Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Fake antivirus overwhelming scanners

Criminals look for easy money

Article comments

Fake antivirus programs are multiplying at such a rate they could start to overwhelm the detection capabilities of signature-based scanners, the latest figures from the Anti-Phishing Working Group (APWG) have hinted.

Rogue or bogus programs passing themselves off as real antivirus software have been one of the malware themes of 2009, but the APWG's numbers for the first half of the year show that the organisation's members detected 485,000 samples, more than five times the total for the whole of 2008.

The reason for the growth in numbers is what is known in technical terminology as ‘polymorphism', an old defence technique which involves changing the binary checksum of every copy (or download) of a piece of malware. This makes it much more difficult for antivirus programs to detect the programs.

"The primary reason for the creation of so many variants is to avoid signature-based detection by legitimate antivirus programs," says PandaLabs' director and APWG member, Luis Corrons in the report. "The use of behavioural analysis is of limited use in this type of malware because the programs themselves do not act maliciously on computers, other than displaying false information."

The figures themselves are the good news because each statistic is, by definition, a detected sample. But these are likely to be only a percentage of the true picture. Fake antivirus software can be hard to catch using heuristics because they are often willingly installed by users who think the programs to be genuine, bypassing systems such as Vista's User Account Control (UAC).

Elsewhere in the report, the APWG reports a 66 percent increase in infected PCs in Q2 of 2009 form the same period on 2008, to a total of 11.9 million, and over the half the total number scanned. This total includes all types of malware and fake AV will only be a small portion of that, but it demonstrates the scale of the problem. Large numbers of PCs are getting infected either because users have no protection or that software is unable to cope with new malware.

Banking and password-stealing Trojans accounted for 16.6 percent of infected PCs during the first half of 2009, downloading Trojans 4.2 percent.

According to Corrons, the rogueware business is controlled by up to 200 gangs globally, but 78 percent of the business could be in the hands of a top ten criminal entities.

The APWG report for January to June 2009 can be downloaded from the organisation's website.


More from Techworld

More relevant IT news


anon said: Many of these programs install when you visit a website behind the scenes so anyone can get hit with one of these

Wesley said: We are pretty much to the point now where you need to be savvy to avoid infections Even the best antivirusltagt cannot help you if you are installing these programs yourselfPeople need education more than they need software if they are going to stop these fake AVs from getting them

Eirik Iverson said: Even a fortress is vulnerable if its occupants leave the main gate open With automated polymorphism on the rise there really is no practical means to discern safe from unsafe software A different better approach exists for stopping malware something like AppGuard DefenseWall or others But users must download the software they install from reputable places

Zariel said: The only thing more alarming than the rogue antivirus is the authors many typos

Able To Spell said: Looks like techworld could use a copy proofreader Id be happy to do the job are you hiring

Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *