Last month we reported that the developer of so-called antivirus products called Anti-Virus-1 and Antivirus 2010 was convincing users to install the software, which then led them to fake sites that use web addresses closely resembling the URLs of legitimate websites such as PC Advisor.
When Anti-virus-1 or Antivirus 2010 are installed, they add a series of entries into the Windows hosts file which direct users to fake reviews on copycat sites. Only those who have downloaded the tools in the first place will see the bogus reviews, however.
Now Bleeping Computer is warning users about a new variation called Anti-Virus Number 1. It uses exactly the same methods as its predecessors, but the tech website has revealed a few more details of how it convinces those who download it that it's legit antivirus software.
"Once installed, Anti-Virus Number 1 will be configured to run when Windows starts," the site says. The software then scans your computer and displays scan results that are scripted to be the same regardless of the computer it runs on. "Whatever Anti-Virus Number 1 shows during its scans should be ignored as the program was designed to always show those results no matter how clean your computer is. It does this to scare you into thinking you are infected in the hope that you may purchase the program."
The text of some of these alerts include 'Internal conflict alert' and 'Privacy Violation alert!'
These scareware tools are spreading across the web, so beware of antivirus products you've not heard of before. Run a Google search to check up on the company providing the software and, if in doubt, use the PC Advisor forums to see which security tools other users vouch for.