Hackers Spreading Scareware through Fake Security Updates

According to Trend Micro, the security vendor, cyber criminals have discovered a new method of earning revenue from bogus antivirus software. The method pertains to a scam involving a malicious program 'Vundo' that the criminals plant on users' computers by tricking them into opening a file that pretends to be a program update.

The company indicated that as soon as the malicious program is planted, it encrypts various types of document files such as Adobe Reader .pdf and Microsoft Word .doc documents. Furthermore, it scrambles the documents into Windows "My Documents" folder.

But when an end-user attempts to view any of the encrypted files, a pop-up appears that mentions - FileFix Pro 2009 would loosen the data from the folder. The message that pretends to be a notice from the Windows operating system says that the OS has found some corrupt Microsoft media and MS Office files. Subsequently, it suggests the user to follow a link so that the suggested file could be downloaded on the computer.

On clicking the link, FileFix Pro gets loaded and installed. While it decrypts just one of the tainted documents free of charge, it demands a payment from the user for the software that would completely clean the virus from the computer.

Trend Micro says that not a single antivirus product could spot or remove the malicious program as it is a "polymorphic" component and each time shows itself as a new executable.

Meanwhile, another security company, FireEye, also reported that it failed to determine the entity behind the distribution of the malware. But the letters "whois" appearing within the Internet Protocol address of FileFixPro.com suggests the site is hosted at domain name ThePlanet and bears its registration to some Ukrainian organization, said Alex Lanstein, malware Researcher at FireEye, as reported by DarkREADING on March 25, 2009.

Security experts state that rogue software are on the rise. Recent statistics from Anti-Phishing Working Group (APWG) show that fake anti-malware applications rose from a count of 2,850 to 9,287 over July-December 2008.

Related article: Hackers Redirect Windows Live Search to Malicious Sites

» SPAMfighter News - 4/2/2009