Fake AV scammers impersonate Microsoft

Cyber scammers continue to impersonate Microsoft and try to trick users into believing that their computer is serious need of an AV solution.

Webroot researchers have spotted an active campaign that involves an ever-rotating slew of websites sporting a warning mimicking a Microsoft Security Essentials alert:

“There are a number of ways to figure out that this is a false alert,” the researchers point out. “The first is that it’s a website message and not a program; the second is that location of the web site will be a random string of letters.”

Still, there are users who will fall for it and press the “Clean computer” button, and end up downloading an executable that currently drops a fake malware removal tool (“XP Security Cleaner Pro”) on the victim’s computer and several more malicious files

The fake AV then flags innocuous software as malware and asks user to pay for its removal.

The researchers believe that potential victims are redirected to the fake web pages via malicious ad links. The pages stay active for 24-48hrs before being pulled down, and currently lead to fake AV, but the payload can be changed by the crooks at will and at any moment.

If you’re faced with one of these pages, closing it without clicking on it will allow you to avoid being infected. If you have downloaded the malware, you will have to use a legitimate tool to remove it from your system (more experienced users can do it manually).