“The HoeflerText Font Wasn’t Found” Google Chrome Malware Scam – What it is and how to avoid it!

You are browsing the web and accidentally land on a website with nonsensical characters instead of letters and you receive a prompt to download a missing font in order to read the website. You are told in order to fix the error and display the text, you have to update the “Chrome Font Pack”. Whatever you do, please do not click that blue Update button!

Fake Google Chrome Prompt asking you to install the malware

It is a scam designed to trick users into installing malware onto their systems. This malware is ranging from Ransomware, to Trojans, to various adware bundles.

How to avoid it

The fake dialogue box informing you that the “The HoeflerText Font Wasn’t Found” will claim you are using Chrome version 53 even if you are not using that version, which tells you something isn’t right and that the prompt you are seeing is fake.

Make sure you are using the latest version of Google Chrome which you can download by clicking here

Make sure you are also using the latest version of SUPERAntiSpyware with Real-Time Protection enabled, a feature only available for SUPERAntiSpyware Professional users.

Ransomware: Revisited

A lot has changed in the world of ransomware since we last talked about it on this blog back in 2013. For those who are new to ransomware, this post should provide a primer of what this family of malware is and what it does. For those who are more well-versed, some of our best practices at the end of this post should help provide some extra prevention methods.

TeslaCrypt, Locky, CryptoLocker, CryptoWall, and other ransomware families are making their way around the internet at break-neck pace. If you find yourself in the unfortunate place of having fallen victim to this type of malware, you’ve essentially got two options: pay up or start from scratch. While this is not something that most people want to hear, it’s the unfortunate reality for a machine that’s been ravaged by these types of infections. Even the FBI has come out and stated that your best option at data retrieval is to pay the ransom (if you do not have proper backups)!

What is Ransomware?

Ransomware is a designation given to families of malware that encrypt your personal files, and then demand a ransom payment in order to be given the decryption key. The types of files that ransomware targets range from generic text files and documents, to pictures, to video games, to music, and even beyond. Unfortunately, the type of encryption that’s used is so strong, that newer versions of some ransomware are completely impenetrable.

Most ransomware families are spread by a special type of Trojan called a “dropper”. The purpose of a dropper is to run processes in the background of your machine to download and execute code from a remote server. That code then searches your computer for files of a specific type (or types), then modifies those files by scrambling them with high-end, two part encryption. After a critical mass of files have been encrypted, the ransomware will then typically create a few different unencrypted documents and/or display a dialogue on your machine telling you that you’ve been locked out of your files unless you pay the price. To add fuel to the fire, many different variants will have a timer imposed upon you for when payment is “due” to them. If you don’t pay in time, they either increase the ransom, or delete the encryption key from their server, thereby making it impossible to retrieve your files.

To make matters worse, many different ransomware variants will disable the Volume Shadow Copy Service on your machine. This service is used by Windows to perform automatic backups and create restore points. These backups are what you would typically use to “roll back” your computer to before a major change happened.

How did I get infected?

Ransomware droppers come in all different shapes and sizes, but one thing that’s true about them is once they’ve been started, it’s almost always too late. These droppers typically are files that you download from your email, other websites, or p2p servers (such as torrent sites). Unfortunately, this is changing rapidly, and we’re starting to see “drive-by” exploits occur in the wild through infected ad-streams on popular sites many people visit on a daily basis.

One of the most frustrating parts of ransomware infections are that they’re extremely difficult to clean up. Even if you run antivirus and antimalware scanners, once the damage has been done, there’s nothing that these pieces of software can do to reverse the damage. These tools, including SUPERAntiSpyware®, can remove the underlying cause of the infection (the dropper) in many instances, but the encryption itself can’t be reversed.

Some versions of ransomware will display messages saying that they are from the FBI, NSA, INTERPOL, or other law enforcement agency. They’ll accuse you of possessing illegal documents and/or visiting illegal websites. This type of scare tactic has fallen out of favor, as people have gotten wise to it. Most modern ransomware will simply display a page admitting freely that you’ve been infected and display instructions on how to pay the ransom.

If you have a home or office network, it’s also possible that your machine got infected due to sharing a network with another infected machine. Because of how these infections work, they simply spread out across the drive space they can see, encrypting whatever data that can be found, regardless if it is on the machine that was initially infected.

What about my data?

If your machine has fallen prey to a ransomware attack, there’s not a whole lot that can be done with the files that were encrypted. Creating new files without removing the underlying infection is a fool’s errand, as they will quickly become encrypted as well.

