Fake Antivirus and Firefox Cache Tools

Firefox has some pretty nifty features. One of those is the ability to view the cache contents without any extra tools. This post covers an incident with a fake antivirus popup and how I used the built in Firefox tools to confirm my suspicions.

The Story

This all started when I got a text message from my wife earlier today. This is the image she sent me:

The story goes, our daughter was using the computer and this appeared on the screen. My initial thought was this is a fake antivirus popup. However, we do have Microsoft Security Essentials (MSE) on that computer and the screen shot is convincing. Following the old saying of "you are better safe than sorry"; I told her to shut down the computer and I would look at it when I got home.

The Initial Review

Once at home, I looked more closely at this incident. First, I opened MSE to review the logs and found that nothing was detected in any previous scans (edit: MSE actually calls this History). This starts to confirm the suspicion of a fake antivirus popup.

The next step was to take the cache files from my daughter's profile and put them in a virtual machine. Since she uses Firefox, this is easy to do. If you are interested, explanations of the Firefox cache directories are here.

A quick peek at the history reveals this is definitely fake antivirus related.

The entries for detectionprotectorprocesses.in and "Viruses were found on your computer!" are dead giveaways. At this point you could stop but I will take a few more minutes to show you some of the Firefox cache exploration tools.

Firefox Cache Tools

I start the cache exploration by typing about:cache into the URL bar. This gives you the screen below which is not very useful.

Clicking on "List Cache Entries" starts to look more interesting.

This page can be searched by pressing Ctrl+F. I searched for "detectionprotectorprocesses.in".

The fifth detectionprotectorprocesses.in entry refers to a PNG image file. Clicking on that link takes us to another page, specific to the alert.PNG cache entry.

This page is filled with information. It includes HTTP server response headers and a full packet capture of the PNG image. In the center of the page is a line marked "file on disk". This gives the location on the disk where the cached image is located. I navigated to that location, copied the file to a temporary directory, and renamed it with a PNG extension.

Opening this file removes any remaining doubt about the fake antivirus popup. This recovered image perfectly matches the text message I received earlier today!

Conclusion

I suspect the popup came from the website directly prior in the browsing history, possibly from an advertisement. If that is true, it appears the problem has been remedied. I did look for some contact information on that website, but I did not locate any. I would have preferred to report this information, but I was unable to.

Firefox is a great browser. These cache tools are great for troubleshooting and fun to explore with as well. I am certain Firefox includes many more tools that I don't know about. Hopefully you found something useful in this post. Thanks for reading!

Remote Packet Captures With Wireshark

Here's a Wireshark feature I just recently discovered. I don't know how long it's been available but I believe it's fairly new. It is listed as experimental in WinPcap so YMMV.

If you have ever needed to do a remote packet capture you know it can be painful. It usually requires that you to go to the remote system or switch. You probably have to configure a mirrored port or install a hub inline. If you are lucky, you can get someone at the remote end to do this for you. In either case, it seems like it takes longer than it should. With Wireshark 1.6.2 and WinPcap 4.1.2 you can make this a much simpler task. Use the simple diagram below as a guide. In this example, we want to capture packets from the remote host with IP address 172.16.10.50.

Start by installing WinPcap on the machine you would like to capture packets from. This is probably a good time to note that this only works on Windows. After WinPcap is installed, drop to a command prompt (elevated command prompt in Vista/7/2008/2008R2).  Change directories to C:\Program Files\WinPcap or C:\Program Files (x86)\WinPcap. Run "rpcapd.exe -s rpcapd.ini -l 172.16.5.20" and then press Ctrl+C. Remember, 172.16.5.20 is the Wireshark computer. This creates the rpcapd.ini file necessary to run as a service. Next open rpcpad.ini in notepad.

This next part may be a little controversial. In order to connect, you need to disable username/password authentication. According to winpcap.org, username/password authentication is possible however I have not been able to locate any documentation on how to configure it. I have also asked on the winpcap-users mailing list. If you know the answer to this, drop me a line. Once I have this problem solved, I will update this post to enforce authentication. For additional security, you should disable the rpcapd service or uninstall WinPcap when you are finished with your capture.

With that out of the way, go back to notepad. Change the line NullAuthPermit = NO to NullAuthPermit = YES. Close notepad and run "net start rpcapd" to start the "Remote Packet Capture Protocol v.0 (experimental)" service. We are now done with the remote system.



Go to your computer with Wireshark installed and open Wireshark. Click Capture->Options.


Click the drop down arrow next to Interface and choose Remote.


Enter 172.16.10.50 (your remote capture machine) and 2002 for the port. Choose Null Authentication and click OK.



Next, just click Start to begin your packet capture. Wireshark behaves exactly as if you were capturing packets locally. By default, Wireshark ignores the RPCAP traffic. You might want to a make a copy of your rpcapd.ini file. If you need to do more caputres in the future, you can install WinPcap, copy your rpcap.ini file to a host, and start the rpcapd service.

As always, feel free to leave comments below and drop me a note if you found this useful.