Antivirus

Avast security tools hijacked in order to crack antivirus protection

Researchers spot new campaign that can turn off antivirus protection Malware uses legitimate Avast Anti-Rootkit driver to access kernel level Once antivirus is deactivated, the malware can proceed without detection Hackers are using a legitimate Avast Anti-Rootkit driver to disguise their malware, turn off antivirus protection, and infect systems, experts have warned. The vulnerable driver


  • Researchers spot new campaign that can turn off antivirus protection
  • Malware uses legitimate Avast Anti-Rootkit driver to access kernel level
  • Once antivirus is deactivated, the malware can proceed without detection

Hackers are using a legitimate Avast Anti-Rootkit driver to disguise their malware, turn off antivirus protection, and infect systems, experts have warned.

The vulnerable driver has been exploited in a number of attacks since 2021, with the original vulnerabilities being present since at least 2016, research by Trellix, has claimed, noting the malware can use the vulnerable driver to end the processes of security software at the kernel level.

The malware in question belongs to the AV Killer family, with the attack using a vector known as bring-your-own-vulnerable-driver (BYOVD) to infect the system.

Virus can turn off antivirus

Trellix outlined how the malware uses a file named ‘kill-floor.exe’ to place the vulnerable driver named ‘ntfs.bin’ into the default Windows user folder, before using the Service Control executable (sc.exe) to register the driver using the ‘aswArPot.sys’ service.

Included within the malware is a hardcoded list of 142 processes used by common security products, which is used to check system process snapshots for any matches.

The malware then uses the ‘DeviceIoControl’ API to run the relevant commands to end the process, thereby preventing the antivirus from detecting the malware.

The hardcoded list includes processes belonging to a number of security products from names such as McAfee, Avast, Microsoft Defender, BlackBerry, Sophos, and many more.

As BleepingComputer points out, this isn’t the first time a BYOVD attack has exploited a vulnerable Avast driver, with the 2021 Avoslocker ransomware attacks abusing an Avast Anti-R

Read More

Be the first to write a comment.

Leave a Reply

Your email address will not be published. Required fields are marked *

Antivirus

Hackers Aren’t Just After Your Devices

Antivirus isn’t enough—hackers are after doors they can open…

Antivirus isn’t enough—hackers are after doors they can open…
Read More

Continue Reading
Antivirus

Police takes down AVCheck site used by cybercriminals to scan malware

An international law enforcement operation has taken down AVCheck, a service used by cybercriminals to test whether their malware is detected by commercial antivirus software before deploying it in the wild. …

An international law enforcement operation has taken down AVCheck, a service used by cybercriminals to test whether their malware is detected by commercial antivirus software before deploying it in the wild. …
Read More

Continue Reading
Antivirus

Microsoft oversells Windows 11’s Smart App Control as a “top antivirus solution”

Smart App Control is a Windows 11 security feature that requires a clean OS installation to work as intended. According to a recent post from Microsoft, users who upgrade and enable the feature will benefit from enhanced security. However, the company provides vague and arguably misleading explanations that could do…Read Entire Article…

Smart App Control is a Windows 11 security feature that requires a clean OS installation to work as intended. According to a recent post from Microsoft, users who upgrade and enable the feature will benefit from enhanced security. However, the company provides vague and arguably misleading explanations that could do…Read Entire Article…
Read More

Continue Reading
Antivirus

New ‘Defendnot’ tool tricks Windows into disabling Microsoft Defender

A new tool called ‘Defendnot’ can disable Microsoft Defender on Windows devices by registering a fake antivirus product, even when no real AV is installed. …

A new tool called ‘Defendnot’ can disable Microsoft Defender on Windows devices by registering a fake antivirus product, even when no real AV is installed. …
Read More

Continue Reading