Advisory - Fake Antivirus Malware
C&C wishes to advise clients of a recent increase in fake antivirus malware spreading via the web. The user experience will vary depending on the variant encountered, but in general a pop-up window will appear and falsely advise the user that they are "infected" with one or more viruses; further pop-ups will then prompt the user to download and install additional software in order to "disinfect" themselves. Filenames seen to date include "freesystemscan.exe" and "bestantivirus2011.exe", but different filenames can be expected as these become well known. Clients installing either file will experience further pop-up windows crafted to look like Microsoft's built-in "Windows Security Centre", but instead named "Windows Stability Centre", "Windows Expansion System", or similar. If the fake malware scan is allowed to run to completion, a final pop-up window will prompt the user to enter their credit card number in order to enabled the fake software's "disinfection" features.
Clients are advised that the version of McAfee VirusScan that is approved for use on the St John's campus will *never* prompt for credit card information. Clients experiencing any of the above or having questions or concerns about this notification should contact the C&C Service Desk at 864-4595 or firstname.lastname@example.org for assistance.