We came across a new fake anti virus yesterday that was accessed by clicking on a link that looked like a twitter feed subscription. The web page that was opened loaded the virus in the background, and didn't take the user to twitter, but to an online pharmacy. This fake alert bug is based on one that has been around for a while - Anti-Virus XP. This one goes by many aliases such as Anti-Virus 2010, Win 7 Antivirus Pro, Total security, plus many more. Once installed, it modifies the system registry so that when you open any program, the fake anti-virus is run first. Once it is open, a fake scan takes place, and an alert is given saying that your system is infected, and that you need to purchase the program to fix your system. This is a scam, and we have found that some anti-virus programs have trouble detecting and removing it. It is a bit tricky to remove aswell, as there are registry settings that need to be edited aswell as removing the actual file. If you believe that you have been infected, please contact us, and we'll get it sorted for you!
Wednesday, June 9, 2010
Beware of Fake Anti-Virus!
We came across a new fake anti virus yesterday that was accessed by clicking on a link that looked like a twitter feed subscription. The web page that was opened loaded the virus in the background, and didn't take the user to twitter, but to an online pharmacy. This fake alert bug is based on one that has been around for a while - Anti-Virus XP. This one goes by many aliases such as Anti-Virus 2010, Win 7 Antivirus Pro, Total security, plus many more. Once installed, it modifies the system registry so that when you open any program, the fake anti-virus is run first. Once it is open, a fake scan takes place, and an alert is given saying that your system is infected, and that you need to purchase the program to fix your system. This is a scam, and we have found that some anti-virus programs have trouble detecting and removing it. It is a bit tricky to remove aswell, as there are registry settings that need to be edited aswell as removing the actual file. If you believe that you have been infected, please contact us, and we'll get it sorted for you!
