Rogue Anti-Malware products (are you ready for your close-up?)

DeborahS · 09-10-2008, 12:26 AM

Today I am going to record some examples of rogue anti-malware and what it does to your computer for a video that I'll put together for our Web of Trust (WOT) series. The current "stars" in this nasty galaxy are the XP Antivirus 2008 & 2009 twins. But you know how it is in show business - those two are so last week!

Do any of our forum experts have a suggestion of better candidates? This type of software quickly disappears, then reappears with a new package, name, look and marketing around it, so it is a race to find one that will remain in existence for a while. I looked at xp-shield and free-web-browsers the other day, but they may be gone already.

Thanks for any suggestions. I'll let you know what I end up using.

Best,
Deborah

DeborahS · 09-16-2008, 02:04 AM

For examples of fake anti-malware products, I used an infected redirect from a real business website that took me to Windows Antivirus (WinAntivirus 2008). It's appearance would easily fool someone into thinking it was coming from their own computer, especially if they were startled by the suddenness of it. It did a fake scan on a clean virtual machine and "found" 3 viruses. Pushing buttons to cancel, run, save, whatever, put me in an endless loop.

I simulated what a confused and frightened person would do (not much of a simulation because the errors and pop ups were coming fast and furious), I tried the search again and got redirected again. This time it went to a similar looking anti-malware scanner called VirusRemover 2008. It did the same thing with the scan and the message boxes popping up, finally going to a website and ultimately ending up on a purchase page.

After an F-secure online scan the clean virtual machine ended up having 16 viruses!

09-10-2008, 12:26 AM	#1 (permalink)
DeborahS Registered User Join Date: Sep 2008 Location: At the top of the world Posts: 4 OS: Vista	Rogue Anti-Malware products (are you ready for your close-up?) Today I am going to record some examples of rogue anti-malware and what it does to your computer for a video that I'll put together for our Web of Trust (WOT) series. The current "stars" in this nasty galaxy are the XP Antivirus 2008 & 2009 twins. But you know how it is in show business - those two are so last week! Do any of our forum experts have a suggestion of better candidates? This type of software quickly disappears, then reappears with a new package, name, look and marketing around it, so it is a race to find one that will remain in existence for a while. I looked at xp-shield and free-web-browsers the other day, but they may be gone already. Thanks for any suggestions. I'll let you know what I end up using. Best, Deborah

09-16-2008, 02:04 AM	#2 (permalink)
DeborahS Registered User Join Date: Sep 2008 Location: At the top of the world Posts: 4 OS: Vista	Re: Rogue Anti-Malware products (are you ready for your close-up?) For examples of fake anti-malware products, I used an infected redirect from a real business website that took me to Windows Antivirus (WinAntivirus 2008). It's appearance would easily fool someone into thinking it was coming from their own computer, especially if they were startled by the suddenness of it. It did a fake scan on a clean virtual machine and "found" 3 viruses. Pushing buttons to cancel, run, save, whatever, put me in an endless loop. I simulated what a confused and frightened person would do (not much of a simulation because the errors and pop ups were coming fast and furious), I tried the search again and got redirected again. This time it went to a similar looking anti-malware scanner called VirusRemover 2008. It did the same thing with the scan and the message boxes popping up, finally going to a website and ultimately ending up on a purchase page. After an F-secure online scan the clean virtual machine ended up having 16 viruses!