Cyber-Criminals Peddling Fake AV That Looks Very Much Like the Real Thing

[InfoSec News <alerts () infosecnews org>]

http://www.eweek.com/c/a/Security/CyberCriminals-Peddling-Fake-AV-That-Looks-Very-Much-Like-the-Real-Thing-679275/

By Fahmida Y. Rashid
eWeek.com
2011-11-29

It's getting harder and harder to tell the fake antivirus apart from the 
real software as cyber-criminals improve the look and feel of the 
scareware programs.

Developers of fake antivirus software are getting better at copying the 
look and feel of legitimate antivirus products to make it harder for 
victims to tell whether they are being scammed or not, according to 
Kaspersky Lab.

A fake antivirus Website was found specially designed to mimic the 
interface for antivirus products from Kaspersky Lab, Symantec's Norton 
and Avira, Dmitry Bestuzhev, an antivirus researcher at Kaspersky Lab, 
wrote on the SecureList blog Nov.29. The initial infection was triggered 
by a dropper Trojan that downloaded onto the user's computer the fake 
screen that closely resembled legitimate software.

In the past, rogue antivirus products were fake screenshots taken from a 
generic template. "These fakes didn’t claim to find any infections—the 
victim was simply ripped off after paying for a useless product," said 
Bestuzhev. A recent version observed by Kaspersky Lab simulates the 
actual scanning process on the victim's PC, he said.

Kaspersky Lab researchers noted at the beginning of the month a 
"substantial decrease" in the number of fake antivirus programs since 
earlier this year. There were 10,000 daily attempts to infect users with 
fake antivirus, down dramatically from the 50,000 to 60,000 daily 
attempts back in June, according to Vyacheslav Zakorzhevsky, a senior 
malware analyst in Kaspersky Lab's heuristic detection group.

[...]

_____________________________________________________
Subscribe to InfoSec News - www.infosecnews.org
http://www.infosecnews.org/mailman/listinfo/isn