Glaswegian

Fake antivirus programs are multiplying at such a rate they could start to overwhelm the detection capabilities of signature-based scanners, the latest figures from the Anti-Phishing Working Group (APWG) have hinted.

Rogue or bogus programs passing themselves off as real antivirus software have been one of the malware themes of 2009, but the APWG's numbers for the first half of the year show that the organisation's members detected 485,000 samples, more than five times the total for the whole of 2008.

The reason for the growth in numbers is what is known in technical terminology as ‘polymorphism', an old defence technique which involves changing the binary checksum of every copy (or download) of a piece of malware. This makes it much more difficult for antivirus programs to detect the programs.

"The primary reason for the creation of so many variants is to avoid signature-based detection by legitimate antivirus programs," says PandaLabs' director and APWG member, Luis Corrons in the report. "The use of behavioural analysis is of limited use in this type of malware because the programs themselves do not act maliciously on computers, other than displaying false information."

The figures themselves are the good news because each statistic is, by definition, a detected sample. But these are likely to be only a percentage of the true picture. Fake antivirus software can be hard to catch using heuristics because they are often willingly installed by users who think the programs to be genuine, bypassing systems such as Vista's User Account Control (UAC).


http://news.techworld.com/security/3...nners/?olo=rss