Good reading
Wednesday, June 01, 2005
The Antivirus Virus...
....allow me to elaborate. There's something floating round
out there at the moment, and it takes the form of an
Antivirus scanner that (wait for it)...infects you with a
handful of viruses, then demands payment so you can remove
them!
Antivirus Gold (not to be confused with Norton Antivirus
Gold, though I wouldn't run that either) is currently
spreading like a bad rash across desktop PCs with the
promise of extra safety and the reality of grown men
weeping.
A number of vaguley sneaky ploys are used to gain user
trust (the Antivirus Gold .exe is named AVG.exe - sound
familiar and reassuring?) and there are also one or two
reports of this thing appearing by means of a dodgy codec
install. This codec apparently originates from a number of
porn sites, so think twice before indulging in some
Bridget the Midget action.
http://www.ez-finder.com - ah, bless. Its a widdle biddy
search engine....except, its not. It simply serves as a
front for the infective files which can be obtained from
that particular URL. End up with Antivirus Gold on your
PC, and immediately upon install the damn thing runs
automatically and throws "Danger, Will Robinson" splash
screens all over the place:
These are totally fictionalised false positives here, as
this was a totally clean build of XP that hadn't even been
online. Worse still, the "quick" scan seemed to take about
the same length of time as the "thorough" one. Hmm.
Regardless of what you click, everything takes you to
a "BUY ME NOW!" button - and if you don't, presumably your
PC is doomed to a life of, er, one fake registry entry and
a pair of cookies. The horror.
However - that's not the whole story.
There seem to be a number of different installs for this
thing, and depending on how your luck is doing, you may
get the above (relatively harmless) version or one of the
more nastier ones. The ones with the aforementioned
Trojans, for example - or the one with the hijacked
desktop wallpaper (screaming, yes, you've guessed it, "buy
me now"). I would assume the ultimate payload comes from
the "Codec", though I'll have to get my hands on it to
confirm.
As for the above version, it thankfully goes (with a bit
of effort) from the Add / Remove programs panel, though it
does force open one final webpage on its way out (because
let's face it, if you thought a program was bad enough to
uninstall, the first thing you want to see after removing
it is a webpage imploring you to buy it, right?) Other
versions will allow you to uninstall, only to reappear
upon reboot. Eek.
For now, I'd advise to stick to the tried and tested AV
Scanners. At this rate, Eric L. Howes is going to have to
create a whole new rogue list...
