Scareware pops-up at FoxNews

Scareware pops-up at FoxNews

Summary: There have been numerous reports from affected users that a scareware variant of PersonalAntivirus and ExtraAntivirus has been poping-up at during the last couple of days, through a malvertising campaign.

TOPICS: Security, Browser

There have been numerous reports from affected users that a scareware variant of PersonalAntivirus and ExtraAntivirus has been poping-up at during the last couple of days, through a malvertising campaign.

This most recent case of malvertising (MSN Norway serving Flash exploits through malvertising; Fake Antivirus XP pops-up at once demonstrates that whenever a direct access to a high-trafficked site cannot be obtained through a compromise, cybercriminals are logically exploiting third-party content/ad networks to achieve their goals.

Reproducing malvertising campaigns is tricky due to the geolocated nature in which the ads are served, as well as the cybercriminals' awareness on the fact that the amount of traffic which they expose to scareware is logically increasing the risk of having their campaign exposed. A risk which they hedge by temporarily inactivating the campaign or basically rotating the geolocation preferences and displaying the malicious ads to random countries.

Interestingly, in's case Google's Safe Browsing diagnostic page is stating that "Malicious software is hosted on 3 domain(s), including,," with part of DoubleClick's network, with another interesting note stating that "Yes, this site has hosted malicious software over the past 90 days. It infected 18 domain(s)", confirmed by another report as well. These isolated incidents in the sense that the campaign's lifecycle is shortened based on collective reporting of affected users, are also taking place at other ad networks such as ContextWeb, and

Here's a brief analysis of the campaign which now appears to have been removed by FoxNews. Until the next time. According to SandShark, the warning issued by Google's Safe Browsing was in respect to the a domain redirector rd-point .net which is still active and is redirecting to the rogue ExtraAntivirus (extrantivirus .com) followed by previous known redirectors to another scareware RapidAntivirus.

It's worth pointing out that a scareware pop-up at a high-trafficked web site that is basically relying on the social engineering factor, is not as ugly as the introduction of a hybrid scareware demanding ransom for the decryption of files, or client-side exploits. With the list of the major web properties that have been historically affected by much more malicious malvertising incidents (e.g. MySpace, Excite, Expedia, Rhapsody) continuously expanding, maintaining a decent situational awareness next to a client-side vulnerabilities free host, mitigates a great percentage of the currently active threats.

Who's to blame anyway - the advertising networks for working with phony content publishers, the affected web sites for not policing themselves, or the web site visitor for the lack of situational awareness on emerging threats/scams like scareware?


Topics: Security, Browser

Dancho Danchev

About Dancho Danchev

Dancho Danchev is an independent security consultant and cyber threats analyst, with extensive experience in open source intelligence gathering, malware and cybercrime incident response.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
  • Fox News IS scareware.(nt)

    • Plus 1 Zillion (nt)

    • Fox News is the BEST!

      I guess to a liberal who can't stand to hear common sense or differing opinions, it might be scary, but for most of us Americans they actually make sense. It helps that they aren't controlled by the liberal elites. :-)
      • For God's sake...

        ...give the political BS a rest...WILL YOU?
        • Why didn't you make that charge against the OP?

          The only reason someone goes after fox news is because of their political
          ideology. Everyone knows it.
          • Fox Snus

            The only reason Fox Snus goes after someone is because of their political ideology. Tea-baggers prefer their views to be wintergreen-tinged and neatly contained because they can't cope with the gritty Copenhagen buzz of the real world.
            Dave S2
          • No

            It is because most of their user probably use AOL and are not smart enough to find their news on legit sites.
          • malfox

            Of course that's the reason and Hannity and Beck and on and on. Hope this keeps on happening until they have to shut site down. Pity this can't be done to the network.
          • Why should they be shut down?

            Can we shut down some libtard sites as well?

            No sense in being one-sided about it...
            hasta la Vista, bah-bie
          • Political ideology, no.

            It's because they scaremonger and lie. Like Neil Cavuto claiming that Fox had covered the Million Man March....they weren't even broadcasting till almost a whole year later. You can go to and find a lot more lies.
          • Denial is a powerful thing

            No doubt... ;)
            hasta la Vista, bah-bie
      • Yep...the best FUD channel on TV.

