Threat Level: green Handler on Duty: Rob VandenBrink

SANS ISC: InfoSec Handlers Diary Blog - SANS Internet Storm Center InfoSec Handlers Diary Blog

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Fake antivirus 2009 and search engine results

Published: 2008-09-15
Last Updated: 2008-09-16 01:15:04 UTC
by donald smith (Version: 1)
1 comment(s)

Web servers have been compromised and their .htaccess files have been modified.

Here you can see an example of a modified .htacces

"# RewriteEngine On
# RewriteCond %{HTTP_REFERER} .*google.*$ [NC,OR]
# RewriteCond %{HTTP_REFERER} .*aol.*$ [NC,OR]
# RewriteCond %{HTTP_REFERER} .*msn.*$ [NC,OR]
# RewriteCond %{HTTP_REFERER} .*altavista.*$ [NC,OR]
# RewriteCond %{HTTP_REFERER} .*ask.*$ [NC,OR]
# RewriteCond %{HTTP_REFERER} .*yahoo.*$ [NC]
# RewriteRule .* [R,L]
# Errordocument 404

Another site that was compromised and searches redirected is discussed here:

I don't know how the systems are being compromised at this point.

I modified the names of the sites in use below substituting 3 for e to prevent further search engine hit increases:)

Their .htaccess is being modified to rewrite requests. Specifically they
are redirecting to sites that "advertise" antivirus2008 or antivirus2009 when several search engines try to spider the original site.
They redirect most of the search engines there (google, yahoo, altavista...).
I believe that is how they are getting their fake av into the search engines with a HIGH hit rate.

The site I was seeing in use was int3rn3t-d3f3ns3s .com
Which is an "ad" for anti-virus2009. Here is the "scary text" from
freescan.php that is being used to convince victims to load this fake-av software.

 "ATTENTION! If your computer is infected, you could suffer
data loss,erratic PC behaviour, PC freezes and crashes.

Detect and remove viruses before they damage your computer!
Antivirus 2009 will perform a quick and 100% FREE scan of your computer for Viruses, Spyware and Adware.

Do you want to install Antivirus 2009 to scan your computer for malware now? (Recommended)

'Antivirus 2009 will scan your system for threats now.

Please select "RUN" or "OPEN" when prompted to start the installation.

This file has been digitally signed and independently certified as 100% free of viruses, adware and spyware." is at I recommend blocking that at your enterprise gateway.
Prt3ctionactiv3scan .com which is mentioned in the sunbelt blog is at blocking that
at your gateway is also recommended.

There is a blog here about some of these fake av sites.
Microsoft mvp Harry Waldron blogged about it here.
The popups they use are so convincing that the daughter of fellow handler Deb Hale installed the 2008 version of it.
Sunbelt did a good write up of it here and has been tracking the sites involved.
If you need antivirus software icsa labs has a useful collection of valid links here:$3d83e732-011a28d6$5ac9-0f77e15b

1 comment(s)
Diary Archives