Rogue anti-virus crooks hone sales skills

gallery

Cyber criminals have tried to dupe users into downloading rogue anti-virus software using a fake comparision service.

A new Trojan has been spotted by Sunbelt Software, offering a range of fake security products, rather than just one as is typical with such attacks.

The Trojan opened a window with the heading “Microsoft Security Essentials Alert” and four buttons to choose from, all of which led to a website offering a comparison service between different products, noted Sunbelt Software researcher Tom Kelchner.

A selection of security products appeared on the list, with legitimate ones seemingly unable to identify malware supposedly infecting the user’s computer.

Four of the products, all of which were fake, managed to find malicious files and also claim to be free.

The names of the fake products included Red Cross Antivirus, Peak Protection 2010, Major Defense Kit and Pest Detector 4.1.

“You know the drill. Although the installs are ‘free’ they pop up scary warnings that your machine is infected, but don't remove the threats until you pay,” Kelchner said in a blog.

The rogue products installed themselves on victims’ computers as antispy.exe and tmp.exe files.

“The install reboots your computer, kills Windows Explorer (which is what displays your desktop) and leaves you with no icons on your desktop,” Kelchner said

It is possible to launch Explorer and restore the icons by using Task Manager, he advised.

Rogue causing ruin

Fake anti-virus products are still a hit with hackers and Sophos issued a warning yesterday of a major attack.

The illicit initiative attempted to lure potential victims into downloading attached HTML files from a spam email.

If opened, the file would take users to a website using a malicious iFrame - a frame that allows different HTML documents to load on the same page.

This would then load scripts from other websites to help launch the fake anti-virus attack.

Email to a friend

Print this page