1. Welcome Guest! In order to create a new topic or reply to an existing one, you must register first. It is easy and free. Click here to sign up now!.
    Dismiss Notice

Fake Antivirus Forces User Uninstall Of Legit A/v

Discussion in 'News & Current Events' started by allheart55 (Cindy E), Aug 20, 2010.

  1. allheart55 (Cindy E)

    allheart55 (Cindy E) Administrator Administrator

    Joined:
    Jun 11, 2009
    Messages:
    10,617
    Location:
    Pennsylvania
    Operating System:
    Windows 10
    Computer Brand or Motherboard:
    ASUS M4A77TD AM3 AMD 770 ATX AMD
    CPU:
    AMD Phenom II X6 1090T-Thuban 3.2GHz
    Memory:
    Crucial-DDR3 SDRAM 1333-8GB
    Hard Drive:
    WD Caviar Black SE HDD 640 GB - WD Caviar Black SE HDD 500 GB
    Graphics Card:
    Sapphire Radeon HD-7870 2GB
    Power Supply:
    CORSAIR CMPSU-750W
    Hackers are running a new social engineering scheme that tricks users into uninstalling their legitimate
    anti-virus program protecting their computer, and using a rogue product instead.

    Those behind the duping scheme have leveraged a clone of the CoreGuard (fake) Antivirus product and
    relabeled it as AnVi Antivirus. Both products are rogue.

    Rogue antivirus products have become a reoccurring problem for security companies, though one particular
    security software firm, Symantec, noted that this method of attack differs from rogue antivirus products
    of the past.

    Symantec stumbled upon the AnVi Antivirus scheme when hackers attempted to get them to uninstall some
    of their own software. Symantec employees reported that, when infected by AnVi, a "warning is displayed
    that the Symantec anti-virus is 'uncertified' and will hamper the system's performance."
    (Source: informationweek.com )

    From there, the user becomes a virtual hostage within their own computer system, realizing that they have
    become the victim of a rogue attack.

    "The user is left with no other option than clicking OK, which initiates the uninstall process. Even if the use
    r clicks the 'close' button, the uninstaller of the anti-virus product still executes."

    Symantec researchers also discovered that AnVi also attempted to download rogue anti-virus software by
    linking to malware-ridden websites. Once installed, users are bombarded with notifications that their
    system is infected and that it will cost money to fix the problem, which doesn't technically exist.

    AnVi Antivirus is also attacking other big-name antivirus products, including Microsoft, AVG antivirus,
    Spyware Doctor, and Zone Labs. (Source: symantec.com )


    Unfortunately, the combination of dubious antivirus and social engineering has become a popular method among
    online evildoers. Earlier this week, Panda Labs reported more than 200 fake web addresses capitalizing on the
    allure of teen heartthrob Justin Bieber to spread a form of rogue software called MySecurityEngine.
    (Source: itpro.co.uk )

    As Luis Corrons, technical Director of PandaLabs, warned "When positioning websites used to distribute
    malware among the first results in search engines, they can be sure that numerous Internet users will
    inadvertently download the fake anti-virus."

    Article
     
  2. BeeCeeBee

    BeeCeeBee ADMINISTRATOR IN MEMORY

    Joined:
    Apr 20, 2009
    Messages:
    7,201
    Location:
    New Jersey "Stronger than the Storm"
    Operating System:
    Windows 7
    I have a question. Yes I do. :rolleyes:

    When I am faced with notices that I am reasonably certain are bogus or worse, my first inclination is to click on nothing and disable the process through my device manager. If I am really concerned I pull the plug on the internet by ether unplugging the router (if wireless) and the ethernet cable if wired.

    If it is the click that starts the download will the disconnect stop it short? I think this is important for our members to know.
     
