DLS 101 - How to spot a fake Windows antivirus program

by Lee Mathews on July 20, 2009 at 10:00 AM


One of the most common problems I tackle on Windows computers is the removal of rogue antivirus programs. Just what is a rogue antivirus? It's malware that disguises itself as a legitimate antivirus program.

Unlike Avast, AVG, Kaspersky, Norton, or any of the other real antivirus options out there, a rogue will do nothing to protect you. Rather, it's going to try to deceive you into paying for a full version or removal tool. It may even open a backdoor to your system and start downloading other annoying, nasty programs.

How do these programs get on people's computers in the first place? Usually through deceptive pop-ups on web. Often these "alerts" will try to trick you into thinking:
  • porn and illegal files have been found on your computer
  • a scan has found virus and malware infections on your system
  • your system is totally unprotected
They're all scare tactics designed to get you to clicking something that you really don't want to click. Some go to great lengths to deceive, copying actual Windows screens as closely as possible.

Here are some things to look for:
  • cheesey names - never mind the old adage, with these programs you usually CAN judge the book by its cover. Rogue antivirus programs typically use names like Antivirus 360, WinAntivirus 2009, Spyware Police, SpywareProtect, etc.

    Wikipedia has a huge list of known fake programs. It also helps to get familiar with big-name, legitimate software (like these free antivirus programs for Windows).

    Remind yourself that if you don't recognize the name, don't click.

  • alerts that just don't belong - Windows will tell you if you're not running antivirus software or the definitions are out of date, but it won't tell you that an infection has been found. Windows Defender will pop up alerts, but not Windows itself or the Windows Security Center. Alerts that claim Windows has found infected files are pulling your leg.

  • poor grammar - Windows has its weak points, but real system messages are usually very well written and clear. Alerts from rogue apps don't have the same attention to detail.

  • bogus scanning - lots of these apps pretend to scan your system and find all kinds of infected files. Watch what folders and files are being scanned and see if they match the infected files being found.

    If the scan is going through c:\windows\ and infected items in folders like c:\temp or c:\documents and settings\ are popping up, it's bogus. Real virus scanners will display infected items as soon as they find them in the folder that's currently being scanned - not random stuff from who knows where.
How do you know if you've already been tricked into installing one of these applications?
  • your wallpaper has been changed and the image says something about being infected
  • every time you reboot a scan window pops up
  • whenever the scan completes, you're asked to register or pay in order to remove the infections
If this sounds like your system, take a look at this list of programs which help you clean up your own messes. They just might save you a trip to the repair shop!

Tags: antivirus, dls-101, dls101, malware, rogue-antivirus, security, spyware, trojan, virus