400,000 PCs Infected With Fake "Antivirus 2009" 353
nandemoari writes "The second month of Microsoft's campaign against fake security software has resulted in the removal of the rogue "Antivirus 2009" application from almost 400,000 infected PCs. Microsoft claims that December's version of the Malicious Software Removal Tool (MSRT) — the free utility included in Windows Update every month — specifically targeted 'Antivirus 2009.' According to Microsoft, MSRT removed the rogue application from over 394,000 PCs in the first nine days after it was released on December 9."
Wildly annoying one. (Score:5, Insightful)
I really don't have the time or interest to figure out if the AV is just sucking, and not reporting infections that actually do exist, or if whoever is pushing the software has compromised a bunch of ad providers; but it seems to be a big issue in windows land(poor bastards).
Re:Malwarebytes (Score:4, Insightful)
The annoying thing though, most of them installed it themselves, deliberately, thinking they were doing "good".
Bah. Hang the authors of "Antivirus 2009" up by their nadgers.
Is this troublesome to anyone else? (Score:3, Insightful)
The idea of MSFT deleting a program (albeit a piece of malware) from my machine bothers me.
When will their idea of malware differ from mine?
Will they always do it correctly (no collateral damage)?
Understating the menace. (Score:5, Insightful)
This family of infectors is probably, by far, the worst spyware/hijacking peice of junk I've ever seen. I can't help but feel that 400,000 isn't nearly the number that has actually been infected, simply because nobody I know actually uses MSRT, and I seriously doubt that any machine that gets infected with it could actually get back into the condition where it can download and/or install MSRT, or virtually any other software. It's just that bad.
Re:Is this troublesome to anyone else? (Score:5, Insightful)
Well, the reason you install these programs like Defender is so it deletes the malware for you.
Replace Microsoft with Kaspersky, AVG or one of those other "reputable" AV vendors and ask the same question. They have just as much ability to delete a program.
Re:how many users will complain about removal? (Score:3, Insightful)
An amusing notion, but it'll never happen for two reasons:
1) EULAs may or may not be enforceable in their usual sense, but a requirement that you can't remove the software doesn't even make sense. The concept of a EULA is that you must agree to the terms in order to use the software. If you're not using the software (i.e. you remove it) you're not bound by the terms anymore.
2) Since this is intentionally malicious software and almost certainly constitutes at least one form of fraud, the owner publicly identifying themselves would be a bad plan. Not only are they unlikely to win a legal battle with MS in civil court (the fraud might even make the EULA automatically invalid or some such), but they might well end up facing criminal charges as well.
IANAL, and one can always hope the malware authors get stupid, but this doesn't seem a likely scenario.
I'm tired of users like you (Score:4, Insightful)
I'm not saying this as flamebait but I'm really tired of users who consistently post in forum after forum that they don't run antivirus, firewall, or antimalware applications. Then, just like you, they claim they don't have any infections. How would you know even if you had an infection without running a scanner? Online scanners are great but they only cover files that you're going to run of your own volition. They do not cover infections that occur through holes in the browser and/or OS. This is where the fundamental problem lies in your strategy.
Case in point, lets say you browse to a website that uses a hole in your browser to get code onto your system that opens a port via UPNP in your router. Then through the open port your machine starts infecting/spamming others. How would your methods guard against that?
Safe computer habits are great when you can trust your Operating System and browser to be secure all while you're not logged in with an account with "Administrator" (root) level privileges. Too bad Windows can't be trusted to be secure and, therefore, necessitates the need for antivirus, antimalware, and firewall.
it got me (Score:2, Insightful)
Re:When will people learn (Score:2, Insightful)
One rogue program removed per month? (Score:4, Insightful)
So how long will it take to clean up the entire population of Windows PCs?
This kind of propaganda is counterproductive. First of all, this is a negligible effect, secondly it pretends that MS takes care of Windows users, and thirdly it doesn't emphasize that safe computing is far more important than all security software in the world.
Re:When will the Malcious software removal tool... (Score:1, Insightful)
hahahahahahaha
oh dear me how original and hilarious.
joke is so old now.
Re:I'm tired of users like you (Score:1, Insightful)
You're still trusting your security to a scan every few months. You're more likely to have a lower infection rate by running a good on-access virus scanner on your machine even if another scanner (such as Mcafee) ignores some files.
First of all, how would you know a site found an exploitable hole? I'm pretty certain you're not monitoring every security mailing list on the internet. Even if you were would you run a full system scan every time a new exploit came out? It seems like a pretty big waste of resources. Secondly, we all use Process Explorer but do you leave it running all the time and monitor every process running on your machine in realtime? What about big all encompassing processes like svchost.exe that run multiple services? Do you monitor the load modules and stacks in realtime? Most times people fire up Process Explorer because something is pegging their CPU usage.
What happens when the next piece of malware comes out what runs at a low priority, can detect an idle network connection, and can hide itself as another legitmate process? Oh wait, they already exist. I somehow doubt you monitor all of this in realtime because if you were paying attention to everything then you'd have very little time to do "real work" on your computer. This is why these realtime scanning agents were created.
Vigilance of every process in realtime on your machine is exactly what a virus scanner does. However, as a person who runs his computer 24/7 and always connected to the internet, how can you claim to be vigilant?
The worst part of overly self-confident posters like you is you try to train others in your system. For example you stated you taught your sister your system. Does she use process explorer too? Does she monitor her bandwidth usage as well? Therein lies my problem with your post. In this day-and-age running Windows without antivirus and antimalware scanners is all the rage amongst the "too cool for you" self-proclaimed computer geniuses littering the web's gamer forums. You wouldn't believe how many times I've been asked to fix someone's computer only to hear that they "read somewhere that virus scanners aren't needed." Therefore people like you are the problem just as much as those who don't manage their own computer's safety. All it takes is a couple thousand machines to bring down spam/infect tens of thousands of others.
Re:The best antivirus solution (Score:0, Insightful)
Using an insecure OS that nobody cares about is NOT security. dumbass.
Re:The best antivirus solution (Score:1, Insightful)
Using an insecure OS that nobody cares about is NOT security. dumbass.
There ought to be a moderation type made specifically for this kind of a post.