Catch up on stories from the past week (and beyond) at the Slashdot story archive


Forgot your password?
Security IT

Fake Antivirus Overwhelming Scanners 334

ChiefMonkeyGrinder writes "Rogue or bogus programs passing themselves off as real antivirus software have been one of the malware themes of 2009, but the APWG's numbers for the first half of the year show that the organisation's members detected 485,000 samples, more than five times the total for the whole of 2008."
This discussion has been archived. No new comments can be posted.

Fake Antivirus Overwhelming Scanners

Comments Filter:
  • by excid3 ( 1108239 ) on Thursday October 01, 2009 @12:28PM (#29607179) Homepage

    I'm pretty sure that Antivirus 2009 has protected me from emerging threats quite reliably.

    • by Darkness404 ( 1287218 ) on Thursday October 01, 2009 @12:32PM (#29607251)
      Note to clueless mods, Antivirus 2009 is one of these fake antiviruses, mod them funny, not interesting....
    • Re: (Score:3, Insightful)

      by Shikaku ( 1129753 )

      Um mods? This is a joke. It's a really bad malware that's almost impossible to remove.

      • by kimvette ( 919543 ) on Thursday October 01, 2009 @12:40PM (#29607361) Homepage Journal

        See my other post on this subject. Antivirus XP (and variants) can be removed by hand but it's a tedious process. Malwarebytes removes it VERY easily though. With some Antivirus ($FOO) variants you do need to rename the Malwarebytes installer filename and then the executable filename but once you get the process launched it will fully automate the removal process. IMHO Malwarebytes is the very best ad/malware removal utility at the moment, with Spybot S&D and Superantispyware being tied for a very distant second.

        • Re: (Score:2, Informative)

          by Kaeles ( 971982 )
          Combofix! Go download it and use it. it will slaughter those stupid antivirus xp 200x and all that jazz. I want to make out with whoever made it.
          • Combofix! Fuck yeah!

            That program's saved me a lot of wipe-and-reinstall jobs at work. It removes even the most stubborn self-repairing process-hooking BHO-installing rootkits.

            Whoever made it deserves a Mercedes SLK convertible and an expensive watch - the closest real thing to a FantasyGirlSexLand lifetime pass.
        • Re: (Score:3, Informative)

          by tunapez ( 1161697 )

          I agree MalwareBytes is one of the best Win environment removal tools, but I was having about 20% re-infection rate with these entrenched AVPro infestations that were removed by MB(& Spybot). I also searched system folders for dll's newly installed and installed "BEFORE the OS" to unregister manually, then running MB and SB S&D again, in SafeMode w/ Restore Points deleted/disabled. Honestly, after all that work, it is most times easier/cheaper to image drive, nuke/repart drive(in DOS or EXT), reload

    • My sister got this on her XP system. She is pretty clueless but had never managed to get any malware on her system other than this.

      Took me and her boyfriend nearly 2 hours to clean it off.

    • Re: (Score:3, Funny)

      by Deathlizard ( 115856 )

      Av2009 sucks! Antivirus 360 is the best scanner ever! and it's only 79.95! And it also came with a great product called File Fixer Pro!

      All my documents were corrupted, And this File Fixer Pro fixed them all for only $49.95! I was so relieved!

      I'm also hearing great things about "Antivirus Number 1" too. After all, It's Number 1!

      (Yes this is a Joke. Laugh, becaue you'd be surprised how many times I've heard something similar to this.)

  • Are we surprised? (Score:5, Informative)

    by Canazza ( 1428553 ) on Thursday October 01, 2009 @12:30PM (#29607207)

    Adverts for these things get into legitimate sites all the time through things like adwords, even though they're normally taken off quite sharpish, they're still there. They still cause problems and numpties do click on them. The old IBK error keeps appearing. As long as people aren't educated as to how this all works the problem will remain huge.

