📎 AI Summary:
The thread focuses on Microsoft’s warning about a new “rogue” malware (Rogue:MSIL/Zeven) that detects the user’s browser and displays highly realistic fake malware warning pages matching Internet Explorer/Firefox/Chrome, then pressures users to “update” by paying for a fake full version. The main questions revolve around how convincing the impersonation is and how the scam works (including fake update/paid flows and changes to security/privacy settings), with the original poster sharing links and screenshots comparing past and current page designs. Overall sentiment is cautionary and concerned, emphasizing the effectiveness of social engineering and the close look required to spot the fraud.

Adamsappleone

U.S.Navy D.A.V.
Member details
Joined
Aug 2, 2009
Messages
1,642
Thread Author #1
"Microsoft is warning about a new piece of malware, Rogue:MSIL/Zeven, that auto-detects a user's browser and then imitates the relevant malware warning pages from Internet Explorer, Firefox, or Chrome. The fake warning pages are very similar to the real thing; you have to look closely to realize they aren't the real thing. The ploy is a basic social engineering scheme, but in this case the malware authors are relying on the user's trust in their browser, a tactic that hasn't been seen before. Beyond the warning pages, the actual malware looks like the real deal: it allows you to scan files, tells you when you're behind on your updates, and enables you to change your security and privacy settings. Performing a scan results in the product finding malicious files, but of course it cannot delete them unless you update, which requires paying for the full version. Attempting to buy the product will open an HTML window that provides a useless 'Safe Browsing Mode' with high-strength encryption. To top it all off, the rogue antivirus webpage looks awfully similar to the Microsoft Security Essentials webpage; even the awards received by MSE and a link to the Microsoft Malware Protection Center have been copied."

Source and screenshots of what past pages looked like and what they look like now; http://arstechnica.c...arning-page.ars