About Malware: Your System

" + htmlEscape(Expected) + "

" + htmlEscape(ifrmhtml) + "

• Common ad blockers, which help prevent your browser from becoming infected with malware. (Test #2 does not test for every possible ad blocker system. Some users may have ad blockers that are not detected.)
• Insecure browser plugins, like Adobe's Flash, Microsoft's Silverlight, and Java, that are often used by malware to infect systems. These plugins should be disabled or set as click-to-play; they should not autorun. (Test #2 does not check if the plugin is configured for autorun; it only tests if the plugin exists.)
• Altered content, such as unexpected links or JavaScript, can indicate hostile software on your computer or network hijacking.

• Detecting nothing on this server does not mean that your system is free of malware; it only means that we did not detect anything. You should still use an anti-virus system and good online habits to prevent a malware infection.
• The 色色FotoForensics staff cannot provide assistance with mitigating any detected problems. You should contact your system administrator or a company that specializes in malware removal. 色色FotoForensics does not specialize in malware removal.

Understanding Malware

What is Malware?

• Virus: A computer virus is a piece of code that, when loaded onto your computer, replicates and attaches itself to other files. If an infected file is transferred to another vulnerabile computer, then that computer also becomes infected.
• Worm: A worm is similar to a virus, except that it has the ability to spread all by itself. If two computers are connected over a network, then a worm could potentially spread between the computers over the network connection.
• Trojan: Like the fabled Trojan Horse, a trojan is a program that appears to do one thing but actually does something else. For example, a trojan malware acting as a computer game would appear as a game but would also infect your computer with non-game software.

• Adware: This type of payload attempts to show advertisements to the user. The person responsible for the malware may gain revenue from sales, or from click-through counters. Clicking on an ad, hovering the mouse over an ad, closing the ad, or displaying the ad to the user could generate money for the ad provider. Some adware floods the user's screen with popups or highlights random words on web pages for the purpose of generating more advertising revenue.

FTC vs Innovative Marketing Inc.

In 2008, the Federal Trade Commission (FTC) accused Kristy Ross and her company, Innovative Marketing, Inc. of deceptive marketing. The FTC found that Ross's internet business used a scareware advertising scheme that claimed to scan the victim's computer and identify risks, such as finding viruses, spyware and "illegal" pornography. They then offered to sell a security solution that they claimed would fix these problems.

During the investigation, the FTC found that the software never performed a scan and never found any actual malware. The FTC took Ross and her company to court and, in 2012, received a $163 million dollar judgement against Ross. In 2014, the Appeals Court upheld the ruling against the scareware company.
• Spyware: This type of malware watches what you do and reports it to someone else; it spies on you. Spyware often works with adware, reporting your activities and interests to advertisers so they can better target you with even more advertisements.
• Ransomware: Ransomware alters your computer system in order to limit the functionality. For example, it may encrypt your personal files or change your passwords. The criminal typically offers a method for payment; if you pay the ransom then they will remove the limitations. Of course, some criminals just take the payment and leave your computer system in an unusable state...
• Scareware: Scareware claims to be legitimate software but really tries to scare the user into performing an action. For example, scareware may pretend to check your computer for problems, but always reports problems -- even if there are actually no problems with your computer. The scareware author hopes that fear will cause you to buy some software to resolve the fictional problem.

What is Network Hijacking?

What is Malvertising?

Heated Debates

Differing Opinions

• Consumers: There are many ad blockers available as plugins for web browsers. By blocking and disabling ads, these add-ons speed up web site loading, lower bandwidth requirements, limit personal data collection, and stop malvertisements.
• Web sites: Advertisements provide significant revenue, and ad blockers reduce this revenue stream. Some companies that are dependent on ad revenue have taken steps to work around ad blockers, either by restricting content or bypassing blockers.
• Advertisers: Ads only generate revenue if they are seen by users. If advertisers cannot raise enough visibility by passively placing ads on web sites, then they will employ more active roles through malvertising and adware. Because consumer profiles have value, some advertisers resort to spyware as an additional means to collect information about users.

Home Page For The World's Business Leaders

Forbes is a large, respected news outlet. And like other news organizations, they are continually looking for new revenue sources. The company currently depends on revenue from web page advertisements. Unfortunately, ad blockers dramatically reduce this revenue stream.

In December 2015, Forbes began forcing users to disable ad blockers. If forbes.com detected an ad blocker, then it would not send content to the browser. Instead, they displayed a message asking users to disable their ad blockers.

Unfortunately, a month later the ad campaign included by Forbes changed. Users who disabled their ad blockers were served malware that infected their computers.

This problem is not unique to Forbes. In 2009, the New York Times included an advertisement that infected computers with botnet software. In 2013, Yahoo.com and the London Stock Exchange linked to malware disguised as advertisements, in 2014 both the Hindustan Times and Times of Israel included malvertisements on their web sites, and in 2015, the UK's Daily Mail linked to ransomware. Each of these companies depend on revenue from online ads, but ended up distributing malware and infecting their users. In each case, site visitors with active ad blockers were unaffected.

Altered Content

• Removing any final newline characters at the end of the HTML.
• Inserting a newline characters after the HTML body.
• Converting HTML attributes from single quotes (') to double quotes (").