    The problem with Anti-virus is that every few years a new guy appears on the block. First it was Norton, then Mcafee, then AVG, Kaspersky, and now whatever AV's the in-thing to use. There are new viruses out there all the time too, and if there's one thing that normal people are aware of it's that there are alot of viruses out there, and that your AV doesn't give 100% protection, so when something pops up saying "You're infected! Our AV will cure it!" they're likely to believe that their current AV is defective, because clearly this one spotted it, they download it and BAM! world of trouble.

    It's depressing sometimes, but gladly, I've not had to remove it from any PCs in a while, whenever I do I recommend they replace their browser with Firefox and Adblock plus (Not noscript, I did that once and I got bollocked for that a bit because 'using the web was too hard as he had to press buttons every site he went on', the guy was a real pleb but nevermind) - and ABP stopped all the ads, and thus, stopped them downloading and installing that shite.

    • Re: (Score:3, Insightful)

      by sopssa ( 1498795 ) *

      The more interesting thing is the recent development in them - they've actually started to detect small amount of threats.

      Combined with that and the fact that they aren't a virus but seemingly legitimate software makes it hard in law point of view. By far the only way to have them procedured has been about misleading marketing, which is right. But for example I installed Norton Antivirus (or the quick scanner of it to see if I had viruses). It ended up being really hard one to delete, popping up its scan fr

  • Norton (Score:5, Funny)

    by Krneki ( 1192201 ) on Thursday October 01, 2009 @12:32PM (#29607253)
    Still I'd rather have a fake anti-virus then Norton Symantec or Windows Live Family protection. At least the fake anti-virus will let me use my PC every now an then. :)
  • by Obfuscant ( 592200 ) on Thursday October 01, 2009 @12:33PM (#29607267)
    Very very scary. Not.

    My netbook required an update to MacAfee ("free" from Comcast) because one part of it stopped working, and during its first scan, it started reporting a problem. Wouldn't tell me what the problem was unless I let it run for twelve hours to scan the whole system. I tried stopping it and looking at logs, I tried looking at logs while it was running, nothing other than the "ominous" 1 under "detected threats".

    Turned out that it was reporting the crack program that allows me to run Duke Nukem without the CD -- since the netbook doesn't have a damn CD and I own the copy of Duke Nukem. MacAfraid called it "a program you might not want to have".


  • Major pain (Score:3, Informative)

    by zip_000 ( 951794 ) on Thursday October 01, 2009 @12:36PM (#29607307)
    I've been losing this battle with the staff where I work; they just can't seem to understand that it is itself spyware and/or viruses. I've had to remove this crap from 5 or 6 computers in the last month alone.
    • Re:Major pain (Score:5, Informative)

      by Krneki ( 1192201 ) on Thursday October 01, 2009 @12:41PM (#29607379)
      Start with removing them from local Admin group for a start.
      • Re: (Score:3, Insightful)

        "Start with removing them from local Admin group for a start."

        I'll second that. Make sure they have no privileges outside their specific job description. If "Limited User" isn't good enough, go to group policies and restrict them there. Lock the user down tight, and he won't be able to run these scripts or install anything. No mercy - if you have to protect a dumbass from himself, protect him. You wouldn't let your toddler play in traffic, would you?

        • Re: (Score:2, Interesting)

          Yeah, except that won't neccessarily fix the problem. I got caught by a drive-by downloader on my work laptop, where I do not have admin priviledges. I didn't click on anything, or agree to download anything. I merely visited a popular webcomic - then bam, install script trying to give me AntiVirusPro2010 or something along those lines. I got rid of it easily enough with MalWareBytes, but I couldn't even use safe mode to run HiJack this because I have no admin privileges.
          • At a guess, javascript is enabled. That's why noscript is so good, and adblockplus. Assuming you can't install Firefox, at least disable javascript in your browser. Set all of your security settings to high in IE. Hopefully, you informed the IT department of the drive-by, so that they know their machines are vulnerable. HOST file can alleviate the problem, just download some of the readily available files from the internet, and copy them over your old file. Hostess program is good for merging files.

