Not even security managers immune to FakeAV infection

This insidious malware is hard to root out, which is why it's making a lot of money for its distributors

Can you believe it? As I sat down this morning to write this column, I got hit by a drive-by download of FakeAV.

My computer is infected with pop-up warnings and file scans telling me I have security problems, and Internet Explorer has been hijacked to keep sending me to a website where I can "purchase the software." Pop-ups are coming from my taskbar, showing up in the middle of the screen, and rifling through my files with a fake scan. My computer is being held for ransom.

How did this happen? And what am I going to do about it? I mean really, as a security manager you'd think I would be immune to this kind of problem. My antivirus software is up to date and actively scanning, and my system is fully patched. That's more than most people are doing. Fortunately, I also have current backups (more on that in a minute).

I wrote that a week ago. As it turned out, I had to do a lot more work to get rid of this infection than I anticipated.

I started with some research on what FakeAV is all about. I've been hearing a lot about it through word-of-mouth, and now I'm getting firsthand experience. According to Sophos, FakeAV is a rapidly growing threat on the Internet, mainly because it's profitable to the people who wrote and distributed it. Evidently, a lot of people are being tricked into sending money to these criminals to get back control of their computers. I hate to think how many people are being fooled by this malware into thinking it's a legitimate security scan. It would be a lot easier to just send them the money to get back control of my system. But I'm not going to let these guys win.

This is clearly a very advanced program. It looks exactly like the real Windows Security Center. It appears to be professionally programmed, with none of the crashes or bugs prevalent among more pedestrian malware.

Sophos says there are so many variants being released constantly that it can be difficult to detect using traditional signature-based antivirus, which is what I have. Even with the latest updates, the newest variants can get through. Some variants are also employing polymorphic code, which changes itself so frequently that the MD5 hashes used by antivirus programs cannot be effective. Well, that explains how I got it despite having a good, up-to-date antivirus product.

Earlier versions of FakeAV required the user to say "Yes" to something, such as a fake video codec installation to play a video or a fake Flash player update. Some even use the old-fashioned, tried-and-true technique of attaching the installer to a spam email notifying users of a password reset, package delivery or IRS refund, which I see a lot of at the office. But none of these is how I got infected. I was searching on Google. Search terms are being "poisoned" on Google. When an unsuspecting victim clicks on what seems to be a legitimate page, he is brought instead to a compromised website where the malware is lurking in an image or JavaScript code. When I'm searching on Google, I use CTRL-click to open interesting results in a new tab in Internet Explorer Version 8 (fully patched). Last week, when I did this, one of the pages I opened must have contained the JavaScript or image version. It opened in a new tab, where I left it for later viewing, and it infected my system. Pop-ups appeared, all my browser sessions closed, and my antivirus programs were disabled. This is what's known as a "drive-by download."

Now that I know what I'm up against, I tried running three different antivirus and malware-cleanup utilities I already have on my system. None of them worked. In fact, they wouldn't even start. I then tried killing the malicious process, but I couldn't find it (it's well hidden). I did find an entry in the system registry to run the malware installer on reboot, but when I deleted that, it was back after the next reboot. Next, I tried to boot into safe mode, and that's when my computer went completely dead. It wouldn't boot at all. Even booting from the operating system CD didn't work.

As it turns out, this malware went really deep. Not only did it infect Windows, but it also inserted itself into Safe Mode. Usually, we can boot into Safe Mode to run a virus scan, but not this time. In fact, I discovered that the malware actually got into my system BIOS. That's right, it went so deep it actually got into my hardware. Even a BIOS upgrade didn't get rid of it.

In the end, I had to disconnect my CMOS battery for a day to clear the BIOS, completely reinstall Windows and restore from backup. Unfortunately, during my initial restore attempts, the system crashed in the middle of the restore process, which corrupted my backups. I lost my two most recent backups that way, so now I'm running on a six-month-old version. So there was collateral damage.

I'm not the only one with this problem. A few days after I got infected, my kids' computer also got hit with a variant called "XP Security Center." And the same day my infection happened, my company's desktop services manager got a version called "Windows Defender" on his work computer.

I hope you take this as a warning. Nobody is safe anymore from malware, now that it's being professionally and competently developed. Make sure your backups are current, and spread the word to unsuspecting users that any unexpected "Security Scans" require immediate response.

This week's journal is written by a real security manager, "J.F. Rice," whose name and employer have been disguised for obvious reasons. Contact him at

To join in the discussions about security, go to

Join the PC World newsletter!

Error: Please check your email address.

Tags securityscams

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

J.F. Rice

Computerworld (US)
Show Comments

Most Popular Reviews

Best Deals on PC World

Latest News Articles


GGG Evaluation Team

Kathy Cassidy


First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni


For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell


The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi


The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott


My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?