Feeds

Washington and Microsoft declare war on scareware

One down, but how many more to go?

Securing Web Applications Made Simple and Scalable

Washington state's top law enforcement official has filed suit against a man accused of bombarding end users with misleading messages designed to trick them into buying software to fix PC problems that don't exist.

The complaint, filed in Washington state court by Attorney General Rob McKenna's office, names James Reed McCreary IV of The Woodlands, Texas, and two of his companies, Branch Software and Alpha Red. They stand accused of pushing a software package called Registry Cleaner XP by sending end users messages falsely claiming their PCs have corrupted or damaged registry settings that must be repaired immediately. The software sells for $40.

In many cases, the warnings are delivered using Windows Messenger Service, a network administration utility for delivering system-wide messages to end users. The popup windows claim to be generated by the "Local System" and warn of a "critical error" related to the end user's registry. The messages were directed to a wide swath of internet protocol addresses, and in many cases were sent over and over, causing hundreds of windows to open that the user has to close individually.

The prevalence of so-called scareware has reached epidemic proportions. Programs frequently mimic real security features within the Windows operating system to fool people into believing their PC has been infected with malware. In many cases, it's just about impossible to remove the software once it's been installed.

"Through alarmist language seemingly delivered by a trusted source, defendants misrepresent the extent to which installing the software is necessary for repair of the computer for proper operation," the complaint argues. The error messages, which appear on machines free of any problems, "induces the consumers to purchase defendants' product, which must be used in order to 'repair' the 'errors.'"

Attempts to reach McCreary, Branch Software and Alpha Red were unsuccessful. A number listed as belonging to McCreary had been disconnected. No one answered a phone listed in this whois listing as belonging to Branch Software.

Microsoft referred the case to McKenna's office and has been helpful in assisting the AG's consumer protection high-tech unit to enforce laws against scareware mongers. Over the past three years, Microsoft has brought 17 lawsuits under Washington's Computer Spyware Act and the state's attorney general has filed seven.

Yes, the enforcement actions are a step in the right direction, but we question the efficacy of this finger-in-the-dike approach. Despite filing a raft of suits they find themselves back in court again. And at time of writing, registrycleanerxp.com continued to offer free registry scans. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.