Fake AV Now poses as part of Security Center!

General Topics
1

Hi malware fighters,

Cybercriminals now took their schemes just a step further when a rogue av now makes itself part of Windows Security Center by replacing that executable with a fake one. It disables your genuine av solution and MS Defender, re: http://www.sophos.com/blogs/sophoslabs//?p=4096

polonus

2

I’m quiet sure that there are many people which will gorge the hook. :-
(…to gorge the hook… does this term even exist?.. its from my dictionary ;D)

Hopefully Avast! will be able to remove this ???

3

The word exists but I’m not sure this is the right context… or at least I would opt for a different expression such as: “I’m quiet sure that there are many people who will fall for this, hook, line, and sinker.”

Hook, Line and Sinker means:

To be fooled hook, line and sinker is an idiomatic expression, meaning that someone has been fooled beyond merely "taking the bait".
taken from:http://en.wikipedia.org/wiki/Hook,_Line_and_Sinker

But besides the point. Sorry for the ramble.

I’m hopping it will be able to Prevent this rather than remove it.

@ Polonus:
Thank you for the post.
Any info on how this thing spreads i.e. are you asked to make a download, or install an update at which point this gets on your machine?

Thanks.

4

Thank you for your explanation :slight_smile:

And you are right - prevention should be more important than the removal, as most of us aren’t infected :wink:

5

I just spent 2 1/2 hrs at a friends house last night on on of these Fake AV’s
I ran a boot scan of avast! but it detected nothing.
When I tried to go on-line to download Malwarebytes Anti-Malware, it blocked
access to it’s website.
Lucky for my frieds that I came prepared with a secured USB Drive which had all of the
needed programs on it.