  3. allheart55 (Cindy E)

    allheart55 (Cindy E) Administrator Administrator

    Joined:
    Jun 11, 2009
    Messages:
    10,617
    Location:
    Pennsylvania
    Operating System:
    Windows 10
    Computer Brand or Motherboard:
    ASUS M4A77TD AM3 AMD 770 ATX AMD
    CPU:
    AMD Phenom II X6 1090T-Thuban 3.2GHz
    Memory:
    Crucial-DDR3 SDRAM 1333-8GB
    Hard Drive:
    WD Caviar Black SE HDD 640 GB - WD Caviar Black SE HDD 500 GB
    Graphics Card:
    Sapphire Radeon HD-7870 2GB
    Power Supply:
    CORSAIR CMPSU-750W
    I would immediately close the program using the task manager. If that doesn't work I would
    force a hard boot to shut down. I believe you only have a few seconds...
    I have done this before with other rogue programs successfully.

     
  4. Match

    Match Registered Members

    Joined:
    Apr 23, 2009
    Messages:
    4,175
    Location:
    Wolverhampton, UK.
    Computer Brand or Motherboard:
    Abit AN52
    CPU:
    AMD Athlon dual core 5000+
    Memory:
    4 Gig Corsair
    Hard Drive:
    160 Gb Hitachi 500 Gb Western Digital
    Graphics Card:
    Radion XFX 4650
    Power Supply:
    550W EZcool
    that's all well and good but from what I read that clicking any where starts the uninstall process to which the inexperienced would sit there panicking not knowing what to do, and I would also bet it would take them more than a couple of seconds to locate the CTRL, ALT, DEL, buttons where as the more experienced would hit them without even thinking. so I think the main point is to be wary in the first place and having a good firewall in place is the best option.
     
  5. allheart55 (Cindy E)

    allheart55 (Cindy E) Administrator Administrator

    Joined:
    Jun 11, 2009
    Messages:
    10,617
    Location:
    Pennsylvania
    Operating System:
    Windows 10
    Computer Brand or Motherboard:
    ASUS M4A77TD AM3 AMD 770 ATX AMD
    CPU:
    AMD Phenom II X6 1090T-Thuban 3.2GHz
    Memory:
    Crucial-DDR3 SDRAM 1333-8GB
    Hard Drive:
    WD Caviar Black SE HDD 640 GB - WD Caviar Black SE HDD 500 GB
    Graphics Card:
    Sapphire Radeon HD-7870 2GB
    Power Supply:
    CORSAIR CMPSU-750W
    I don't think a firewall is going to deter some of these rogue programs that are out there. It's
    always best to pratice safe surfing but if or when something such as this makes an attempt to
    break through....Right click the task bar and select Task Manager. No need for Ctrl>Alt>Delete.
    :unsure: It takes less time...:eek: When in doubt, do a hard boot shut down. Keep in mind, you do not
    want your cursor anywhere near it.:yikes:

     
  6. Match

    Match Registered Members

    Joined:
    Apr 23, 2009
    Messages:
    4,175
    Location:
    Wolverhampton, UK.
    Computer Brand or Motherboard:
    Abit AN52
    CPU:
    AMD Athlon dual core 5000+
    Memory:
    4 Gig Corsair
    Hard Drive:
    160 Gb Hitachi 500 Gb Western Digital
    Graphics Card:
    Radion XFX 4650
    Power Supply:
    550W EZcool
    I'll admit I'm not familiar with many firewalls, but I use Zonealarm pro, and for it's annoying jump in and notify, and ask for permissions attitude I wouldn't be without it, even if I have to put up with disabling the internet connection and Zonealarm to get round some installation problems.
     
  7. BeeCeeBee

    BeeCeeBee ADMINISTRATOR IN MEMORY

    Joined:
    Apr 20, 2009
    Messages:
    7,201
    Location:
    New Jersey "Stronger than the Storm"
    Operating System:
    Windows 7
    Assuming that it is the mouse click that launches the download and install (which I have assumed to be the case when I run into these things ) would not the best practice be to sever the connection to the internet as the first line of defense? I am on a laptop and one that has no switch for a wireless connection. However, the power plug for the router is very conveniently just to my left. Nothing to learn, no paths to follow or shortcuts to learn.

    Once that is done, I still close the browser in task manager etc. If you fail to close the browser window in task manager after disconnecting (particularly with Firefox) you run the risk of having the window reopen when you go back to the browser. A shut down and/or restart should also avoid this.

    If I am right, it may well be a good idea to have a "planned escape" from the internet.
     

Share This Page