        • Re: (Score:3, Funny)

          by Tanktalus ( 794810 )

          You wouldn't let your toddler play in traffic, would you?

          /me goes out to retrieve toddler.

      • We do this too, we also randomly remove people who were in the group as well, to see if they complain
    • Tell me about it. We've had to resort to sending out emails with screenshots of various Antivirus 2009 screens cribbed from ISC and other places. "Hey, see this? Don't click on it". And I know it won't do a damn bit of good.

    • Re: (Score:3, Informative)

      by Deathlizard ( 115856 )

      Laws of computer stupidity
      1) 99% of computer users do not know what they are doing.
      2) Computer users do not read.
      3) If a computer user can click on it, they will.
      4) You can patch software, but you can't patch stupid.

      Understanding the above when making your corporate system build will pay off in the end.

    • by pyrr ( 1170465 )

      I wouldn't be so quick to blame your users. Almost all of these fake anti-malware viruses seem to exploit flaws in certain outdated versions of Sun Java or browsers.

      Not to mention, the users have little choice in the matter once exploited-- and they likely did nothing to become infected other than visiting a website that happened to be infected. The AV2009 virus and others tend to hijack the system on a superficial, but widespread infection, flooding the users with threatening popups that they are unable

  • Combofix (Score:5, Informative)

    by Anonymous Coward on Thursday October 01, 2009 @12:37PM (#29607329)

    I'm posting to say: COMBOFIX. This thing magically removes Antivirus 2009 and 2010, even the rootkit versions that MBAM falters on (or that prevent MBAM from running, even in safe mode). []

    Use it. Love it. Marvel at its simplicity, its beauty.

  • by kimvette ( 919543 ) on Thursday October 01, 2009 @12:37PM (#29607335) Homepage Journal

    Those are some of the best-written software out there. No, really! The first time I encountered the more advanced ones, almost malware detection/removal software could detect them, and none of them could remove that malware. It was on a system for a friend where reformat/reinstall was not really an option (would have taken more time to do that) so I dug into it. It took 26 hours to completely remove the crap from the system - it had strewn source files through the Windows and System Restore directories, had several hidden processes which monitored process killing and file deletion and would modify, recompile, and reinstall multiple copies of itself again.

    A few weeks later Malwarebytes and Spybot S&D were updated and could easily remove any variant I've come across since then. The first time I hit it was a pain in the neck, then it was routine removal of it for a few weeks (a bit of time consuming but not nearly so much as the first time) and then it became a simple matter of renaming the malwarebytes and Spybot S&D installers, renaming the installed executable and running them. Ad-Aware couldn't detect them - and it's a shame. Ad-Aware is pretty much useless now. It seems that once they gained commercial viability they became complacent.

    The douchebags who write that software aren't stupid. Malware is getting to be extremely well-designed and it's a damned shame those authors aren't doing more productive work.

    • Those are some of the best-written software out there. No, really! The first time I encountered the more advanced ones, almost malware detection/removal software could detect them, and none of them could remove that malware. It was on a system for a friend where reformat/reinstall was not really an option (would have taken more time to do that) so I dug into it. It took 26 hours to completely remove the crap from the system - it had strewn source files through the Windows and System Restore directories, had several hidden processes which monitored process killing and file deletion and would modify, recompile, and reinstall multiple copies of itself again.

      It isn't that they're especially well-written... They may be, I don't know. The problem is that the mainstream anti-virus/malware stuff (like Panda, Symantec, McAfee, etc.) does basically nothing for them. You need to use tools like - as you suggest - Malwarebytes and Spybot. Of course there's some lag between when something new comes out and when definitions get updated... But that's always been the case. If you're one of the first infections of anything it will be a pain to remove.

      Ad-Aware couldn't detect them - and it's a shame. Ad-Aware is pretty much useless now. It seems that once they gained commercial viability they became complacent.

      Agreed. We used t

    • by dword ( 735428 )

      I would like to congratulate the writers of that malware. I would also like to honestly congratulate you for finding the way to removing it in 26 hours!

