A new variation on the Fake Anti-Virus scam actually launches legitimate uninstallers of anti-virus programs from Symantec, Microsoft, AVG and others.
A new variation on the Fake Anti-Virus scam actually launches legitimate uninstallers of anti-virus programs from Symantec, Microsoft, AVG and others.The phony anti-virus scam keeps getting new wrinkles, the latest being a pop-up Anti-Virus alert that warns users that their security program is uncertified and must be replaced. When the alert is clicked, it launches the user's legitimate anti-virus uninstall program.
Symantec notes that the Trojan carries uninstall launchers for "Symantec, Microsoft, AVG, Spyware Doctor, and Zone Labs." I would imagine that it won't be long before other security vendors find their products' uninstallers added to the payload.
Once the user's legit security software is uninstalled, the Trojan replaces it with "AnVi Antivirus" which is itself a variant of the well-known CoreGuard anti-virus scamware.
If you haven't reminded your staff of the prevalence -- and persistence -- of fake a-v threats in awhile, this is a good time to do so. Let them know that:
No anti-virus pop=up warning or alert should ever be taken seriously (other than as a threat). And remind them that no pop-up should be clicked at all, including its close button. The window should be closed, and users should immediately double-check their legitimate anti-virus programs, including an update of virus definitions.
Obviously, fake anti-virus warnings aren't going away, but employee gullibility -- and in consequence your company's vulnerability -- can be dramatically reduced just by spreading the word, and continuing to on a regular basis, and certainly with every new variation on the attack.