WV State Bar Site Remains Offline After Last Malware Infection

The WV State Bar site remains offline today. The site was taken offline last Friday, four days after it was discovered the site was hosting malware yet again.

In an email, the Bar published information the site would be offline for maintenance:

“SPECIAL EDITION BAR BLAST”

* wvbar.org is currently offline for maintenance
* For Casemaker access, click here - https://demo.lawriter.net - login and password are westva (lowercase)
* For registration & other inquiries regarding the 2009 Annual Meeting, please contact Cheryl L. Wright at
cheryl@wvbar.org or 304.558.0828
*For Information regarding pro hac vice admissions, please contact Cheryl L. Wright at cheryl@wvbar.org or
304.558.0828

This is the same information currently on the website at http://www.wvbar.org/. It appears the site has been taken down to fix whatever problem was causing the site to be compromised on an almost monthly basis.

While my firm has not reported any infections that can be traced to the Bar's website, it remains to be seen if others firms have been so lucky.

New Fake AntiVirus warning screen

With looking at this screen closely you might not recognize this is a web page rendered in Firefox. Once gain the bad guys have upped the ante in the high stakes poker game of malware. This particular trick attempts to make the end user believe they are looking at a Windows Explorer screen with warning messages of a large number of trojans and virus infections. It next presents a popup box to entice the user to download the fake antivirus, probably our old friend Antivirus2009.



Click on the picture of a better view.

This is another example of how malware writers continue to excelerate the arms race in the battle of keeping users from clicking on things.

If you see a screen like this kill it from the process viewer. There has been reports clicking anywhere on this screen will cause infection. In this case the user was looking for NCAA brackets using a Google search. Thankfully he called to report the incident before taking any other action.

Related Story: NCAA March Madness Malicious Blog Links