    • by Sycraft-fu ( 314770 ) on Thursday October 01, 2009 @01:44PM (#29608299)

      for compromised systems, one thing that works great in the cases where you can't is Process Explorer from Microsoft. It is a more detailed task manager so you can get more information on processes. That itself isn't useful. However, what it can do is suspend processes. You choose a process and there's a suspend option, as well as killing it. Well, what that does is allow you to shut this stuff down, but its watchdog process doesn't notice. It is still "running" it just doesn't get CPU time. So the main process can't stop you from modifying the system, and the watchdog doesn't know to reload it.

      You then can make use of Autoruns, also from Microsoft. That shows you everything that starts up on your system. Use that to track down and remove the startup of the processes. Reboot to clear the file locks (or boot to a live CD), and delete the files.

      I can get rid of all the malware I've thus far encountered manually using those tools and spending some time. We have to do it sometimes because professors refuse to let us reinstall, even though that is the best option, since I can never be 100% sure I cleared all threats.

    • by pyrr ( 1170465 )
      It might be more successful if they could only learn to SPELL and use proper GRAMMAR. This software is definitely cleverly-implemented. The extortionists' abuse of the English language turns what could be a successful scam into a comical failure.
  • by ahuger ( 1648027 ) on Thursday October 01, 2009 @12:41PM (#29607375)
    That number in itself should not surprise anyone. Many threats which are using the web as their primary introduction vector are using server side polymorphism. The sheer volume which the APWG is calling out really only reflects that allot of people are downloading the rogue AV packages. Of course, given the nature of malware collections there is a very strong chance that many of those people already had 'real' AV which detected it, hence the sample being sent to an AV company in the first place. Of course crawling and honeynets will account for some of the sample set but not the majority. The assertion that this is only the tip of the iceberg is likely true given no AV vendor has an omnipresent view of the world but I am not convinced it's any worse than a plethora of other highly deployed threats. Bluntly, they are all out there in gut wrenching numbers. The rise in rogue AV is driven by the fact that it's gaining in popularity with malware distributors because it's a fast, proven revenue source. In some cases they may even skirt the law on whether it's even illegal. Remember, some of these things have rudimentary AV detection capabilities. -al Immunet Corp
  • by Girtych ( 1345935 ) on Thursday October 01, 2009 @12:47PM (#29607483)
    I work for a IT department here in California, and we get about three fake-antivirus-infected computers every week. Lately, the malware's been getting more difficult to remove- it's been hooking into system processes so that it can continually replace itself if part of the program gets deleted.
    Thankfully, we've found a fairly nice remedy that doesn't force us to wipe the hard drive. Don't bother with Ad-Aware or Spybot S&D anymore- they've become very ineffective as of late.

    First we hit it with a scan from Malwarebytes Anti-Malware, a free scanner you can download here: []

    Then, on the infected computer, we download and run (in safe mode) a somewhat obscure free program called Combofix, which is available here: []

    After that, we run one more follow-up scan with Malwarebytes to ensure that the computer is clean.

    So far, this combination of steps has eliminated the infections that we've come across.
    • by Ephemeriis ( 315124 ) on Thursday October 01, 2009 @01:04PM (#29607755)

      There seems to be very little response from the traditional/big/mainstream antivirus companies.

      We usually install something centrally-managed for our clients, like Panda or Symantec. They do a decent job of stopping viruses, and it makes for less work for us... But they do absolutely nothing for these new rogue things. They don't get detected, they don't get blocked, they don't get removed... Nothing at all.

      You wind up having to actually sit down at the machine and run through a battery of individual scans... Slaving the HDD to another machine, booting into safe mode, booting into normal mode... Far more time-consuming than I'd like.

      • The ones that are truly lovely are the ones that patch the Windows Restore directory tree with binaries and source. Those are really nasty!

    • by Z34107 ( 925136 ) on Thursday October 01, 2009 @01:11PM (#29607833)


      I work help desk at the college I'm enrolled at, and removing this virus and its variants from student laptops is pretty much the entirety of my job description.

      I recommend running ComboFix first, because it will generally neuter a virus enough for MalwareBytes to install and remove it. If the virus keeps ComboFix from running, rename it to magickitties.exe - some kill AV processes by name.

      Anything more interesting than that, download the free Windows AIK []. Make an image of the drive using ImageX. Mount the image (and the registry hives on the image) on a clean PC and do a scan on that. Reimage the PC with the clean image.

      Just creating an image with ImageX is sometimes sufficient to remove the rootkit portions. ImageX is file based, and the rootkit portions hide from the MFT. ImageX simply fails to gather the rootkit portion, because it hides too well.

      Usually, all it takes is 10 minutes of letting ComboFix run and 30 minutes of letting MalwareBytes run. Very slick.

    • I love our campus laptop program for this very reason.

      If we get one of these viruses, we swap their hard drive with a preimaged one then clean and copy "my documents", "desktop" and "favorites" from the old drive to the new one, then wipe and image the old drive for the next person.

      This way we know the virus is totally dead, since so much crap these days rootkit your box right off the bat.

      There is viruses that nothing truly removes. My favorite is still TDSS. There was a varient that would reside in the rec

    • by dword ( 735428 )

      A single scan isn't enough and you should scan your computers with multiple competitive scanners simultaneously. We need something stronger that can protect against many kinds of holes. Until recently, I've been quite satisfied with ESET's NOD32 and I had even considered purchasing a couple of licenses for home use, but their anti-trojan team seems to have taken a long break. Then, I realized: antivirus products protect well against viruses that look for holes in the software, not against trojans that look

    • Re: (Score:3, Interesting)

      by Mr. DOS ( 1276020 )

      Agreed. Until very recently, I worked in a computer service shop, and MBAM proved so useful that I purchased a license for the full version just to support Malwarebytes (I wasn't running Windows at the time, so the license was essentially useless to me). Well, now I'm back running Windows (I installed 7 on my laptop Tuesday night to get a good look at it before people start bugging me with questions about it), and I must say, the real-time scanner is nice - it's very lightweight (the service is currently co

    • Stop letting your users run as local admins.

  • frustrating as hell (Score:5, Interesting)

    by Ephemeriis ( 315124 ) on Thursday October 01, 2009 @12:51PM (#29607525)

    What really annoys me is the fact that the mainstream antivirus products (Panda, Symantec, McAfee, etc.) do such a crappy job of dealing with these rogue antivirus things. Most of them don't do a thing. Don't detect the rogue stuff, don't disinfect it, nothing.

    Which means that we have to use something like Malwarebytes or Spyware Doctor to remove them.

    This is especially annoying for us... We're outsourced IT for our clients. We aren't there every day to take care of everything they need. We set things up as safely and securely as we can, manage it all as best we can, but we can't lock things down as tightly as I'd like because these folks need to be able to operate without us - installing their own software and updates, things like that. So it's only a matter of time before one of our clients stumbles into one of these rogue antivirus products.

    Does anyone know of a good, centrally-managed (like Symantec of Panda) anti-virus/malware package that actually detects these rogue things?

  • I got to fight with Windows Police Pro after it got onto my Mom's computer. It pretty much makes the computer useless. It even changed the file registration for .exe's and .com's. Luckily, after fixing the registry I was able to get Malwarebyte working and got things running again.

    My wife later told me about someone at work getting something similar. She asked what to do and I started rambling on about all the steps. She then asked what this non-techie should do. I had no idea. Find a geek or pay for one a

    • Re: (Score:3, Insightful)

      by Girtych ( 1345935 )
      1. Don't use Internet Explorer. I swear that most of the infections I've run into are from compromised websites using exploits that target IE.

      2. Don't install anything- ANYTHING- from the internet unless you know exactly what it is. Even then, you might want to run a quick scan on it. Most virus scanners add an option to the right-click context menu to make this simple.

