Cybercrimals use fake Windows update to push bogus security software

Cybercriminals are using a fake Windows Update installation dialogue box to sell a bogus security product called Anti-malware Defender, security researchers have warned.

Download this free guide

Web security 101: Keeping hackers at bay

Many people assume that they are untouchable when browsing the web. Many people are wrong. It's impossible to be completely safe whilst online, but there are some simple methods to help increase your web security.

Start Download

• Corporate E-mail Address:

  You forgot to provide an Email Address.

  This email address doesn’t appear to be valid.

  This email address is already registered. Please login.

  You have exceeded the maximum character limit.

  Please provide a Corporate E-mail Address.

• • I agree to TechTarget’s Terms of Use, Privacy Policy, and the transfer of my information to the United States for processing to provide me with relevant information as described in our Privacy Policy.

  Please check the box if you want to proceed.

• • I agree to my information being processed by TechTarget and its Partners to contact me via phone, email, or other means regarding information relevant to my professional interests. I may unsubscribe at any time.

  Please check the box if you want to proceed.

By submitting my Email address I confirm that I have read and accepted the Terms of Use and Declaration of Consent.

The scam uses very realistic looking Windows Update dialogue boxes, pop-ups and bogus anti-virus scans, said Andrew Brandt, malware researcher at Webroot.

The scam is triggered by infected websites that push drive-by downloads at visitors and include links to genuine Microsoft information pages, he said in a blog post.

If the "install now" button is clicked, the malware attempt to coerce victims into buying a "licence" to the nonexistent product.

Identifying the file is not difficult for users accustomed to the Windows Task Manager, said Brandt.

"Unlike a real Windows Update session, these fake updates appear as a DLL running from the temp folder with the words 'start worker' in the command line," he said.

Victims can stop the malware from running by emptying the temp folder.