Adware Virus Turns Out Trick-Through Certificates

An adware family that has been active for several years used a new trick to disable virus scanners and other security software on computers, so it is regarded as a trojan. Once the active adware start a variety of tasks that show advertisements on the computer.

In addition, all shortcuts to be adjusted at the desktop, taskbar and Start menu. What is new is that the adware 13 certificates of anti-virus companies such as Avast, AVG, BitDefender, McAfee, and Malwarebytes, now classifies as 'not trusted'.Therefore applications such certificates can not be started. Because of this method, anti-malware Malwarebytes company decided to brand the adware henceforth as a trojan.

Kaspersky: Angry Ex-Employees Behind Bogus

Yesterday Reuters with a story that Russian anti-virus firm Kaspersky Lab competitors like AVG, Avast and Microsoft did years sabotaged, but according to founder Eugene Kaspersky and the anti-virus company is a nonsense story from angry ex-employees.

The story would have provided the anti-virus company legitimate files from malicious code. These files are then uploaded to the VirusTotal website and shared with other anti-virus companies. VirusTotal is a website where Internet files can be scanned dozens of virus scanners. Uploaded files are shared with participating anti-virus companies. By uploading the files sabotaged legitimate files the virus of anti-virus companies would therefore be regarded as malware.

Kaspersky Lab that the statements are unfounded and untrue and made ​​by angry ex-employees. The anti-virus company shares data correctly with other parties. "Although the security market is very competitive, is the exchange of threat data is an important component of the security of the entire IT ecosystem and we work hard to ensure that this exchange does not jeopardize or sabotaged."

Experiment

Well carried out the anti-virus company in 2009 and 2010, two experiments in which clean files to VirusTotal were sent and Kaspersky Lab files considered intentional malware. A few months later found several other scanners on VirusTotal that the files were infected, even though that was not the case. Kaspersky Lab made ​​the investigation public . In their own words to indicate that the problems with the testing of malware.

Ex-employees

On his own blog is Eugene Kaspersky also on the story and denounces in particular the use of anonymous sources. "Angry ex-employees often say nasty things about their former employer, but in this case the lies are simply ridiculous." According to Kaspersky, the resources possible to convince the journalist of Reuters know, but the story is ultimately published without any evidence. "I therefore ask myself what these ex-workers' media tell us about the next time and who believe their bullshit then."

In the blog posting Kaspersky also discusses the problem with false positives. In 2012 and 2013 had anti-virus companies many problems with false positives. An attacker provided legitimate software from malicious code and spread it. Both Kaspersky Lab and other antivirus companies were targeted. There was then a meeting behind closed doors, where there is information about the attacks was exchanged. This also was the suggestion suggested that another anti-virus company possible was behind the attacks. Symantec confirms the story and says that Kaspersky Lab, in any case, none of the suspects.

Kaspersky Accused Of Sabotage Anti-virus Companies

The Russian anti-virus firm Kaspersky Lab would have the virus for years of competing anti-virus companies sabotaged to show to clean files for malware, so important files were deleted or quarantined.

Let two former employees facing Reuters know. Kaspersky Lab, however, denies any wrongdoing. According to former employees, there was a secret campaign against Microsoft, AVG, Avast and other competitors that lasted for ten years. The plan would be carried out with the knowledge of Kaspersky founder Eugene Kaspersky. According to former employees, who wish to remain anonymous, Kaspersky found that the competition software imitated.

Microsoft, AVG and Avast showed earlier told Reuters that unknown parties in recent years had tried to cause false positives, such as the improper detection of clean files as malware is called. According to the former employees of Kaspersky were provided important files from malicious code, to upload them then to VirusTotal. This website Google scans files with dozens virus. Uploaded files are then shared with connected anti-virus companies.

If the malicious file seemed adequate to the original, the virus would clean file as malware can label. Microsoft says that in 2013 discovered thousands of these files and warned here at that time also ( pdf ). Kaspersky Lab said in a statement that it has never carried out such a secret campaign to mislead competitors with false positives. "Such actions are unethical, unfair, and if it is legal, at least questionable," said the Russian virus fighter.

Update

Eugene Kaspersky cites Reuters story on Twitter complete nonsense. "Usually I do not read to Reuters, but when I do I see false positives. This story was complete nonsense."

Apple Removes Antivirus Apps From App Store For Misleading

Apple has removed antivirus apps in the iOS App Store because the description was misleading and could make customers think that there are viruses for the operating system, claims one of the affected anti-virus companies. Wednesday came Intego Virus fighter with the message that the program Virus Barrier Apple had been removed. This allows users to receive any program updates, as they walk through the App Store.Virus definitions are still updated, as it goes through a different channel.

VirusBarrier is an app that can scan files on iPads, iPhones and iPods, such as e-mail attachments. "Your iOS device can serve as a gateway for malware and viruses. Infected attachments can to your computer, your friends, family and colleagues to be sent," the description. According to Intego was the action of Apple not only against the company, but different companies would have been affected. Opposite MacRumors explains the CEO of Intego that Apple was misleading description of the app, because the customer might make you think that there are viruses for iOS would be in circulation.

Intego went against the removal appeal. "We were as clear as possible that this was not a scanner, that the e-mail attachments and cloud files scanned." Despite this explanation Apple decided not to reinstall the app. Why Apple has removed the apps is unknown. Last year decided Intego Virus Barrier itself from the Mac App Store to remove because it was not possible to offer a scanner that would conform to the expectations of users.