      3. If you see anything saying "your computer may be infected" or something along those lines while browsing the internet, ignore it. I
      • > Don't install anything- ANYTHING- from the internet unless you know exactly
        > what it is.

        I'd amend this to "Don't install anything- ANYTHING- from the internet even if you know do exactly what it is." Because the sort of users we are discussing here, when they "know exactly what it is", are WRONG.

    • If you can turn it over to a geek for about two days (how long depends on the computer, some I can scan and clean in a couple of hours, some take longer), they should be willing to fix it for under $100. It really takes very little of my time to clean these, a couple of minutes to install software then let it run until it has finished scanning (maybe reaching over and clicking "ok" every now and again) while I work on other things. If I can work at it at my leisure in between working on other projects, I fi
  • by Anonymous Coward

    You know MBAM is good when the newest variants of this shit specifically prevent its installer and the application itself from running (unless you rename them).

    Whoever is responsible for this fake antivirus and security software should be killed slowly and painfully over a period of weeks. Like, torture them to near the point of death and keep a couple medical personnel on hand to nurse them back to health so you can start over again, and repeat the process a few times. And put videos of it on YouTube for t

  • Motivation (Score:5, Interesting)

    by 99BottlesOfBeerInMyF ( 813746 ) on Thursday October 01, 2009 @01:05PM (#29607775)

    This is all the free market working against the unfree market. In a free market competitors work to make the best product to make the most money. Right now, that's malware writers, each trying to outdo one another and make the best trojans to get the most bots and personal info.

    In a free market consumers would buy computers best suited to deal with this threat, with defenses that appropriately reduce this threat to a small subset of their customers. But, since we have one player with a huge amount of influence on the desktop OS market, with huge influence on computer makers and other markets and who has built substantial barriers to prevent consumers from trying other options, desktop OS's are not adapting appropriately. Why should they if it is not losing them significant money?

    Trojans aren't some unsolvable problem, but for the most part they are a problem that needs to be dealt with at the OS level. Add on software from computer makers is only going to be partially effective. SELinux, for example, does a reasonable job of mitigating trojans in the secure workstation market, but has not been adapted to the consumer desktop market as yet because it requires integration on the part of application developers and there is no real motivation to do that. Linux and OS X desktops don't face significant levels of attack. Windows doesn't lose real money when it fails to defend against them. Why would anyone who understands the benefits of free market capitalism expect anything but to have malware writers win. They have direct, financial motivation.

    Seriously, MS could easily create a sandboxed backwards compatibility layer (they already have). They could easily require all software that did not have a proper signature and an ACL to run in a restricted sandbox. They could dump money into crafting a good UI for it and motivating developers by restricting access to new, useful APIs. The real question is, why should they, as a business, spend that money?

    I have a modest proposal that will solve this problem and a lot of other problems all stemming from the same cause. Break up Microsoft. Seriously. They're repeat offender antitrust violators. Break them up and give at least two new companies complete rights to use all the source code and patents and an equal portion of the human resources and capital. Forbid these companies from any nonpublic communication or any agreements they don't offer to other companies with the same terms.

    When you have executives at MS-A and at MS-B both realizing they have to do something to win sales contracts from Dell and HP and Sony and Asus guess what, they'll have to compete. Then their financial well being will depend upon which can deliver a better product at a lower price. Neither will be able to strongarm customers or people in other markets. They'll have motivation to fix the flaws in Windows and the accompanying software that people have been learning to work around for decades. And neither company will have to worry about antitrust concerns and will be able to bundle whatever crap they want including their version of IE. I'd be willing to bet if our justice department had the balls, the malware problem would be a minor annoyance in 5 years time.

  • by EXTomar ( 78739 ) on Thursday October 01, 2009 @01:17PM (#29607901)

    Isn't it about time to start asking Microsoft to fix the system instead of installing additional software that helps cover up the flaws? The reason why they went with this is that it is cheaper to offer "feature rich environment" but cover the holes with "additional safety software" than it is to make sure the "feature rich environment" is correct let alone sane or safe. The weakness has always been the "additional safety software" part. If legitimate software can be "additional safety software" then illegitimate software can be "additional safety software" as well.

