Latest information to combat Fake AV

Fake AV has been one of the most challenging malware families I have encountered in a long time.

A friend of mine recently had an encounter with a FakeAV variant.  Her son had been using the computer, and her updated free-AVG had no idea the malware had infiltrated or was present.  Even though there were many pop-ups appearing asking her to pay for the "Security Software" which had detected Trojans on her machine (classic indicator of a FakeAV "RansomWare").

Eventually it was a simple matter of removing a single registry run key in safe-mode and submitting the related file to our labs for further analysis (which we were able to identify immediately).

We were actually a little disappointed that this variant seemed so easy to remove.  We thought it was all over... we were wrong!!

The pop-ups had ceased.  It was like looking at a still pond.  Smooth surface, but plenty of activity happening underneath!

I installed Trend Micro Titanium on her Netbook, which immediately started detecting Web Threats!  Granted, we were not detecting a local file-based infection at that stage - BUT it was blocking the malware's connection home.  This malware will try to connect home to either get an updated malware components, or send sensitive information back "home".  Our Virus Research labs filled in the gaps with the file-based infection response.

< soap_box >

(I hope this doesn't sound like Marketing fluff.)  This really highlights the true power of what the Smart Protection Network means in real-life scenarios.  It's not only for the major enterprises - its also for the "average-Joe" home user, who effectively is the most vulnerable user of all!  Plus the information provided from this ultra-vulnerable source also contributes to protecting our large corporate customers, and visa-versa.

PLEASE enable Web Threat Protection (Web Reputation) in all your Trend Micro installs.  PLEASE enable Email Reputation and Smart Scanning (File Reputation) were applicable too.

Another thing that is highlighted is that you certainly get what you pay for when installing a "Free" Anti-Malware product, and unfortunately this was installed by a person from one of the franchise computer services companies who should really have known better!

< /soap_box >

Anyway.  I trust you will enjoy having a read through this whitepaper which aims to educate users on how FakeAV gets onto their machines, and best to protect themselves from it happening in the first place!

Have a great rest of the week everyone!
Regs
Kieran