Windows 7: Antivirus nightmare.

More -
Larry Dignan's antivirus nightmare - Computerworld Blogs

I only have NIS 2010. I thought I was sufficiently protected.

I've never used any more than 1 antivirus program. There is something serious wrong with windows if you need multiple AV applications to simply keep your computer running.

He unfortunately had a TDSSServ.sys trojan / rootkit involved with Antivirus Pro 2009 ... not too many antivirus programs can detect and/or remove it.

You are right, TDSS is also present in MS AntiSpyware 2009. Indeed this is very clever and very hard to detect/remove infection since it can control AddPrinter function of the spoolss.exe process at driver (LPC transport) level.

Hi there
Are you really telling me that a program shipped by MS actually has a virus in it -- or have I mis-understood something here.

If the program really does contain a virus I just shudder to think of the lawsuits MS will be facing.

Please tell me I mis-understood the post.

Cheers
jimbo

Hi Jimbo,

you are wrong here. MS AntiSpyware is NOT Microsoft product. Have a look at VirusTotal analyze: Virustotal. MD5: 5a34fd85bdac65d50a56a2c69228a726 Packed.Generic.187 VirTool:Win32/Obfuscator.EF High Risk Fraudulent Security Program
and my video on YouTube: http://www.youtube.com/watch?v=LRcxMhiHXGQ

MS AntiSpyware 2009 (MSAS2009 or msas2009.exe) is FAKE AS.

Hi there

this is an easy error to make as MS implies Microsoft -- perhaps the "product" should not be called MS Antispyware -- surprised MS haven't protected their trademark.

It's like saying MS outlook or MS windows aren't MS products.

However with AV software or anything else labelled MS ----- I would check to see if it is a Licensed MS product before even thinking to install it.

Reading the original post I'm sure most people who didn't know would assume MS antispyware was an MS product.

Cheers
jimbo.

Yes I agree with you, but this is how it works (marketing approach?)... and it allows malware writers to cheat more not computer/security savvy users than ever. The best practice in such casesis to determine whether a program has digital signature signed by Microsoft or other security vendor, check in google/bing whether a program is malicious, scan before install via VirusTotal or our AV/AS/AM scaner - you should be sure on 100% that software which you want to install is 100% safe - there is no room for error, unless you do it on VM and you know what you are doing.

Many viruses/malware will pose themselves as a normal operating file, when infact they are malicious.
The particular one above is hidden in Drivers.