"To the surprise of many, an antivirus application was published on the Windows Phone Marketplace earlier in the week. The publication of AVG Mobilation for Windows Phone was peculiar for two main reasons. The first is that Windows Phone simply doesn't have any viruses to scan for. Second, Windows Phone applications are sandboxed; they have no access to the system files or other applications. Even if a virus were to be developed for the platform, the virus scanner would not be able to detect or remove it.<br />
"AVG was apparently undaunted by these obstacles, and developed the free, but ad-supported, Mobilation regardless."<br />
<br />
AVG didn't really cover itself in glory here.

"TrafficConverter.biz was dismantled on Nov. 29, 2008, most likely because the same domain was referenced deep inside the guts of the Conficker worm, a family of malware that is estimated to have infected at least 10 million Microsoft Windows systems.<br />
"Prior to site's demise, security researchers managed to snag a copy of the database for the TrafficConverter affiliate program. While that data set is incomplete, the information available on the top-earning affiliates helps explain why so many consumers are reporting infections from rogue anti-virus products: Successful affiliates are making money hand over fist with these programs."

About eight hours after the bad guys altered their product, Apple came back with an update. "As the cat-and-mouse game continues it will be interesting to see how the attackers proceed. The major change to bypass detection yesterday was to use a small downloader program to do the initial infection, then have that program retrieve the actual malware payload.<br />
"This approach may be successful as it will be easier for them to continually make small changes to the downloader program to evade detection while leaving the fake anti-virus program largely unchanged.<br />
"Why is this important? Apple's XProtect is not a full anti-virus product with on-access scanning. XProtect only scans files that are marked by browsers and other tools as having been downloaded from the internet.<br />
"If the bad guys can continually mutate the download, XProtect will not detect it and will not scan the files downloaded by this retrieval program."<br />
<br />
And they can mutate it, for sure.