After coming to terms with the fact that your data has been encrypted, you will find yourself in the middle of an ethical quagmire. If you pay the ransom that is demanded, you will most likely get your files back; however, you’re actively giving these attackers what they want, which is your money. There’s also no guarantee that by paying, your files will be restored; however, if people didn’t get their files back by paying the ransom, why would people continue to pay? If you don’t pay the ransom, you will lose access to all of your files, some of which may be irreplaceable. This is probably one of the most difficult decisions you will make after an infection.

While we can’t tell you one way or the other to pay the ransom or not, one thing that makes it extremely easy to rebound from is the availability of recent backups. If your backups are good, it is far more palatable to format your machine and reinstall the operating system than it is to pay the ransom. There are a few older variants of ransomware that can be decrypted by special software; however, these versions aren’t found in the wild much anymore for that very reason.

How can I protect myself?

There are many different steps you can take in order to help ensure that your machine doesn’t fall victim to a ransomware attack. Below you will find some of the best practices we have to offer:

Back up your data frequently on an external hard drive AND in the cloud. One set of backups is very rarely going to provide you with 100% coverage, either due to timing differences between when you back up your data and what you’re working on, drive failures, or infection of files in your backup.

If you network computers in your home or office make sure that each machine has its own set of backups. Most ransomware infections can not only infect drives that are connected directly to the infected machine, but also the drives of machines that are connected to the same network as the infected machine.

Always disconnect physical backup drives from your machine when not in use. If you constantly have your backup drive plugged in, there’s a strong chance that the ransomware can find and encrypt files on your backup drive.

Don’t ever download from a site that tells you that something is outdated on your machine. Websites aren’t able to detect outdated software or drivers unless you give them access to your machine. If you think that you have outdated software, download the latest version directly from the publisher’s website.

Practice caution when downloading files of any kind, even if it’s something that your grandmother sent you. Many variants of ransomware will send out emails to logged-in accounts with copies of itself attached. Always make sure to save files to your machine before running them, and always scan those files with your antivirus and antimalware scanners.

Keep your antivirus and antimalware scanners up to date with both the most recent versions of the programs themselves and the most recent versions of the detection databases. You should also take this practice a step further and make sure to keep your operating system up to date as well, as many attacks rely on exploiting bugs that have already been patched.

Leave macros in Microsoft Office disabled if you do not use them regularly, and do not turn them on if you don’t. One of the most common attack vectors of ransomware is to have unknowing victims turn on macros in order to “fix” a document that appears to be corrupted. In actuality, once the macros are enabled, the dropper begins its work.

Don’t give yourself (or other users) more login power than you need. Having administrator rights to your machine is definitely something most people overlook. Unfortunately, if a ransomware infection sees that you have administrative access, it makes the computer much easier to infect.

(OPTIONAL) Use adblocking software while browsing the web, disable scripting within your web browser, disable Flash, and disable Java. Many of the drive-by attacks are distributed through infected advertisements, Javascript commands, or through the downloading of files automatically when you open the page. By turning off this vector of attack, you might limit some of your web browsing capability, but will be that much more secure against attacks.

PUPs and You: How to Identify and Remove Potentially Unwanted Programs

The internet today is just as dangerous of a place as it ever was. Sure, there are plenty of trusted websites you visit on a daily basis that pose little to no risk to your computer. The worst that happens to most people are unwanted tracking cookies from ad servers being placed on their machine, which is a small price to pay for free access to these sites, especially since they are so easy to remove with programs such as SUPERAntiSpyware®.

Today we’re going to talk about Potentially Unwanted Programs or PUPs for short.

What are PUPs?

PUPs live in the grey area of the software spectrum. Sometimes, they can provide a service that you want, such as coupons or the ability to download videos from popular sites like YouTube; however, sometimes the programs that we classify as PUPs can be the underlying cause of unwanted behavior, such as displaying ads, installing other pieces of software, or modifying your web browser’s homepage. 

The most common sources of PUP “infections” are download websites that bundle other pieces of software in with the software that you are really trying to get. Unfortunately, many of the companies that make legitimate software don’t have a say in this bundling of software, as the download host is the one that is making a special installer that will offer up these other pieces of software before you can, or in order to, download and install the piece of software you want.

Many people just click the next button over and over again until they get the software they want installed. The downside to this method of installing software is that you leave yourself susceptible to PUPs on your machine, oftentimes not realizing what has been installed until it is too late. This is what many of these bundled installers are hoping for. They want you to blindly click through so they can get paid for the install of software, as these sites get paid for each piece of software they are able to distribute to end-users, even if they don’t necessarily want what they’re getting.

