Paranoia and the rise of fake antivirus
Summary: Cisco Talos describes a fake antivirus scam in which a program called Block Watcher told a user her machine was infected and pushed a $30 product to clean it, and a site offered as a removal tool, removal-tool.com, was itself delivering malware. Talos ran the executable through ThreatExpert, which showed it created files and registry entries and opened UDP port 1053, a back door indicator, and cites a Symantec report of roughly 43 million attempts to install fake antivirus software between July 1, 2008, and June 30, 2009.
Bottom line: Roughly 43 million attempted fake antivirus installs in a single year means the users on your network are the delivery path, and Talos notes McAfee's SiteAdvisor rated removal-tool.com as clean even though 11 of 17 user reviews on McAfee's own page flagged it for adware, spyware, or viruses.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026