    Who validates what is legitimate "additional safety software"? The AV Industry? Microsoft? These guys aren't exactly impartial and at an abstract level represents a conflict of interest. Should it be left up to the user? If the user was qualified to do that they wouldn't need "additional safety software". This is a gigantic losing battle where we have long since pasted the point where we need more AV and UAC "protection" and start closing loopholes and flaws in the Windows OS and architecture.

    • No viruses. Not one, and not a single Windows computer is permitted to connect to my network. I keep one copy of windows in one box. It is a cardboard box in my closet under some books and smelly socks. It has not gotten a single virus either.

      I do have to keep a frigen virus scanner on my mail and files coming from outside my network, so I don't simply pass them on to other windows computers if the files ever leave my network. It pisses me off that I have to waist time and resources on protecting windows co

      • No viruses. Not one,

        Out of curiosity, how do you know? If you had a virus, what in your system would reveal that?

        Note: I'm being somewhat rhetorical here, as it's quite possible you're one of the Linux users who constantly check your firewall logs and such to actually ensure their computer isn't doing anything undesirable. I'm not even suggesting Linux is insecure, other than to say it's just as open to viruses as any other OS.

        I just like commenting on the fact that the vast majority of Linux users who clai

    • This is a gigantic losing battle where we have long since pasted the point where we need more AV and UAC "protection" and start closing loopholes and flaws in the Windows OS and architecture.

      The core flaws are the that Windows does not clearly provide the user with appropriate information on who is providing a given application and if that is a reputable source or an anonymous provider. Windows does not allow users to run software within a sandbox with permissions appropriate to the software, by default. Windows does not clearly provide granular controls and feedback on what a given application wants to do and what risk this entails. Further, when it comes to determining trust, MS has failed to

    • Re: (Score:3, Insightful)

      by lukas84 ( 912874 )

      AppLocker fixes this in properly managed environments.

      But there is no way, for any OS, to fix "user willingly downloads malware and runs it".

  • If viruses change the way a system functions, wouldn't it just be safer to burn the OS into a chip?

    Seriously, I'm happy with Windows XP. I never need to change it, and MSFT certainly isn't maintaining it anymore.

    Couldn't we just burn XP to a chip and be done with the virus problem forever? Or is there always a need for external (non read only) files?

  • Why do none of you people reinstall when you discover that a machine is compromised? You appear to be using the compromised OS to scan itself. That cannot be reliable.

    • by pyrr ( 1170465 )
      The type of infection in question is very superficial. In most examples I've seen, it doesn't even require local admin permissions to infect a Windows machine. Mostly what it does is loads its executable files and makes a mess of the logged-in user's profile, but it's unable to do much damage at the system level. Some infections seem to be worse than others, it probably just depends on what permissions the current user has.
  • by Torodung ( 31985 ) on Thursday October 01, 2009 @02:19PM (#29608833) Journal

    I'd make a headline change, sub in "users" for "scanners."

    If there was ever a clearer case of PEBKAC, I'd like to hear about it. This is like trying to wall off a cliff to protect the lemmings.

    If people will install random crap off the Internet without first reading a review, getting some word of mouth, and/or downloading it from a trusted source, they're going to get infected. Having an AV is useless if you're going to behave as described in TFA. There isn't a technological solution here.

    An AV can't protect people who don't understand that you shouldn't "fertilize your lawn with motor oil." This is the level of dumb we are talking about here.


  • I wonder if the reason that most of the mainstream AV products fail to classify these fake anti-malware viruses as what they are-- viruses, is some sort of honor code that exists between thieves and extortionists. It's pathetic how the most expensive security products on the market today just refuse to expose and remove a virus that morphs into a well-known trojan when the user gives-in to the threats.

I've noticed several design suggestions in your code.