Incident Response, Network Security, TDR

Washington state, Microsoft announce “scareware” suits

The Washington attorney general on Monday announced the state's latest lawsuit under its expanded anti-spyware law -- this time going after a Texas company that sent computer users bogus messages telling them their machines were infected.

"We won't tolerate the use of alarmist warnings or deceptive 'free scans' to trick consumers into buying software to fix a problem that doesn't even exist," Attorney General Rob McKenna said in a conference call on Monday.

The suit is the latest of seven that have been filed since the state's anti-spyware law was extended to make it illegal for malicious individuals to send fake pop-ups that warn users they need to make computer repairs -- a class of malware known as "scareware."

In the latest case, the state contends that James McCreary IV of The Woodlands, Texas and his two companies, Branch Software and Alpha Red, were responsible for bombarding users with warnings they need to buy a bogus product called RegistryCleaner XP.

If users clicked on the pop-up, a free scan ran that claimed their registries were corrupted with critical errors, Paula Selis, who heads the Attorney General Office's consumer protection unit, said during the call. To fix the problem, the scam said, users needed to purchase RegistryCleanerXP for $39.95.

An example of what the pop-up ad looked like.

"What this doesn't tell you is that every single computer we did this scan on had 43 errors when, in fact, none of them actually had those errors," she said.

McCreary could not be reached for comment.

Richard Boscovich, a Microsoft senior attorney, said the alleged fraudsters were sending their messages through the Windows Messenger Service, normally used by administrators to send notices to users. However, it appears the scammers were able to send their own notices if users had forgotten to download the latest XP Service Pack updates from Microsoft.

On its own, Redmond, Wash.-based Microsoft, which assisted the state with the crafting of the Computer Spyware Act, has filed 17 civil lawsuits -- including five for alleged scareware offenses -- since the law took effect in 2005.

The press conference on Monday comes on the heels of a new study from North Carolina State University which concluded that most internet users cannot tell the difference between real and fake pop-up messages. In fact, the study showed, users clicked "OK" on the pop-ups 63 percent of the time.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.