As the anniversary of the horrible September 11 attacks in The United States approaches, Trend Micro researchers donned their research coats and waited for the people behind FAKEAV to make their move. Predictably, they did not disappoint.
Through SEO poisoning, users searching for any reports related to September 11 may find themselves stacked with Google search results that lead to a rogue AV malware detected by Trend Micro as TROJ_FAKEAV.BOH.
Figure 1. Poisoned Google search results
As shown in the image above, TROJ_FAKEAV.BOH may arrive on the system as Scanner-7c545a_2031.exe from several malicious Web sites that can all be found in the poisoned Google search results.
Trend Micro users are already protected from this threat, as the malicious file(s) are already detected and the download links are already identified and blocked by the Web Reputation Service.
The people behind FAKEAV still show no sign of slowing down. With the holiday season coming up, users are also advised to refrain from visiting unknown sites returned in Search Engine results and rely on reputable news agencies instead.
If you're new here, you may want to subscribe to our RSS feed. Thanks for visiting!
September 11th, 2009 at 6:19 am
I was waiting to see this kind of news in different blogs, as always at these dates, attackers are ready to strike!
September 14th, 2009 at 12:58 pm
http://www.infowars.com/internet-security-software-company-says-911-searches-infected-with-malware/