Fake antivirus peddlers helped by Microsoft, IRS

Scammers are back two weeks after the FTC shut down two major fake antivirus software sellers.

Just weeks after the U.S. Federal Trade Commission shut down two companies accused of selling fake antivirus software, a new player has moved into the market, aided by glitches in the Microsoft and U.S. Internal Revenue Service Web sites.

Over the past four days the scammers have used so-called redirector links on Web sites belonging to magazines, universities and, most remarkably, the Microsoft.com and IRS.gov domains, said Gary Warner, director of research in computer forensics with the University of Alabama at Birmingham, who first reported the activity on his blog Tuesday.

Many Web sites use redirector links to take visitors away from the site, although the Web site operators try to stop them from being misused by scammers. For example, the Google URL http://www.google.com/search?q=idg&btnI=3564 uses Google's "I'm feeling lucky" feature to send Web surfers to IDG.com.

If criminals can use a redirector on a major Web site like Microsoft.com or IRS.gov, however, they can make their malicious links pop up very high in Google search results, Warner said in an interview.

"Microsoft is a super-powerful site as far as search engine weight is concerned," he said.

The bad guys have tricked search engines into returning their malicious links to tens of thousands of search terms, Warner said. They've done this by using special software to add these redirector links to "tens of thousands of blog comments, guestbook entries, and imaginary blog stories all around the Internet," Warner said in his blog posting.

You can see the results of this activity. A Google search for the term "Microsoft Office 2002 download" yields a Microsoft.com redirection link as its first result. That link had been redirecting visitors to a malicious Web site, which launched Web-based attack code against victims and tried to trick them into downloading fake antivirus software, Warner said. By Tuesday evening, Microsoft had fixed the problem, so the Microsoft.com link that pops up in the google search results was no longer taking surfers to the malicious Web site.

The IRS has now addressed the issue too, but about 20 other sites remain a problem Warner said.

The fake antivirus software, also called "scareware," installs a keylogger on the victim's computer, presumably to steal login names and passwords, and also launches fake warning popups on every Web page that the victim visits telling him he needs to buy antivirus software, called System Security. The price for the fake product? A believable-sounding $51.45.

The FTC estimates that 1 million consumers were taken in by other fake antivirus products which go by names such as WinFixer, WinAntivirus, DriveCleaner, ErrorSafe and XP Antivirus. On Dec. 10 a federal court ordered two companies, Innovative Marketing and ByteHosting Internet Services, to stop promoting these products.

Warner doesn't know who is behind System Security, but he believes that the scammers behind this latest operation may be connected to the earlier scams. "It's similar enough that it's got to be somebody who has a relationship with the last group," he said.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Cool Tech

Bang and Olufsen Beosound Stage - Dolby Atmos Soundbar

Learn more >

Toys for Boys

Sony WF-1000XM3 Wireless Noise Cancelling Headphones

Learn more >

Nakamichi Delta 100 3-Way Hi Fi Speaker System

Learn more >

ASUS ROG, ACRONYM partner for Special Edition Zephyrus G14

Learn more >

Family Friendly

Philips Sonicare Diamond Clean 9000 Toothbrush

Learn more >

Mario Kart Live: Home Circuit for Nintendo Switch

Learn more >

Stocking Stuffer

Teac 7 inch Swivel Screen Portable DVD Player

Learn more >

SunnyBunny Snowflakes 20 LED Solar Powered Fairy String

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?