[Portions adapted and republished from CA.com]

An alarming alert suddenly appears on your computer screen– your PC has been infected and must be cleansed. The alert offers an opportunity to download “Antivirus XP 2008″ (aka “Antivirus XP Pro”), a program to remove the infection. Do not click any links; turn off the computer with the on/off button and call us immediately at 770-713-8070.

Your PC is already infected, but the damage can be minimized. Antivirus XP 2008 (AntivirusXP08) is a component of the FakeAlert family of trojans. It follows in a long line of schemes to extort money from innocent computer users via multicomponent malware. The FakeAlert family is one part trojan, one part downloader, and one part rogue security product. All components work in tandem to trick users out of money.

The downloader pulls down various code and installs a rogue security product. The most recent, and unfortunately most prolific, rogue security product to be installed is “Antivirus XP 2008″, but that could change. Past downloads have included rogue security products like Antivirus 2009, WinFixer 2006 and Malware Protector 2008. Most variants hijack the user’s desktop and screensaver.

They also use what look like legitimate Windows alerts (balloon windows), but are actually fake alerts, to scare the user into thinking they are infected with spyware. Unfortunately, the actual infection is FakeAlert and related components. The same alerts offer a remedy to the infection, a rogue security product, that will remove the “spyware” for a fee. The entire scheme is meant to get your money. All components need to be removed to neutralize the threat.

The possibilities for infection are great. Recently, aggressive email spam campaigns have been used to infect users with FakeAlert and subcomponent Antivirus XP 2008. One notable campaign sent fake CNN news alerts. The alerts were identical to actual alerts sent by CNN and MSN. When the user clicked a link to a “news story” they were brought to page that looked identical to a CNN page and prompted to download a video codec to watch the news alert. Upon doing this, the user became infected. Some fake emails have also been titled ““CNN.com Daily Top 10″. Visitors to porn video sites are also at great risk of acquiring this infection.

Shoestring Solutions can remove the AntivirusXP08 infection and restore your computer to full function. We can also install high-quality antivirus and antispyware applications to minimize the possibility of repeat infection. In addition, we can reclaim wasted disk space, and update Windows* for optimal performance. Contact us for more information.

(Windows XP and Vista)

While we applaud the anti-spam industry for removing the plethora of unwanted email from our mailboxes, from time to time some legitimate email publications like ours are mistaken as unwanted. Sometimes, this results in mailings from our Shoestring News mail list hosting service bouncing back, with requests for us to respond to challenge/response messages to prevent future filtering.  However, due to the size of our client’s lists, it’s nearly impossible for us handle the volume of such requests.

We want you to receive our newsletters! You can make sure that you receive the newsletters to which you are subscribed by doing the following:

1. Never use the “Report Spam” button to remove a newsletter to which you subscribed from your Inbox. The “Report Spam” or “Junk Mail” button is not the same as the “Delete” button– it will send a message to your ISP that the newsletter is spam. This can prevent you from receiving other, wanted emails. If you subscribed, be a good subscriber and unsubscribe if you no longer want to receive a publication;
2. Add our publications to your “safe” or permitted email sender list.  This usually involves simply adding our sending address (From: mail@shoestringnews.com) to your whitelist, safelist, or list of privileged senders.  This is commonly known as “whitelisting” a publication and doesn’t prevent you from unsubscribing in the future.

Please refer to the following whitelisting instructions you can use to whitelist Shoestring News publications, depending on the filtering solution you use:

AOL

Go to keyword:  Mail Controls.
Select the screen name we’re sending your Shoestring News to.
Click Customize Mail Controls For This Screen Name.

Version 9.0:

Open your latest Shoestring News e-mail.
Click the Add Address button (on the right) to add to your “People I Know” list.

Alternatively, you can just send an e-mail to: mail@shoestringnews.com, and that
will add us to your “People I Know” list automatically. To do this:

Open your latest Shoestring News e-mail.
Click the Reply button (it’s in the top right corner).
A new email window opens with the wrong address in the “Send To” box.
Replace the address in the Send To box with: mail@shoestringnews.com
Click Send Now (in the top right corner).
Even if the e-mail you send doesn’t get through to us, the act of sending it does the job of putting us into your “People I Know” list.

CleanMyMailbox:

If Shoestring News is filtered, from the spambox,
click on the white “W” icon on the left column of the mailing. 
When the pop-up window comes up, simply click the Add to Whitelist button.

Alternative whitelisting methods: 

* Click on the White List button.
   Add: mail@shoestringnews.com to the bottom of your existing list. 
   Click the Submit List button.

Cloudmark SpamNet:

Select Cloudmark | Options… from the Cloudmark SpamNet toolbar in Outlook.
Click Advanced.
Go to the Whitelist tab.
Click the Add button.
Type: mail@shoestringnews.com
Click OK.
Click OK.
Click Yes.
Click OK.

Earthlink:

Click on Address Book (it’s over on the left, below your Folders).
When your Address Book opens, click the Add button.
On the Add Contact screen, find the Internet Information box.
Enter mail@shoestringnews.com into the top Email box.
Click Save.

