Fraud Theft by Rouge Anti-Virus Software

Fraud theft has many faces – none of which are pretty – but perhaps the most insidious is that of Rouge Anti-Virus Software scams.

One of the newest virus threats online comes to your computer as a true “wolf wrapped in sheep’s clothing.” System Tool 2011, and other such malware, is being e-mailed to computers all over the world, causing damage and bilking its victims out of hundreds of dollars.

The Scam

Unless you work, live, and breathe for computers, you probably aren’t familiar with online theft information regarding the term “rogue” anti-virus software until you become a victim. This is not optimal way to learn about the deleterious effects it can have on your computer and bank accounts.

Rogue anti-virus software is spread over the Internet the same way other viruses are: in e-mail attachments, as a part of a shareware software bundle all with the help of a Trojan. (Trojans are software packets that sneak inside your hard drive hiding within another download, much the same way the actual warriors hid inside the horse.) One of the most successful, and most damaging, of these rogue anit-virus programs is System Tool (also known as systemtool and System Tool 2011).

Rogue anti-viruses have no affinity for malware, Trojan, or other harmful programs’ removal because they are in and of themselves malware. Their real and only purpose is theft fraud by capturing your credit card information under false pretenses. This qualifies rogue virus software as identity fraud theft scams at their finest.

How it Works

Once inside your computer, System Tool, or any other rouge anti-virus program, springs into action without your knowledge or consent. It self-installs and plants its malignant files deep within your registry. It sets itself to begin on your computer’s start up.

The next time you turn on your computer you will be greeted with a legitimate-looking scan results screen listing the many programs System Tool has detected within your computer. The list is fake – a scare tactic to motivate you to click the removal button option.

Once you click the remove button, a message will prompt to you to activate your account or subscription. To do this you need to pay for a one, two, or lifetime subscription option. To keep you motivated, new messages are popping up all the while proclaiming new infestations, infected files, and other damages needing repair.

Don’t fall for it. The messages are fake. The infections are fake. The computer scan results are also fake. They are all part of System Tool’s design to entice you to impart of your credit card information willingly. This program is a virus itself, so it will not do anything but mess up your computer and then take your money and run.

Recovery

First off, if you have paid for System Tool (now that you are wiser), call your credit card company and dispute the charges.

The next step is getting it off of your computer. This can be tricky because part of the programming is aimed at keeping itself alive inside your hard drive by blocking attempts to remove it. Legitimate virus removal software does not always recognize and remove it because the malware looks like real anti-virus software.

To be certain you are rid of System Tool, you will most likely need the help of an experienced computer wiz, a visit from the Geek Squad, or someone similarly qualified.

The process of starting the computer in safe mode and sifting through real system files from fake ones will be simple for them but difficult and dangerous for a novice.

Malware Posing as Fake Desktop Utilities Instead of Phony Antivirus

In the past two months, fake anti-virus scareware has morphed into variants pretending to be generic security products, disk utilities and the trusty defrag tool, according to researchers.

Recently, researchers at GFI Software have noticed an increase in the number of fake security software scams purporting to be disk utilities that fix disk errors. Instead of listing Trojans, these security alerts pretends to find disk fragmentation or file system integrity problems.

“Fake AV authors have added a new branch to their rogueware business,” Desai said. He expects to see more variants of both fake anti-virus and utilities in the coming months.

The rogue products initially looked like a generic security product, addressing a range of system issues with names like HDDDDiagnostic, PCoptomizer and Privacy Corrector, according to GFI. Since then, there’ve been a series of “defragger clones” with names like UltraDefragger and ScanDisk that claim to find read/write errors on the hard disk drive, according to the blog.

The fake disk defrag and scanning utilities started showing up in mid-October, according to Deepen Desai, senior researcher from SonicWALL’s threats team. He noted that new variants are often “A/V resistant” because legitimate security products may not be able to immediately identify the files as fake. Rand Abrams, director of technical education at ESET said these variants are “not yet as popular as they will become.”

Scareware refers to software that displays legitimate looking pop-up windows and dialog boxes claiming serious problems with the user’s computer. Often posing as anti-virus or anti-spyware software, the messages list several malware infections and scare the user into purchasing anti-virus software immediately to fix the problem. Some known variants mimic Microsoft Security Essentials or McAfee, while others have real-sounding names such as Security Tools or Pest Detector.

Fake utilities are generally marketed differently from fake A/V, said Larsen. The potential victim is generally already searching for a disk utility or trying to resolve an issue when the scammer says, “’Here’s what you were searching for,’ and hand them a malware payload instead,” said Larsen.

Users should be wary of any error messages coming from software they didn’t install, and should not purchase or install any software that suggests downgrading the Web browser to an older version, according to GFI Software’s researchers.

There are even some variants that detect legitimate anti-virus software and prompt users to uninstall it, according to Sophos researcher Chester Wisniewski.

Avira AntiVir Personal: Great Malware Protection

Avira AntiVir Personal ranked second in our late 2010 roundup of free antivirus products. AntiVir did a great job at detecting and blocking malware.
AntiVir Personal is nearly identical to its paid counterpart, AntiVir Premium 2010: Both have nearly identical interfaces and installation processes, so the real difference between them is the feature set.
The Status tab gives a basic overview of whether you're protected and up-to-date, though it doesn't really give too much detail. Most buttons are not labeled, and the button icons are not always immediately detectable, so you'll have find them for a tooltip describing what they do. Avira is a German import, and some of the wording in dialog boxes feels awkwardly translated. The overall feeling I got from AntiVir Personal's interface is that, while it's serviceable, it feels geared toward more advanced PC users.
Avira put up very good scores for malware detection. AntiVir Personal detected 99 percent of malware samples in scanner-based detection tests that predominantly rely on malware signature files, which was one of the better showings in this test among the free antivirus products we tested. And in the blocking of actual, real-world malware attacks, AntiVir personal completely blocked 80 percent of attacks, which puts it slightly above the average of the products we tested. It partially blocked an additional 5 percent of attacks.
Avira also but up decent scores for malware cleanup. It detected all infections on the test system, and was successful in removing all active components of an attack 70 percent of the time (right around average), and removed all malware components 30 percent of the time (also about average).
On the negative side, AntiVir Personal, along with Comodo's free Internet Security Premium, had the most false positives--six--of the free antivirus products we looked at. As a percentage, this number is still low--it was .004 percent of files scanned, and they were all non-operating-system files, but any false positive can be a hassle. That said, only one free product we tested--Avast Free Antivirus--achieved a perfect false positive score.
AntiVir Personal's scan speeds were impressive as well--it completed an on-demand scan of 4.5GB of data in 87 seconds, the best finish of the free antivirus products we looked at. Its on-access scans were also quite fast: It finished the test in 4 minutes, 7 seconds, well below the average time of 2 minutes, 50 seconds. The on-access scan is a good indicator of how quickly an antivirus program will be able to scan files for malware as they're opened or saved to disk. In addition, AntiVir Personal's impact on overall system performance was low, and it added a mere 2.5 seconds to system startup in our tests--the average product added over 4 seconds to startup time.
AntiVir Personal, like Avira's other products, has been a strong contender in the past, and this latest version continues that trend. But we'd like to see Avira make some improvements to its user interface.