Microsoft Malicious Software Removal Tool Now Remove Rogues and Fake Alerts

by malwarekilla on December 9, 2008

Bravo for Microsoft!  This month's release of the Malicious Software Removal Tool removes rogue antivirus (like XP Antivirus 2009) and fake system alerts (like "you have a security problem" or "Your computer is at risk").

In the first week alone the MSRT removed over 900,000 rogues in the US!  Here is an excerpt from the MS Malware Protection Center


Symantec BOGO + Free Shipping

Also Known As:
Win-Trojan/Downloader.56320.M (AhnLab)
Win32/Adware.XPAntivirus (ESET)
not-a-virus:Downloader.Win32XpAntivirus.b (Kaspersky)
FakeAlert-AB.dldr (McAfee)
W32/DLoader.FKAI (Norman)
Mal/Generic-A (Sophos)
XPAntivirus (Sunbelt Software)
Downloader.MisleadApp (Symantec)
XP Antivirus (other)
Antivirus 2009 (other)
Summary
Trojan:Win32/FakeXPA is a family of programs that claim to scan for malware and display fake warnings of “malicious programs and viruses”. They then inform the user that they need to pay money to register the software in order to remove these non-existent threats.

Special Note:
Reports of rogue Antivirus programs have been more prevalent as of late.  These are programs that generate misleading alerts and false detections in order to convince users to purchase illegitimate security software.  Some of these programs, such as Trojan:Win32/Antivirusxp and Program:Win32/FakeRednefed may display product names or logos in an apparently unlawful attempt to impersonate Microsoft products.  These products may represent themselves as “Antivirus XP”, “AntivirusXP 2008”, “WinDefender 2008”, “XP Antivirus”, or similar.

Use Microsoft Windows Defender, the Windows Live safety scanner (http://onecare.live.com/site/en-us/default.htm), or another up-to-date scanning and removal tool to detect and remove these threats and other unwanted software from your computer. For more information on Microsoft security products, see http://www.microsoft.com/protect/products/computer/default.mspx.

{ 2 comments… read them below or add one }

James Baldwin December 9, 2008 at 7:56 pm

This is all well and good but MRT is only updated once a month and it can’t fix every problem. People will soon find ways of circumventing it all together and then it’ll be pointless. I’ve seen on heavily infected computers often you cannot open the MRT so…

malwarekilla December 10, 2008 at 2:42 pm

@James – I was just happy that Microsoft is finally starting to take the rogue antivirus and fake alert stuff seriously.

Leave a Comment

Previous post:

Next post: