Symantec finds rogue anti-virus to be well-oiled profit machine

News by Dan Kaplan

An examination into the rogue anti-virus marketplace has revealed a well-organised racket that resembles the adware and spyware industry of several years ago.

An examination into the rogue anti-virus marketplace has revealed a well-organised racket that resembles the adware and spyware industry of several years ago.

A year-long study by Symantec researchers, released on Monday and titled 'Report on Rogue Security Software', concluded that the success of fake anti-virus software - also known as scareware because the makers use fear tactics to get victims to act - is fuelled by an affiliate model that earns them between one and 55 cents per successful installation. The highest fees are paid if victims come from the United States, U.K. or Canada.

These affiliates advertise the bogus solutions through websites, legitimate or malicious, or through advertisements, banner ad compromise on the website of The New York Times, according to the report. Often, the scammers poison search results so that their sites appear near the top of search results for popular terms. In many cases, the web server being used to host and download the fake AV is based in the United States.

Meanwhile, the scareware creators earn between $30 and $100 from victims who agree to pay for the software in hopes of resolving fake claims that their PCs are infected, the report said.

By all accounts, rogue AV makers, master affiliates - such as, which served as major rogue AV distribution point until being dismantled earlier this year - and their individual affiliates are earning quite a bit of money, Vincent Weafer, vice president of Symantec Security Response, told

According to data culled from Symantec customers between 1 July 2008 and 30 June 2009, there were 250 distinct families of rogue security programs, resulting in 43 million attempted downloads. The most common counterfeit applications carry legitimate-sounding names, such as SpywareGuard 2008, AntiVirus 2008, AntiVirus 2009, SpywareSecure and XP AntiVirus.

Weafer said the rogue AV market has become a global enterprise, drawing many parallels to the adware/spyware markets in which there is a well-organised distribution model that features a number of players.

"It's the gift that keeps on giving," he said. "It's just very effective, if you go out and scare people. The message that you're infected and you need to take care of it now seems to get a lot of people."

Weafer added the danger to victims is not only that the rogue AV maker steals their credit card information when they purchase the fake product. By installing the program, the criminal also gains control over that victim's PC, allowing him to install additional malware at any time.

Users should be careful to avoid tricks in which 'someone is screaming at you that you're infected', Weafer said.

He said authorities must increase their enforcement of rogue AV operations.

"Follow the money," Weafer said. "If you can disrupt their money supply, it makes it less attractive."

A version of this article appears on


Find this article useful?

Get more great articles like this in your inbox every lunchtime

Upcoming event 

Webcast: Understanding this year's biggest adversaries - and how to combat them 

Nation-state activity, versatile, slippery strategies and Big Game Hunting - the threats are real, dangerous and ever changing. 
Brought to you in partnership with Crowdstrike