Perks and paintball: life inside a global cybercrime ring

Groups such as Innovative Marketing build the viruses and collect the money but leave the work of distributing their merchandise to outside hackers. Once infected, the machines become virtually impossible to operate. The scareware also removes legitimate anti-virus software from vendors including Symantec, McAfee and Trend Micro, leaving PCs vulnerable to other attacks.

When victims pay the fee, the virus appears to vanish, but in some cases the machine is then infiltrated by other malicious programs. Hackers often sell the victim’s credit-card credentials to the highest bidder.

You totally missed the virus and now you’re going to charge us $100 to fix it?

Removing scareware is a top revenue generator for Geek Choice, a PC repair company with about two dozen outlets in the US. The outfit charges $100 to $150 to clean infected machines, a service that accounts for about 30% of all calls. Geek Choice CEO Lucas Brunelle said that scareware attacks have picked up over the past few months as the software has become increasingly sophisticated. “There are more advanced strains that are resistant to a lot of antivirus software,” Brunelle said.

Antivirus software makers have also gotten into the lucrative business of cleaning PCs, charging for those services even when their products fall down on the job.

Charlotte Vlastelica, a homemaker in State College, Pennsylvania, was running a version of Symantec’s Norton antivirus software when her PC was attacked by Antispyware 2010. “These pop-ups were constant,” she said. “They were layered one on top of the other. You couldn’t do anything.”

So she called Norton for help and was referred to the company’s technical support division. The fee for removing Antispyware 2010 was $100. A frustrated Vlastelica vented: “You totally missed the virus and now you’re going to charge us $100 to fix it?”

A plague on your PC

“It’s sort of a plague,” said Kent Woerner, a network administrator for a public school district in Beloit, Kansas, some 5,500 miles away from Innovative Marketing’s offices in Kiev. He ran into one of its products, Advanced Cleaner, when a teacher called to report that pornographic photos were popping up on a student’s screen. A message falsely claimed the images were stored on the school’s computer.

“When I have a sixth-grader seeing that kind of garbage, that’s offensive,” said Woerner. He fixed the machine by deleting all data from the hard drive and installing a fresh copy of Windows. All stored data was lost.

Stephen Layton, who knows his way around technology, ended up junking his PC, losing a week’s worth of data that he had yet to back up from his hard drive, after an attack from an Innovative Marketing program dubbed Windows XP Antivirus. The president of a home-based software company in Stevensville, Maryland, Layton says he is unsure how he contracted the malware.

But he was certain of its deleterious effect. “I work eight-to-12 hours a day,” he said. “You lose a week of that and you’re ready to jump off the roof.”

World Wide Web

Layton and Woerner are among more than 1,000 people who complained to the US Federal Trade Commission about Innovative Marketing’s software, prompting an investigation that lasted more than a year and the federal lawsuit that sought to shut them down. To date the Government has only succeeded in retrieving $117,000 by settling its charges against one of the defendants in the suit, James Reno of Ohio, who ran a customer support center in Cincinnati. He could not be reached for comment.

“These guys were the innovators and the biggest players [in scareware] for a long time,” said Arenson, who headed up the FTC’s investigation of Innovative Marketing.

Innovative’s roots date back to 2002, according to an account by one of its top executives, Marc D’Souza from Canada. He described the company’s operations in depth in a 2008 legal dispute in Toronto with its founders, over claims that he embezzled millions of dollars from the firm. The other key executives were a British man and a naturalised US citizen of Indian origin.

According to D’Souza’s account, Innovative Marketing was set up as an internet company whose early products included pirated music, pornography downloads and illicit sales of the impotence drug Viagra. It also sold gray market versions of antivirus software from Symantec and McAfee, but got out of the business in 2003 under pressure from those companies.

It tried building its own antivirus software, dubbed Computershield, but the product didn’t work. That didn’t dissuade the firm from peddling the software amid the hysteria over MyDoom, a parasitic “worm” that attacked millions of PCs in what was then the biggest email virus attack to date. Innovative Marketing aggressively promoted the product over the internet, bringing in monthly profits of more than $1 million, according to D’Souza.

Disclaimer: Some pages on this site may include an affiliate link. This does not effect our editorial in any way.

Todays Highlights
How to See Google Search History
how to download photos from google photos