What is a fake antivirus?

11 May 2024 8 minutes Author: Cyber Witcher

Threats associated with rogue antivirus-type programs, also known as scareware, are revealed. It details how rogue programs, masquerading as legitimate antivirus solutions, mislead users through pop-ups with fake virus warnings and offer to buy useless programs to “solve” non-existent problems.

What is a fake antivirus?

Scareware is a malicious program that tricks users into visiting infected websites. Fake antiviruses, also called rogue programs, rogue antiviruses, or pseudo-viruses, can appear as pop-up windows that look like warnings from real antivirus solutions from well-known manufacturers. These windows contain messages that the computer files are infected. They are so thoughtfully designed that under the influence of fear, users are ready to immediately purchase a program that will solve the so-called problem. However, the computer ends up with a fake antivirus program that is actually malicious and designed to steal personal data.

Criminals also use other methods to distribute fake antiviruses, such as spam. The content of such emails deceives users into purchasing useless services, and the disclosure of credit card information is an opportunity for future crimes, including identity theft.

How does fake antivirus work?

Fake antiviruses will usually work according to a certain pattern. Pop-up windows suddenly appear, warning that dangerous files or pornographic materials have been detected on the computer. They appear until you click on the button “Remove all threats” or until you register to use an antivirus program. Scam pop-ups look like real warnings. When using social engineering tactics, fake antivirus pop-ups often:

  • Logos of real antivirus programs and similar names are used.

  • A screenshot of the allegedly infected files on the computer is displayed.

  • A progress bar is displayed to show that the verification process is in progress on your computer.

  • Contains flashing red images.

  • Capital letters and exclamation marks are used to warn that immediate action is required.

This tactic is designed to incite panic and fear in users; it forces them to make quick rash decisions and tricks them into taking the following actions:

  • Buying useless software.

  • Downloading different types of malware.

  • Visiting websites that automatically download and install malware on users’ devices.

Authoritative developers of antivirus solutions do not demand data using intimidation tactics. The more persistent and attention-grabbing these warnings are, the more likely they are from a fake antivirus. But criminals play on the ignorance of many users.

If you clicked Yes, Download, or Protect Your Computer and entered your credit card information in the “Virus Detected” popup, one of two things might happen:

At best, it will be a waste of money and the installation of a useless program that does not solve the problem on your computer, but also does not harm it.

In the worst case scenario, criminals can use your credit card and personal information to steal funds and personal data, or even grab the contents of your hard drive and demand a ransom.

Signs of a fake antivirus

If you think you’ve fallen victim to a fake antivirus scam, look out for the following signs:

  • Numerous notifications and banners on the device screen. Fake antivirus pop-ups, often containing text in capital letters and exclamation marks, are designed to cause panic by warning of critical security breaches.

  • Decreased productivity. A computer infected with malware typically experiences slowdowns, crashes, and freezes. The goal of malware is to prevent these problems from being solved.

  • Unknown apps and features. A new shortcut for an unfamiliar program may appear on your desktop, or your browser may display new toolbars and a new home page. This may force you to download new rogue apps.

  • Unable to access programs and files. For example, you may see unusual error messages or blocked paths.

  • Scroll through the ad. Some banners may contain malicious ads. This is an ad with embedded code that downloads malware onto your computer. It is recommended to always search and verify the product names, and not to go through advertising banners, the safety of which you are not sure.

Examples of the spread of fake antivirus

Below are some typical examples of fake antiviruses.

  • Websites or pop-ups with fake antiviruses. This is one of the most common forms of fake antivirus, often found on websites that promote themselves on social media, such as Facebook. The pop-up ad is a warning from the antivirus program. Its purpose is to trick users into believing they have malware installed on their computer or smartphone and convince them to click on a link to download a “fix”. In fact, the link is a Trojan: instead of an antivirus, it downloads a malicious program capable of causing harm.

  • Emails containing fake antivirus. In this case, the attackers send an “urgent” email demanding that certain actions be taken immediately. Often, an email uses a fake sender address or domain to make it look like it’s from a trusted source. An email containing a fake antivirus may ask you to follow a link to download an antivirus and remove a specific threat, or to provide access information so that “technical support” can fix the problem.

  • Fake Antivirus Technical Support Calls. Strictly speaking, this is not a fake antivirus itself, as there is no malware involved in this type of scam. However, such calls are aimed at scaring the user into giving the attackers personal information or access to sensitive systems. As a rule, criminals call, pretend to be employees of the technical support service or law enforcement agencies, and claim that “suspicious activity has been observed on your computer.” They then try to convince the user to grant them remote access to the computer or account. The attackers then use the obtained access data for fraud.

Many fake antiviruses copy the interface elements of real security programs and use names that sound similar to the names of existing programs. Examples of fake antiviruses and antivirus solutions:

  • SpySheriff

  • XPAntivirus/AntivirusXP

  • ErrorSafe

  • Antivirus360

  • PC Protector

  • Mac Defender

  • DriveCleaner

  • WinFixer

  • WinAntivirus

An example of a fake antivirus that affected an insurance agent in the US was published in the news. In 2020, he lost over $2,000 to a fake antivirus scam that started with a computer attack and ended with a phone call. He paid the attackers directly to “fix” the problem on his computer, then had to pay again when the attackers triggered another malware attack.

How to remove fake antivirus and minimize damage

Turn off the computer and contact an IT professional.

An IT professional can connect your hard drive to another computer and scan it for malware without running the operating system. This will prevent malware from running and causing more problems.

  • Turn off your Internet connection. Turning off your Wi-Fi or router will help prevent malicious software from sending your data to attackers.

  • Change your passwords at the first opportunity. Start with the password from the primary email account to which the other services are linked. It’s also important to change the password for your online banking accounts, especially if you suspect your credit card information may have been compromised.

How to prevent fake antivirus? Seven recommendations

Currently, fake antiviruses for iOS and Android are spreading, so it is important to be vigilant when working on different platforms and operating systems. Practicing cyber hygiene is the best way to prevent fake antivirus scams from windows and Google viruses. To do this, you can do the following:

  1. Do not click on malware messages. Pop-ups, banners, and computer infection warnings that suggest downloading security programs are most likely scams. Do not click on them.

  2. Beware of unintended downloads. To remove rogue pop-ups, close the browser window instead of clicking the Close or X buttons. In Windows, use Ctrl+Alt+Delete to open Task Manager. Then find the program on the Programs tab and click the Remove Task button.

  3. Update your browser regularly. This helps provide protection against fraudulent pop-ups and fake antiviruses. Turn on automatic updates to always use the latest version of your browser.

  4. Enable pop-up blockers. If you manage to block pop-ups, you won’t be shown ads for fake security programs.

  5. Check out new apps before you buy. Never provide credit card details or other personal information to unknown companies or download any material from their sites. Searching the Internet will help distinguish real programs from fake ones.

  6. Use a full suite of cybersecurity tools: Ad blockers, web filters, and network screens help block fake antiviruses and prevent pop-ups with fraudulent malware warnings.

  7. Always use genuine antivirus software. Using modern antivirus solutions from a reliable security service provider is the best protection against fake antiviruses. Such solutions warn of potential threats and immediately quarantine and remove malware that enters your device.

Other related articles
Found an error?
If you find an error, take a screenshot and send it to the bot.