What's In a name: Rogue Antivirus

Greetings Viewers,

You may have read my popular blog post What do these terms mean?

But I do not think I did a few pieces of malware on that list justice, so this is going to be the first in what I hope to be a series of posts on some kinds of malware that I think deserve a better description. And I can think of no better place to start then on my favorite kind of malware: Rogue Antivirus Software.

Rogue Antivirus Software, also called Rogues, or Rogue AVs, are pieces of malware that download and install themselves to your computer without your knowledge or consent. Once the rogue is activated or turned on, it starts a simulated scan of your hard drive. Most rogues detect false infections, that is, infections that are not actually on your computer. So the most important thing to know is that none of the malware it reports as being on your PC is actually on your PC, the program is just messing with you.

The rogue often tells you that you have a large amount of "infections," (100 or more is not uncommon) and demands payment for the "removal" of the "infections." Most rogues disable program execution in some way, such as blocking task manager, web browsers, regedit, (A internal registry editor in Windows) and more. The license for the rogue often varies in price, anywhere from $39.95 to $85.95. Some rogues also open your internet browser and take you to some rather.... unsavory websites to reinforce the lie that your system is infected. Rogues often block you from going to specific websites, claiming that they are infected.

Rogues often have misspellings, bad grammar, and the like. This is often the first clue that the program is a rogue, not a real antivirus software. Rogues often attempt to impersonate real antivirus software in an attempt to make you believe that the rogue is actual antivirus software that you need to pay for to get rid of that malware on your computer. Rogues are often installed along with a rootkit or Trojan, and removal can be tricky depending on how many programs the rogue blocks.