Once in awhile I like to show off some of the malware I find when visit my St. Louis clients. Tonight I thought I’d treat you to a creative little rogue antivirus! When Joyce (my new client) would try visit free.avg.com (or any website) she would be presented with this fake little message…”Warning! Your system is in danger“.

Joyce was infected with the ever present and ever changing ZLOB trojan. I don’t have too much to say about this rogue except that it hijacked every single website visit with the text seen below (which is sorta rare). When Joyce would click the message she would get (…see img B) an installer for Antivirus Pro 2009. Joyce didn’t install Antivirus 2009 because she had heard about such scams at work.

I cleaned Joyce’s machine with Malwarebytes and GMER in safemode. Later she opted to buy Norton Internet Security 2009. Joyce had an expired copy of Trend Micro 2008.

Img. A

Img B.