Rogue antispyware/antivirus software

Threat description

Details

CATEGORYMalware
TYPERogue

Summary

Deceptive or fraudulent antispyware/antivirus software that uses misleading or high-pressure tactics (e.g., falsely claiming a malware infection or deliberately infecting the machine) to pressure users into installing or purchasing the software.



Removal

Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.

Security programs will sometimes unintentionally identify a clean program or file as malicious if its code or behavior is similar to a known harmful program or file. This is known as a False Alarm or False Positive (FP).

For example, 'tmp.edb' and other '.edb' files stored at the location 'C:\WINDOWS\SoftwareDistribution\DataStore\Logs\' may be unintentionally detected as malicious by various security programs.

Checking for a fix

In most cases, a False Positive is fixed in a subsequent database release; updating your F-Secure security product to use the latest database is enough to resolve the issue. If you suspect a detected file may be a False Positive, you can check by first updating your F-Secure security product to use the latest detection database updates, then rescanning the suspect file.

Send a sample to F-Secure Labs

After checking, if you believe the file or program is still incorrectly detected, you can submit a sample of it to F-Secure Labs for analysis and correction:

Exclude a known safe file from further scanning

If you are positive that the suspect file is safe and you want to continue using it, you can exclude it from further scanning by the F-Secure security product:

You may also refer to the Knowledge Base on the F-Secure Community site for more assistance.

Also

Microsoft provides enterprise-level instructions for excluding files from scanning by antivirus software:

Further actions

In some cases, a rogue may have been silently installed on the system in a 'drive-by download'. In such cases, disinfection should be accompanied by a check to determine if any programs require updating or patching; if so, please refer to the program vendor's site for further details.

Technical Details

Rogue antivirus/antispyware programs (generally known as 'rogueware' or 'rogues') are security applications that use misleading, high-pressure, fraudulent or malicious sales tactics to convince users into installing and/or purchasing the product.

The quality of the purchased software itself is also suspect; once installed, the product may not perform as expected. Some are simply substandard products that present false information or false positives due to bugs in the software's code, rather than because of an outright deception. Code corrections can move a suspect program off the rogueware detection lists. Other rogues however are intentionally malicious and either do not bring no benefit to the user, or actively interfere with the computer's operations or compromise the user's data.

Rogue antispyware or antivirus programs typically closely mimic legitimate applications, using similar (or even identical) styling and packaging to convey legitimacy. As such, it can be difficult for both technical and non-technical users to differentiate between legitimate and rogue applications.

For more information about rogues, please see Article: Rogues

Submit a Sample

Suspect a file or URL was wrongly detected?
Send it to our Labs for further analysis

Submit a Sample

Scan & clean your PC

F-Secure Online Scanner will scan and clean your PC in just a few minutes for free

More Info