Home > Security

Computerworld - Can you believe it? As I sat down this morning to write this column, I got hit by a drive-by download of FakeAV.

My computer is infected with pop-up warnings and file scans telling me I have security problems, and Internet Explorer has been hijacked to keep sending me to a website where I can "purchase the software." Pop-ups are coming from my taskbar, showing up in the middle of the screen, and rifling through my files with a fake scan. My computer is being held for ransom.

How did this happen? And what am I going to do about it? I mean really, as a security manager you'd think I would be immune to this kind of problem. My antivirus software is up to date and actively scanning, and my system is fully patched. That's more than most people are doing. Fortunately, I also have current backups (more on that in a minute).

I wrote that a week ago. As it turned out, I had to do a lot more work to get rid of this infection than I anticipated.

I started with some research on what FakeAV is all about. I've been hearing a lot about it through word-of-mouth, and now I'm getting firsthand experience. According to Sophos, FakeAV is a rapidly growing threat on the Internet, mainly because it's profitable to the people who wrote and distributed it. Evidently, a lot of people are being tricked into sending money to these criminals to get back control of their computers. I hate to think how many people are being fooled by this malware into thinking it's a legitimate security scan. It would be a lot easier to just send them the money to get back control of my system. But I'm not going to let these guys win.

This is clearly a very advanced program. It looks exactly like the real Windows Security Center. It appears to be professionally programmed, with none of the crashes or bugs prevalent among more pedestrian malware.

Sophos says there are so many variants being released constantly that it can be difficult to detect using traditional signature-based antivirus, which is what I have. Even with the latest updates, the newest variants can get through. Some variants are also employing polymorphic code, which changes itself so frequently that the MD5 hashes used by antivirus programs cannot be effective. Well, that explains how I got it despite having a good, up-to-date antivirus product.

Earlier versions of FakeAV required the user to say "Yes" to something, such as a fake video codec installation to play a video or a fake Flash player update. Some even use the old-fashioned, tried-and-true technique of attaching the installer to a spam email notifying users of a password reset, package delivery or IRS refund, which I see a lot of at the office. But none of these is how I got infected. I was searching on Google. Search terms are being "poisoned" on Google. When an unsuspecting victim clicks on what seems to be a legitimate page, he is brought instead to a compromised website where the malware is lurking in an image or JavaScript code. When I'm searching on Google, I use CTRL-click to open interesting results in a new tab in Internet Explorer Version 8 (fully patched). Last week, when I did this, one of the pages I opened must have contained the JavaScript or image version. It opened in a new tab, where I left it for later viewing, and it infected my system. Pop-ups appeared, all my browser sessions closed, and my antivirus programs were disabled. This is what's known as a "drive-by download."