Viruses/Worms News

Fake antivirus malware used to ransom hijacked PCs

Thursday, October 15, 2009

Cybercriminals who spread malware in the form of phony antivirus products - called rogueware or scareware - have begun blocking user access to files on hijacked PCs until users purchase the antivirus program, security researchers at PandaLabs reported.

The so-called ransomware locks down user access to documents and files and issues pop-up warnings that the PC is infected by malware and informs victims that the only solution is to purchase the fake antivirus product.

PandaLabs spotted a fake AV product called Total Security 2009 using this new technique. Users who pay $79.99 for the phony product receive a list of serial numbers to have their PCs released, but the malware remains on their PCs.

Users are also blocked by the malware from visiting legitimate antivirus vendor websites or using any type of detection or disinfection tool, said PandaLabs technical director Luis Corrons.

"The way this rogueware operates presents a dual risk: First, users are tricked into paying money simply in order to use their computers; and second, these same users may believe that they have a genuine antivirus installed on the computer, thereby leaving the system unprotected," Corrons said.

Users can become infected by fake antivirus rogueware by visiting hacked websites. The program usually hijacks a user's web browser with warnings that the PC has become infected by malware.