Spyware, Viruses, & Security forum

Question

Need help on Fake App Attack notices from Norton AV

by texasmary / September 7, 2012 11:45 AM PDT

I started receiving notices from Norton that they had blocked a Fake App Attack with additional wording, one of which was "Fake Scan Webpage 3". This seemed to be happening about half the time when I went to a particular website (Healthboards.com). I finally went online with a Norton tech who proceeded to completely kill my hard drive. After getting a brand new hard drive and re-installing all my software, including Norton AV, I tried again to go to Healthboards.com and the Norton warning appeared again. The website shuts down after I receive the warning. So what is the deal... is it my computer or the website? I am afraid to use Norton tech support again. Can anybody help?

Answer This Ask For Clarification
Discussion is locked
You are posting a reply to: Need help on Fake App Attack notices from Norton AV
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Need help on Fake App Attack notices from Norton AV
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.

All Answers

Collapse -
Answer
About Fake App Attack - Fake Scan Website 3
by Carol~ Forum moderator / September 7, 2012 1:49 PM PDT

Mary..

Please read how Symantec describes: Fake App Attack: Fake Scan Website 3

It says in part:

This signature is designed to prevent access to sites that redirect users or perform actions to trick users into installing misleading applications such as fake antivirus software.

The creators of misleading applications often use web pages with fake antivirus scanners in order to convince users to download and run an executable file. They may also use intermediate sites that redirect users from the site they are visiting to another one offering misleading applications for download.

Misleading applications such as fake antivirus scanners (Trojan.FakeAV) or bogus disk defragmenters (UltraDefraggerFraud) are designed to mislead users into thinking that their computer has serious problems that must be fixed by paying for a license of the software. For example, a fake antivirus scanner may perform fake scans of the hard disk and then report multiple non-existent threats....


* * * * * * * * * * *

Norton Safe Web gives Healthboards.com a SAFE rating.
http://static-safeweb.norton.com/report/show?url=healthboards.com

* * * * * * * * * * *

So why all the alerts? The site is / was probably compromised in some form or another. Here's a perfect example. A Norton user posted at their community forum, asking how to stop the alerts, when visiting the Irish Times website. S/he contacted the site and received (in part) the following response:

"We have successfully traced the fake anti-virus notice to a third party advertisement which was being intermittently delivered to users of The Irish Times web-site in recent days. As of Monday, this advertisement has been blocked from running on our site, and the third party advertisement agency have been alerted to the problem. Despite our team vetting the advertisement before it was launched on July 13th, the advert was subsequently altered by the third party late last week without our knowledge and began to distribute these false messages regarding viruses. "

I would suggest contacting the site owner, if you frequent it often. I would further suggest scanning with the below (FREE) tools to make sure all is "as it should be".

Malwarebytes' Anti-Malwre
http://www.malwarebytes.org/products/malwarebytes_free/

ESET's Online Scanner - Their FAQ and Help sections should answer any questions you might have. (Temporarily disable Norton prior to running the scan)

Best of luck..
Carol

Collapse -
Already contacted the website
by texasmary / September 7, 2012 2:26 PM PDT

Thank you. I think I have already read all of the info you mentioned above. I have already contacted the admin for the website. That was about 3 weeks ago before my hard disk crashed. I did not receive a reply from the admin. The newest warning just came yesterday. I'm not sure why the website closes down when I receive the warning. It says that it is to protect my computer. Since I get a warning from Norton, I do not get the opportunity to subscribe to something I don't need and that would endanger my computer. What I dislike most is that I can't go to that website when I want. Thanks again.

Collapse -
Safe Surfing needs some tools to stay protected
by mchainmchain / September 7, 2012 9:03 PM PDT

Seems as if it would help to have at least a second opinion here.

The following antimalware sites scan for web exploits, viruses, and rogue apps:

http://www.urlvoid.com/
http://sitecheck.sucuri.net/scanner/
http://zulu.zscaler.com/
http://urlquery.net/

All that needs to be done here is to type in the full address of the site you want to visit (in this case Healthboards.com) to see if indeed there is anything amiss using any of the above url scanner websites. Whether a site you like becomes infected is beyond anyone's control; at least you can scan it to see why.

I scanned with urlquery and it shows some malware running on the site. Your choice to visit despite the deep level flash exploit warnings and malvertisement site warning. Not every web url scanner will catch everything. That is why it is best to use more than one scanner to come to your best decision.

Collapse -
Thanks
by texasmary / September 8, 2012 12:10 AM PDT

Thank you very much! I will try the above. Still thinking on this... If I visit the website and Norton does not give me a warning (it has been happening about 50% of the time), does that mean that the virus slipped through and could have infected my computer?

Collapse -
Hacked Website(s)
by mchainmchain / September 8, 2012 7:11 AM PDT
In reply to: Thanks

--Once a website is hacked, it is under the control of the bad guys. So, malware present can be active for only one to three hours, and then a newer improved version is installed and the malware comes back up.

--(See above) You may have been protected before, but not always at a later visit. The point of hacking is to infect your system and all other systems that visit.

Collapse -
About Fake App Attack - Fake Scan Website 3
by EXPERT1984 / September 16, 2012 9:54 PM PDT
In reply to: Thanks

HI
As you know that computer is already infected avoid taking risk ., you can try doing system restore in safe mode , if it works good for you / IF Not get help from proffesionals as there is chance of loosing data

reply back if it works or if you need any help

Popular Forums
icon
Computer Help 49,613 discussions
icon
Computer Newbies 10,349 discussions
icon
Laptops 19,436 discussions
icon
Security 30,426 discussions
icon
TVs & Home Theaters 20,308 discussions
icon
Windows 10 360 discussions
icon
Phones 15,802 discussions
icon
Windows 7 7,351 discussions
icon
Networking & Wireless 14,641 discussions

CNET's Tech Minute

Top 3 news reading apps

With the latest tech, getting news delivered to your phone is easier than ever. Here's a roundup of apps that are customizable and useful for getting the news.