Hotmail:

Click the Options link, on the main menu tabs, then Safe List.
Type: mail@shoestringnews.com in your Safe List.
If you see a message that should not be in your Junk Mail folder, click
‘This is not Junk Mail’ to avoid having e-mail from the same source sent to
the Junk Mail folder in the future.

Mailblocks:

Click the Addresses tab.
Click New.
Type: mail@shoestringnews.com
Make sure ‘Accept Mail From This Address’ is selected under Receiving Options.
Uncheck ‘Display in People Picker’ under Other options.
Click Submit.
Click OK.

MailShield:

Click Friends from the toolbar.
Click Add.
Type: mail@shoestringnews.com
Click OK.

MailWasher:

Click Tools, then Blacklist & Friends.
Click Add… on the right, the Friends list side.
Make sure Plain email address is selected.
Type: mail@shoestringnews.com
Click OK.
Click OK.

McAfee Spamkiller:

Click Friends from the sidebar.
Click Add.
Type: mail@shoestringnews.com
Click OK.

MSN:

Click on Settings: E-mail | Junk e-mail (it’s at the bottom left of the screen, just above Calendar)
On the E-mail settings screen, click Junk E-Mail Guard.
Select Safe List.
In the space provided under “Add people to the safe list”, enter mail@shoestringnews.com.
Click Add.

oddpost:

Check your ‘Probably Spam’ folder.
If you see that Shoestring News was incorrectly filtered out,
select it, and click the ‘Move to Inbox and Mark as Not Spam’ button.

Outlook 2003:

Add mail@shoestringnews.com to your Safe List.
Add mail@shoestringnews.com to your Personal Contacts in your Outlook Address Book.
Open any desired e-mail, then select Mark as Not Junk.

SpamButcher:

Click the Configure button.
Go to the Known Senders tab.
Click Add under ‘Known Good Senders and Recipients’.
Type: mail@shoestringnews.com
Click OK.
Click OK.

SpamCop:

Open your browser and go to: http://webmail.spamcop.net
Log into your SpamCop account.
Click on the Options icon in the toolbar.
Under Mail Management (in the middle), click SpamCop Tools.
Select Manage your personal whitelist.
Near the bottom, where it reads “Click here to add to your whitelist”, click on Click here.
Enter mail@shoestringnews.com in the first empty slot.
Click Submit.

Spameater Pro:

Click Filters from the sidebar.
Click the Approved Senders tab.
Click Add Filter.
Type: mail@shoestringnews.com under Address.
Choose ‘Full Email Address’ under Address Type.
Select Email Domain.
Click OK.

Spam Inspector:

Select Spam Inspector, then ‘Manage Friends List’
from either the Spam Inspector toolbar or from the Outlook menu.
Make sure Email is selected under ‘Add a New Friend’.
Type: mail@shoestringnews.com
Click the >> button.
Click Close.

Spam Interceptor:

Follow the Trusted link under > Authentication Lists.  Enter the email
address: mail@shoestringnews.com
Click Add.

Spamkiller:

On the Spamkiller sidebar, click Friends.
Click Add.
Enter mail@shoestringnews.com and click the OK button.

SpamPal:

Click on the SpamPal system tray icon with the right mouse button.
Click ‘Add to Whitelist’ from the menu.
Type: mail@shoestringnews.com
Click Add.

Spam Sleuth:

Select File, then Configure.
Go to the Friends category.
Make sure Active is checked.
Type: mail@shoestringnews.com on a line by itself in the entry field.
Click OK.

Verizon:

Go to your Verizon Inbox.
Click Options.
Select the Block Senders tab (near the top of the screen).
On the Block Senders screen, you’ll see both a “Block Sender List” and
a “Safe List”. In the space where it says “Enter e-mail address or sub
domain to always accept even if the domain is blocked”, enter mail@shoestringnews.com.

Yahoo! Mail

Open your Yahoo! mailbox.
Click Mail Options.
Click Filters.
Click Add Filter.
In the top row, labeled ‘From header:’ make sure Contains is selected in the pull-down menu.
Click in the text box next to that pull-down menu, then enter the address: mail@shoestringnews.com
At the bottom, where it says “Move the Message To:” select Inbox from the pull-down menu.
Click the Add Filter button again.

If Shoestring News has been filtered to your “bulk” folder, simply
open the message and click on the “This is not Spam” link next to
the “From” field.

Other providers:

If Shoestring News is being filtered, try adding mail@shoestringnews.com to your Address Book or Contact list.  If this option is not available, try moving the message to your ‘inbox’ or forwarding the message to yourself.

If subsequent messages continue to be filtered, call or e-mail your ISP’s technical support
and ask how you can be sure to receive all e-mail from mail@shoestringnews.com.

Domain: If they need to know the domain we’re mailing from, tell them:  shoestringnews.com
   
IP Address: If they ask for our sending IP address, tell them: 207.45.176.130 and ds1019.securenet-server.net

###

*Shoestring News is a newsletter hosting service operated by Shoestring Solutions. For a list of our hosted publications, go here.