Fake Antivirus Software

I had an encounter this weekend with a new type of virus/malware. It was particularly difficult to remove, and it did some things that I hadn't seen before.

The program is called Internet Security 2010. It's pretty easy to spot, because the first thing it does is open a big window on your screen and make a nuisance of itself. (Follow the link at the bottom of this post to see what it looks like.)

The goal, basically, is to scare or annoy you into paying for software that you don't need. Internet Security 2010 pretends to be antivirus software, and throws up warnings indicating that your computer is infected. The "infections" are fake; the error messages are generated by the Internet Security 2010 virus.

In addition, Internet Security 2010 blocks you from running several common programs. If you try to open them, it says the file is infected and prevents it from running. Some of these are meant to annoy and scare you (by telling you that Word, Excel, and/or Notepad are infected, for example), but this behavior also blocks a lot of the things you would use to shut down Internet Security 2010 (by making it impossible to open the Task Manager, or use your existing antivirus to remove the fake antivirus program). So, once it infects a system, it is very difficult to remove.

It seems to be a fairly new virus, which means that several popular antivirus programs do not catch it. I expect that within a week or two all major antivirus vendors will have updated their software to catch this thing. Until then, be cautious about your web browsing and any questionable e-mails you receive. The link below leads to the instructions that I used to remove the program, and also has screen shots so you can see what this thing looks like.

Removal Instructions & Screen Shots:
http://www.bleepingcomputer.com/virus-removal/remove-internet-security-2010