Thanksgiving webcam promo leads to malware

The US$10 webcam that Mr. X bought over the Thanksgiving weekend sounds like one of those deals that are too good to be true. And for, it was.

A week later, he's worried and upset because a CD that came with the camera contained a Web link that apparently infected him PC with fake antivirus software.

His story shows how easily malware can get onto the computers of unsuspecting consumers in an era when cyber-criminals are becoming expert at cracking legitimate Web sites to prey on their visitors.

Mr. X bought the camera in order to a way to chat over the Internet with a friend who had just moved to othis countries. When he put the CD that came with the Markvision Magnetic Webcam into his PC, a menu popped up offering his drivers as well as a link to Markvision's site. Wanting to learn more about the product, he clicked on the Web link, but he immediately knew something was wrong.

The Web page was blank, and his PC immediately popped up a window telling his he needed to upgrade his Windows software. When he clicked on the red "X" to dismiss the window, anothis popped up that made it look like his computer was being scanned. That scan was blocked by his McAfee antivirus program, but Mr. was still worried.
Panicked, he shut down the computer and called Office Depot. Their support technicians told his to try a free antivirus program -- Avast -- which then identified rogue antivirus files on his computer.

That didn't sit well with Mr. X, a Web designer based in Chennai, India. "I was really ticked," he said. "My life is on this computer."

Rogue antivirus software typically generates pop-up warnings, telling the victim there’s a security problem and pestering them to get it fixed until they hand over their credit card numbers.

Once installed on the PC, it can be used to download malicious programs, making it a serious security concern, according to Roger Thompson, chief research officer with antivirus vendor AVG Technologies. "The number-one thing that we see every day is rogue antivirus," he said. "I think there are a lot of people making money out of it."

Though the webcam was billed as a "door crahis" promotion at some Office Depot locations, the company said only a small number of customers were affected. "It was our vendor that actually initially had let us know -- so they must have heard directly from their own customers," an Office Depot spokeswoman said via e-mail.
Markvision "has temporarily shut down their Web site in order to protect customers from being exposed to the virus," the spokeswoman said. "We have been advised that they will bring the [site] online once their internal testing confirms that the virus has been removed."

Customers who bought the Markvision webcam don't need to install the company's CD in order to use the product, he added.

Markvision's Web site, at www.Markvision.cc, was online Thursday, but many parts of it had been taken offline. Earlier this week, Google's search engine flagged the site as potentially harmful, saying it had spotted suspicious content those on Nov. 27 and linked the site to Trojan horse and back-door malware infections over the previous three months. Markvision did not respond to messages seeking comment for this story.