New malware attempts legitimacy by spreading phony reviews
It's always interesting to watch what little hooks and schemes the malware industry has cooked up in an attempt to better bait the public and the new Anti-Virus-1 package doesn't disappoint. AV-1 is a cute mixture of scareware and malware, and while we've seen XP Antivirus playing this turf for years, AV-1 adopts a few new tactics of its own. Once run, the program installs its particular Trojan of choice (Zlob and Vundo are apparently popular options), then makes certain modifications to the hosts file.
BleepingComputer.com has assembled a list of these changes, a sample of which is included below. If a user attempts to visit any of the links listed, he or she is directed to a site under the control of the botnet controllers.
Once redirected, users are served up with what appears to be an actual, legitimate review of Anti-Virus-1 from a reputable source. These reviews appear to be thinly-veiled rips of what has been written about actual anti-virus scanners-in BleepingComputer's
:
