Virus authors have developed a strain of malware that attempts to con users into uninstalling legitimate security packages.

A rogue package called AnVi Antivirus generates a cheeky pop-up message suggesting that legitimate apps are “uncertified" and ought to be removed. Failure to take action would result in drastically degraded computer performance, marks are disingenuously warned.

Many malware packages, including the Conficker worm, are designed to silently disable anti-virus software and security updates on infected machines. The AnVi Antivirus rogue differs because it uses social engineering techniques in an attempt to trick users into uninstalling security packages.

The rogue will also attempt to remove legitimate packages from the likes of Microsoft, AVG, Zone Labs and Norton even if users fail to comply with the bogus request to uninstall pukka security software. Such an approach, of course, ought to be blocked if the security packages are doing their job.

But on machines with outdated security definition files the attack may work.

More -
Scareware tries to trick marks into dropping defences • The Register

Posted By: JMH
21 Aug 2010