Once a computer has been “infected” by a PUP, the user may notice some major performance slowdowns or other erratic behaviors. The most common side-effects of PUPs include unwanted or unknown software popping up on your screen telling you there’s a problem, advertisements taking over your screen (either through the web browser directly, or through pop-ups outside the main browser window, system resources being hogged (slowing down the computer), toolbars being installed without your knowledge, and your browser’s homepage being redirected to an unknown/unwanted website.

How can I protect myself from PUPs?

The easiest way to avoid installing PUPs is to make sure that you’re downloading programs from trusted sources (always from the software publisher, if possible), you’re reading each of the screens on install wizards (removing any unwanted options from the installation), and do your research on whether or not the software that you’re looking for is safe and held in high regard by members of the community.

One of the biggest traps that are out there in the wild is the ubiquitous “Big Button”. You have probably seen these before. Say, for example, you’re looking for new media player software to play movies and music. In order to get that software, you go to a file hosting website, and you’re immediately greeted with three green buttons, a red button, and a yellow button, all with the word “DOWNLOAD” in bold capital letters across the center of it. Which one is the correct button to press?

Sometimes reading through the website isn’t enough to show you exactly which button is the real button, and which is an advertisement for another piece of software that’s been embedded near the correct button. Some websites even offer two different versions of the software: one that’s a clean installer, the other is an ad-supported/bundled installer.

This is why we recommend trying to download the software you want directly from the company who makes it. They want you to use their software, so they’re going to make it as easy for you as possible to get what you want. That means no bundled software and no ads that are disguised as download links.

Keep in mind that not all bundled software is bad. Many programs will offer downloads of legitimate products, such as Google Chrome or Dropbox. It’s a common occurrence in the software industry; however, if you’re not familiar with the name of the product a company wants you to install, you should always err on the side of caution and opt out of having that software installed.

How do I get rid of PUPs?

Most PUPs can be removed by going into your control panel and uninstalling them just as you would any other piece of software. In some cases, this unfortunately doesn’t always work. Programs such as SUPERAntiSpyware® try to remove these PUPs before scans, and most of the time we’re successful; however, new PUPs, new malware/spyware threats, and variants of existing threats, are created daily.  

A couple easy ways to try to get rid of these PUPs before running more in-depth cleaning are to make sure you remove any unknown browser extensions in your web browser, and using the add/remove programs feature within Windows.  Typically these PUPs will have their own uninstall files that can easily remove the threat once it is known. As always, make sure you exercise caution when removing programs, as not all “unknown” programs are malicious.

If you think that your machine might have PUPs that you can’t seem to get rid of, or any other malware infection for that matter, the best course of action is to first figure out exactly what you’re dealing with. If there is any distinguishing information you can see (like the program name), do a quick search to see how to remove the program. Most of the time, there will already be a removal guide available for the specific PUP or threat you’re dealing with.

Dealing with pesky PUPs can be time consuming, but remember, the time you take to fix the issue when you first notice it is time you save dealing with a computer that’s been slowed down by these unnecessary and unwanted programs.

Why are you calling <Software Name> a PUP? There’s nothing wrong with it!

There are many different criteria that go into classifying a piece of software a PUP. Keep in mind that the first letter of the acronym stands for POTENTIALLY. If a piece of software you want or use on a regular basis is being detected as a PUP, you’re more than welcome to keep using it or ignore the detection within SUPERAntiSpyware®. 

We try to not remove anything from your machine unless we know that it has un-welcomed side effects. Some of the criteria we use for determining if a piece of software is a PUP is outlined below:

–          The software is known to display advertisements. This covers everything from pop-ups, pup-unders, ad overlays, inserting in-text ads, and replacing existing advertising streams.

–          Hijacking one or more installed web browser. This covers everything from redirecting the homepage (with or without permission), altering search results, inserting bookmarks, installing unwanted add-ons/extensions, and installing toolbars that bring value to the maker rather than the user.

–          Bundling other software. This covers everything from including other software as a bundle (optional or otherwise) with a desired piece of software, being included in a bundle from another software or download site, making it difficult/impossible to opt-out of bundled software.

–          The overall sentiment of the program is bad. This covers install and uninstall trends for particular pieces of software based on reviews and removal guides from trusted sources, using alarmist notifications to trick the user into purchasing, forcing a purchase to clean or fix issues with or without explaining what the issues are, and using misleading uninstallers to either force download more undesirable software or trick users into keeping the software.

While this is by no means a comprehensive list, it is definitely a good starting point as to why we consider a program as being undesirable. There are plenty of other software review websites out there that will probably echo our sentiments; however, as always, if something is working for you, feel free to ignore the detection.