwanted applications

guest · Feb 7, 2019

Tech support scammers use fake Norton scans to dump unwanted applications
February 7, 2019
https://cyware.com/news/tech-suppor...-scans-to-dump-unwanted-applications-c8ce20ac

Scammers are increasingly becoming creative with their methods. This time, they have relied on bogus antivirus scans to trick users into installing potentially unwanted applications (PUAs) on their systems.

According to security firm Symantec Corporation, a fake Windows alert is first displayed on targeted systems, which urges users to perform a ‘quick scan’. After users click on OK, scammers diligently display an antivirus scan that closely resembles Norton Security’s antivirus scan.
Scam Uses HTML and JavaScript
Symantec highlighted the source code in its blog on the scam campaign. It appears that scammers used HTML and JavaScript code for the purpose of creating the fake Norton scan.

“The scammer cleverly makes use of the setTimeout() function to change values over a period of time, giving the victim the illusion that an actual scan is in progress and that their files are being scanned,” indicates the blog.
Click to expand...

ProTruckDriver · Feb 7, 2019

The scammer are defiantly getting clever now a days. Feel sorry for the people that are not computer savvy.

itman · Feb 7, 2019

What the article doesn't mention is if this is occurring on devices with Norton installed. If so, this would indeed be problematic for the average and even more advanced PC users.

itman · Feb 7, 2019

Symantec's recommendations:

How to stay safe

Know what’s real from fake. Even though the “Norton” scan looks almost indistinguishable from the real one, there are many attributes that easily indicate it is fake:

The files on a computer system cannot be scanned by a website running inside a web browser. Thus, any website pretending to scan your system is performing a fake scan.

Updates to the Norton security product are attempted through the product GUI and do not require manual user interaction, such as the download of any additional components via the browser.

The scam has hardcoded attributes, such as “30 days of subscription remaining”, which vary from user to user.

Click to expand...

Whereas most Wilders users know the above, I would say many average PC users would be clueless about the same.

Minimalist · Feb 7, 2019

itman said: ↑

Symantec's recommendations:

Whereas most Wilders users know the above, I would say many average PC users would be clueless about the same.
Click to expand...

Yes, I agree. If regular users are asked they would probably know non of those attributes.

Floyd 57 · Feb 7, 2019

setTimeout()

Krusty · Feb 7, 2019

itman said: ↑

What the article doesn't mention is if this is occurring on devices with Norton installed. If so, this would indeed be problematic for the average and even more advanced PC users.
Click to expand...

Yes, I'm almost sure I have seen posts about this on the Norton forums. I'll try to find link/s later.

Maybe @bjm_ remembers seeing them?

Edit: Or my memory is playing tricks on me. I can't find any recent posts about this issue on the Norton forums.

Log in or Sign up

Tech support scammers use fake Norton scans to dump unwanted applications

guest Guest

ProTruckDriver Registered Member

itman Registered Member

itman Registered Member

Minimalist Registered Member

Floyd 57 Registered Member

Krusty Registered Member

Log in or Sign up

Tech support scammers use fake Norton scans to dump unwanted applications

guest Guest

ProTruckDriver Registered Member

itman Registered Member

itman Registered Member

Minimalist Registered Member

Floyd 57 Registered Member

Krusty Registered Member

Useful Searches