Need help on Fake App Attack notices from Norton AV

Question

Question

Need help on Fake App Attack notices from Norton AV

by texasmary Sep 7, 2012 11:45AM PDT

I started receiving notices from Norton that they had blocked a Fake App Attack with additional wording, one of which was "Fake Scan Webpage 3". This seemed to be happening about half the time when I went to a particular website (Healthboards.com). I finally went online with a Norton tech who proceeded to completely kill my hard drive. After getting a brand new hard drive and re-installing all my software, including Norton AV, I tried again to go to Healthboards.com and the Norton warning appeared again. The website shuts down after I receive the warning. So what is the deal... is it my computer or the website? I am afraid to use Norton tech support again. Can anybody help?

Discussion is locked

6 Posts

- Collapse + Expand Details

- Collapse -

Already contacted the website

by texasmary Sep 7, 2012 2:26PM PDT

Thank you. I think I have already read all of the info you mentioned above. I have already contacted the admin for the website. That was about 3 weeks ago before my hard disk crashed. I did not receive a reply from the admin. The newest warning just came yesterday. I'm not sure why the website closes down when I receive the warning. It says that it is to protect my computer. Since I get a warning from Norton, I do not get the opportunity to subscribe to something I don't need and that would endanger my computer. What I dislike most is that I can't go to that website when I want. Thanks again.

- Collapse -

Safe Surfing needs some tools to stay protected

by mchainmchain Sep 7, 2012 9:03PM PDT

Seems as if it would help to have at least a second opinion here.

The following antimalware sites scan for web exploits, viruses, and rogue apps:

http://www.urlvoid.com/
http://sitecheck.sucuri.net/scanner/
http://zulu.zscaler.com/
http://urlquery.net/

All that needs to be done here is to type in the full address of the site you want to visit (in this case Healthboards.com) to see if indeed there is anything amiss using any of the above url scanner websites. Whether a site you like becomes infected is beyond anyone's control; at least you can scan it to see why.

I scanned with urlquery and it shows some malware running on the site. Your choice to visit despite the deep level flash exploit warnings and malvertisement site warning. Not every web url scanner will catch everything. That is why it is best to use more than one scanner to come to your best decision.

- Collapse -

Thanks

by texasmary Sep 8, 2012 12:10AM PDT

Thank you very much! I will try the above. Still thinking on this... If I visit the website and Norton does not give me a warning (it has been happening about 50% of the time), does that mean that the virus slipped through and could have infected my computer?

- Collapse -

Hacked Website(s)

by mchainmchain Sep 8, 2012 7:11AM PDT

--Once a website is hacked, it is under the control of the bad guys. So, malware present can be active for only one to three hours, and then a newer improved version is installed and the malware comes back up.

--(See above) You may have been protected before, but not always at a later visit. The point of hacking is to infect your system and all other systems that visit.

- Collapse -

About Fake App Attack - Fake Scan Website 3

by EXPERT1984 Sep 16, 2012 9:54PM PDT

HI
As you know that computer is already infected avoid taking risk ., you can try doing system restore in safe mode , if it works good for you / IF Not get help from proffesionals as there is chance of loosing data

reply back if it works or if you need any help

Back to Spyware, Viruses, & Security forum

Carol~ · Answer 1 · Sep 7, 2012 1:49PM PDT

- Collapse -

Answer

About Fake App Attack - Fake Scan Website 3

by Carol~ Sep 7, 2012 1:49PM PDT

Mary..

Please read how Symantec describes: Fake App Attack: Fake Scan Website 3

It says in part:

This signature is designed to prevent access to sites that redirect users or perform actions to trick users into installing misleading applications such as fake antivirus software.

The creators of misleading applications often use web pages with fake antivirus scanners in order to convince users to download and run an executable file. They may also use intermediate sites that redirect users from the site they are visiting to another one offering misleading applications for download.

Misleading applications such as fake antivirus scanners (Trojan.FakeAV) or bogus disk defragmenters (UltraDefraggerFraud) are designed to mislead users into thinking that their computer has serious problems that must be fixed by paying for a license of the software. For example, a fake antivirus scanner may perform fake scans of the hard disk and then report multiple non-existent threats....

* * * * * * * * * * *

Norton Safe Web gives Healthboards.com a SAFE rating.
http://static-safeweb.norton.com/report/show?url=healthboards.com

* * * * * * * * * * *

So why all the alerts? The site is / was probably compromised in some form or another. Here's a perfect example. A Norton user posted at their community forum, asking how to stop the alerts, when visiting the Irish Times website. S/he contacted the site and received (in part) the following response:

"We have successfully traced the fake anti-virus notice to a third party advertisement which was being intermittently delivered to users of The Irish Times web-site in recent days. As of Monday, this advertisement has been blocked from running on our site, and the third party advertisement agency have been alerted to the problem. Despite our team vetting the advertisement before it was launched on July 13th, the advert was subsequently altered by the third party late last week without our knowledge and began to distribute these false messages regarding viruses. "

I would suggest contacting the site owner, if you frequent it often. I would further suggest scanning with the below (FREE) tools to make sure all is "as it should be".

Malwarebytes' Anti-Malwre
http://www.malwarebytes.org/products/malwarebytes_free/

ESET's Online Scanner - Their FAQ and Help sections should answer any questions you might have. (Temporarily disable Norton prior to running the scan)

Best of luck..
Carol

Need help on Fake App Attack notices from Norton AV

CNET Forums

Other Forums

Forum Info