The Antivirus Virus...

...allow me to elaborate. There's something floating round out there at the moment, and it takes the form of an Antivirus scanner that (wait for it)...infects you with a handful of viruses, then demands payment so you can remove them!

Antivirus Gold (not to be confused with Norton Antivirus Gold, though I wouldn't run that either) is currently spreading like a bad rash across desktop PCs with the promise of extra safety and the reality of grown men weeping.

A number of vaguley sneaky ploys are used to gain user trust (the Antivirus Gold .exe is named AVG.exe - sound familiar and reassuring?) and there are also one or two reports of this thing appearing by means of a dodgy codec install. This codec apparently originates from a number of porn sites, so think twice before indulging in some Bridget the Midget action.

http://www.ez-finder.com - ah, bless. Its a widdle biddy search engine....except, its not. It simply serves as a front for the infective files which can be obtained from that particular URL. End up with Antivirus Gold on your PC, and immediately upon install the damn thing runs automatically and throws "Danger, Will Robinson" splash screens all over the place:



These are totally fictionalised false positives here, as this was a totally clean build of XP that hadn't even been online. Worse still, the "quick" scan seemed to take about the same length of time as the "thorough" one. Hmm.

Regardless of what you click, everything takes you to a "BUY ME NOW!" button - and if you don't, presumably your PC is doomed to a life of, er, one fake registry entry and a pair of cookies. The horror.



However - that's not the whole story.

There seem to be a number of different installs for this thing, and depending on how your luck is doing, you may get the above (relatively harmless) version or one of the more nastier ones. The ones with the aforementioned Trojans, for example - or the one with the hijacked desktop wallpaper (screaming, yes, you've guessed it, "buy me now"). I would assume the ultimate payload comes from the "Codec", though I'll have to get my hands on it to confirm.

As for the above version, it thankfully goes (with a bit of effort) from the Add / Remove programs panel, though it does force open one final webpage on its way out (because let's face it, if you thought a program was bad enough to uninstall, the first thing you want to see after removing it is a webpage imploring you to buy it, right?) Other versions will allow you to uninstall, only to reappear upon reboot. Eek.

For now, I'd advise to stick to the tried and tested AV Scanners. At this rate, Eric L. Howes is going to have to create a whole new rogue list...