Apart from SEO poisoning, cybercriminals have found another avenue to proliferate FAKEAV malware—bogus sponsored links (sitio patrocinados in Spanish). Just recently, Trend Micro researchers were alerted to malicious search engine ads that appeared in Microsoft’s Bing and AltaVista, among others, when a user searches the string “malwarebytes.” (Malwarebytes is a free antivirus product, but of course, not a FakeAV.) Clicking the malicious URL points the user to an executable file named MalwareRemovalBot.exe-1 (detected by Trend Micro as TROJ_FAKEAV.DMZ).
Figure 1. Malicious banner ad on Bing
Figure 2. Malicious banner ad on AltaVista
Upon execution, the rogue antivirus displays false information that the system is infected with files that do not even exist.
Figure 3. Fake scan results
In the past, cybercriminals employed the same tactic when it hitchhiked on Trend Micro. Some Google searches then showed banner ads that led to a fraudulent Trend Micro website.
Though the ads may not appear in all regions, all users are still strongly advised to be extra careful when clicking links in search engines. Users connected to the Trend Micro Smart Protection Network are protected from this attack as it detects and blocks all malicious URLs.
If you're new here, you may want to subscribe to our RSS feed. Thanks for visiting!
September 24th, 2009 at 5:10 pm
I hope that twitter sees this post! I’ve been trying to get links to Malware Removal Bot removed from twitter for what feels like forever.
Thank you for your research
/Bev
September 29th, 2009 at 9:23 pm
FakeAV malware authors usually maximizes the use of social engineering to deceive users effectively.