        Now aren't you supposed to be out getting tea bagged today like a good Faux News zombie?

        I mean you're taxes have been lowered and you tea bagee's can't stand for that. :-)
      • Fox news the best???

        Well lets see their average viewer is uneducated, and quasi-religious. They believe in the Death penalty but appose abortion because only God can choose if someone lives or dies. They listen to Bill O'Reilly like he is Edward R. Murrow. Before Fox hired that weasel he was doing Hardcopy? As for Glen Beck he is loosing his mind and is in serious need of a single malt scotch. They don't report the news they slant it to meet the needs of pinheads, I.e. nitwits.
        Oh yeah you lost the Election and now the scary black man has the codes to the BOMB.
        FOX Noise we act like we think so you don't have to!!!!
        • R U kidding?

          Hey bluebuddha - let's see. First you have to insult the intelligence of anyone watching something different than you - that alone says it all. Then you claim the death penalty is in the same category as abortion. Well, the folks who make choices to harm others have done just that - made a choice. Can the unborn make a choice regarding their fate? No, and this discredits the rest of your rant.

          When it comes to abortion, the reason I believe it is wrong is because the woman,IN MOST CASES, already made her choice by engaging in sex. Cases of incest and rape need to be separated out because the choice wasn't given to them. But as for those that want to erase a mistake, they should have no standing. Learn from your mistake and change your habits. That's called growing up.

          As far as the election goes, only time will show that America lost the election, not any one group. The man is scary, not because he's black(which he isn't, technically), but because he wants to ignore history and make mistakes that have been made before and haven't worked ANYWHERE they have been tried.

          If he truly believed the rhetoric he spews, why doesn't he spread the wealth beginning with his income? They spoke of taxing ceos at 100% of anything over $500,000. If they applied that to his situation, he had to give up 1.3 million he kept after he paid his taxes.

          You wanted change - you got it, but you just don't quite understand what it means. So who is uneducated? The American people as a whole, because they continue to fall for promises that just don't have our best interests at heart. They want total control of everything.

          Have a great day.
        • It's iteresting what the demographics say...

          Interestingly, I was, just a couple hours ago, looking at the network stats of Fox News for an ad placement.

          The actual Fox viewer (according to Nielson), is college educated, a majority earn over $60,000 per year, and over 1/3 are top management or business executives. Many more than that own their own businesses.

          Funny, I wouldn't call someone who is successfully running their own business stupid or out-of-touch.

          Anyway - how did an article on malvertisement turn into a mud brawl about Fox's politics? This is as bad as the cage fight over Apple vs. Microsoft. Let's grow up, guys. We are (most of us) adults here!
      • Re; Fox News is the BEST!

        Most people here in Europe sees "Fox News" as either just one big joke, or they think it is meant to be satire, which is what it LOOKS like.
      • Liberal elites??

        No such thing..conservative elites now that's another story. Like Bush, Cheney, Murdoch. With Rupert Murdoch owning Fox Broadcasting Company and 35 local TV stations, 16 cable channels (including Fox News Channel), as well as MySpace and HarperCollins publishing. Murdoch's media holdings are inescapable, and he's even bought more lately.

        Also, remember the run up to the war in Iraq? Every major TV network was kissing Bush's butt. No one ever questioned him or said anything against him on TV. And you call that liberal? Whoo wee! Are you brainwashed! Faux is at it again and you're believing it. Most important thing about watching network news is listening with a critical ear to everything no matter what the source. You just gobble it up and swallow because they're saying what you want to hear. I'll bet you believed McCain when he said, "The fundamentals of our economy are strong". Then we had the crash and you still voted for him. What? You think you're gonna be rich someday? One of the 1%ers? Don't want to give up all that money. Meanwhile, you're scrabbling just to make it and sucking up to the real elite, the conservative elite that has you eating out of their hand like a puppy dog.
    • You beat me to it! 2nded! nt

    • LMAO

      The one and only, Cylon Centurion
    • What's wrong with Faux News?

      Don't like the Comedy Channel having competition?
      Dr. John