Blackhat SEO and Fake anti-virus – Like chocolate and peanut butter

Published by pratyushkp on May 26th, 2011 - in Social, Technology

Image via Wikipedia

Original Article posted on

Author Name – Chester Wisniewski

It’s not exactly a new story that people are being hit hard by fake anti-virus, but I want to draw attention to the sophistication of their software and distribution methods.

Many IT professionals I work with have had to clean up after these infections, and equally as many blame their users for being stupid for getting infected. As a researcher, I know this is not necessarily the case. Certainly, some people make ignorant mistakes clicking links and opening attachments, but many of these attacks are convincing enough that simple computer security advice is not enough to protect users from them.

I just came across another instance of a long running spam campaign pretending to be a message from the user’s ISP telling them to run a file from a web link to update their email program settings. The download led to a fake anti-virus variant that was very realistic.

Dear Customer,

This e-mail was sent by to notify you that we have temporanly prevented access to your account.

We have reasons to beleive that your account may have been accessed by someone else. Please run this file and Follow instructions:


This particular payload behaved much more like a real anti-virus product than ever before. It actually detected my installation of Sophos Anti-Virus and prompted me to uninstall it!

Most fake anti-virus I have run into is distributed through blackhat SEO poisoning. I recently put together a video showing how scammers are gaming Google and Bing to distribute this malware in ways your users may not expect.

(Enjoy this video? You can check out more on the SophosLabs YouTube channel and subscribe if you like)

black hat

Aside from its sophistication in trying to remove our product as well as being distributed through an email, today’s sample of fake anti-virus looks and behaves like most others. It has an annoying habit of rebooting your workstation every 15 minutes or so.

To help educate both professionals and end users we have put together some materials on the 10 myths of safe web browsing. This includes some papers, a link to the video above, and a widget you can deploy on your Intranet that helps train users on safer internet usage.

  • Apple finally admits to Rogue anti-Virus problems (
  • Self Defense – Sophos Anti-Virus (
  • Mac fake anti-virus attack adopts new disguise (
  • Fake Mac Defender ‘Anti-Virus’ For Macs On The Loose (
  • Remove Fake Anti Virus Immediately ? Secure Your Pc With Best Anti … (
  • Mac needs AntiVirus? (
  • Run your anti-virus program. (
  • Free Sophos Anti-Virus for Mac: ‘Frankly there’s no reason not to try it’ (
  • Free anti-virus for Mac named Best Anti-Malware solution at SC Awards (
  • Mac users hit with Fake AV when using Google image search (


Powered by Facebook Comments

8 Responses

  1. [...] Blackhat SEO and Fake anti-virus – Like chocolate and peanut butter ( [...]

  2. [...] Blackhat SEO and Fake anti-virus – Like chocolate and peanut butter ( [...]

  3. [...] Blackhat SEO and Fake anti-virus – Like chocolate and peanut butter ( [...]

  4. fresh water says:

    I would love to hear all that you know with regards to this subject matter. You have only scratched the top of your knowledge about this and that’s apparent in the way you write. Have you thought about devoting a whole web site in order that others will not miss everything you have to say?

  5. filtered water says:

    Your skill to write about this sort of info is exactly what every one of us want. By simply revealing your knowledge you support others through revealing your own private information. And I’ll inform you now your article helped me personally.

  6. MRSA treatment says:

    You could not go into extreme detail, however, you presented components I need to to get me started. Your blog notified me to thinking that I had previous skipped. Should you continue blogging I do believe you’ll be a power in this particular area.

  7. MRSA treatment says:

    Your focus on this particular fundamental degree of knowledge further than the strategy that almost all experts present. If you are trying to find started with a venture this really is the info that is needed. I’m hoping for an additional write-up around these lines soon!

  8. Kimberly says:

    Are you making this up as you go along?

Leave a Reply to IMF boss rape video? Mac malware spreads via Facebook links Cancel reply

Your email address will not be published. Required fields are marked *


You may use these HTML tags and attributes:

© Social Media Blog