Fake anti-virus attacks turn even more sinister

Fake anti-virus software has been the scourge of the net for awhile now, but hackers are now taking it a step further and making it even more sinister. Panda Labs says that Total Security 2009 starts out like most fake anti-viruses. It “scans” the victim’s computer and tells them they’ve got a serious infection, then announces it can take care of it for them for a mere $30. If the victim pays, the fake software pretends to remove the non-existent malware it found. The victim feels relieved and the hacker has made money. If the victim smells a scam and doesn’t pay, they are nagged endlessly by pop ups urging them to pay up and download the program.

Total Security takes it a few steps further. First, it demands $79.95 for the program and then an additional $19.95 (a total of a whopping $100) for “tech support.” If the victim won’t pay the program gets very nasty and blocks every file and program on the computer except IE, claiming they are “infected.” IE is then hijacked and redirects them to Total Security’s website, where they are told to pay up if they want their files back. Yep, Total Security has made the jump from scareware to ransomware.

To achieve its goal of blocking the victim from accessing anything on their computer, the program simply intercepts Windows calls to open programs and blocks them before they can. It’s an old tool being used in a whole new way.

“This intercepting technique has been used before in other malware, for instance any rootkit malware, which is specifically designed to hide and kill processes silently in the background. However, this is the first time in history it has been spotted in conjunction with rogueware,” said Panda Security’s technical director, Luis Corrons..

Total Security 2009, like many fake anti-virus programs, isn’t detected by many anti-virus programs. This low detection rate is key to the success of such programs, which have become huge money makers for cybercriminals. The fake anti-virus software industry is booming, and experts say this new ransomware twist should become more and more common. Stick to name brands like Symantec or AVG for your anti-virus needs.

Read [PCWorld]