Impact on Forensics

• Separating sensitive computers from the Internet (an air gap).
• Segmenting computer networks, so that a problem on one system does not spread to every system.
• Scanning all media and computers with up-to-date anti-virus software.
• Using ad blockers and plugins that restrict web site functionality and mitigate the impact from web-based attacks.

What does 色色FotoForensics detect?

Staying Safe Online

Mitigation	Rational
Patch	Many types of malware exploit vulnerabilities in your computer software. Having up-to-date software prevents the spread of viruses and worms. Web browsers and email systems are particularly vulnerable to malware attacks. These applications receive data from the Internet and automatically run commands. Be sure that your browser and email programs are up-to-date.
Disable	Browser plugins provide additional functionality, but also provide footholds for malware. If you do not need the additional functionality, then turn it off. For example, most web sites require JavaScript, so you should probably leave JavaScript turned on. However, very few web sites require Java (Java is not the same as JavaScript). Java has a large number of known vulnerabilities that put your system at risk. Unless you have a specific need to have Java enabled, you should keep it turned off. The same goes for Adobe's Flash, Microsoft's Silverlight, and most other plugins. If you need the functionality, then be sure to patch often. If you do not need the functionality, then disable or remove it. If you only need the functionality for a specific use, then enable click-to-use; do not allow it to autorun. Most web browsers have a configuration menu for managing Java support, Add-ons, Plug-ins, Applications, and Extensions. This includes specifying the default action. You can choose to disable the additional functionality or prompt the user before activating it (e.g., set the action to "Always ask").
Anti-virus	Anti-virus software looks for malware signatures and takes steps to mitigate infection. Some anti-virus systems perform real-time scans in order to immediately detect and prevent infections. However, new malware comes out daily. Make sure your anti-virus signatures are updated often. Most anti-virus tools are reactive and not proactive. They only detect malware that they know about. Surveys have repeatedly shown that most anti-virus systems only detect about 70% of the computer viruses out there, and most anti-virus software detect less than 60% of new malware. In 2008, the CEO of anti-virus vendor Trend Micro, Eva Chen, declared: "I've been feeling that the anti-virus industry sucks. If you have 5.5 million new viruses out there how can you claim this industry is doing the right job?" Simply having an anti-virus system is not enough. You need to regularly update the anti-virus database and practice good online habits.
Stranger danger	Do not open emails from unknown people. Do not open unexpected attachments. Trojans often appear as unexpected attachments or as emails from strangers. The simple act of opening the email or viewing the attachment could be enough to trigger an infection. When in doubt, just delete.
Beware of ads	Online ads may appear temping, but be careful: some online offers are designed to infect your system. Ads that can be mistaken for content are likely trying to deceive you into activating some code. Watch out for ads that appear to have "buttons" to click or are positioned next to places where you might activate them by accident. Ads that are positioned to be accidentally clicked on are often hostile. Many "free" cellphone apps position ads in places where they can be easily clicked on by accident. Some online ads include malware. Called malvertisements, these ads can infect your computer just by being displayed in the web browser. Be sure to use an ad-blocker with your web browser.
Public problems	Public computers and free wireless networks are more likely to be infected or hostile. Do not use public systems for private communications. Just as a cold or flu can hang around on public surfaces, like doorknobs and faucets, a computer virus can be easily spread among public computer systems. One user may infect the public computer, and the next user will pick up the infection. Public wireless networks are equally risky. If your computer has an unpatched vulnerability, then another computer on the public network may transmit a worm to your system. In addition, hostile systems on the public network may attempt to intercept your network connections. Relying on "HTTPS" to protect your network connection is not enough. Never access anything that requires a login (such as your bank account, Facebook, or Twitter) from a public wireless network.
Share safely	Beware of sharing USB thumbdrives. Never use a CD-ROM or DVD that comes from an unknown source. If you put a clean USB drive into an infected computer, then the USB drive may become infected immediately. (That's what viruses do!) If you then put the infected drive in your computer, then your computer will become infected. Always check media, such as thumbdrives, CD-ROMs, and DVDs, with an anti-virus scanner before you use them.
Browse safely	Watch out for sites that require you to install software, enable Java, or disable your anti-virus or ad-blocker. Some web sites require you to install unknown software, or to weaken your defenses by turning off your anti-virus or disabling ad-blockers. If you see this, then get away from that site as fast as possible. A safe web site should never tell you to do something unsafe.
Avoid bad habits	If you find yourself clicking a series of popup confirmation windows ("Yes", "Yes", "Yes"...) then you are probably infected. Regular software rarely requires multiple confirmations. In constrast, malware usually triggers alerts, causing a series of "Are you sure?" prompts and popup confirmations.
Watch out	Keep an eye out for unexpected behavior. If your computer suddenly starts doing something new (and annoying), then it could be an indication of a malware infection. If your computer is suddenly running very slow, windows keep popping up, applications randomly open and close rapidly in the background, or new programs (that you don't recognize) start appearing on your taskbar, then your computer is probably infected with something. Don't ignore a computer infection. It won't go away and it won't get better over time.