Beware of Fake Anti-Virus Software

It's an unwritten rule that you never need anti-virus software until you need it badly. The corollary to that edict is that, being signature based, AV programs are only as good as what they already know, and studies have shown that leading anti-malware offerings fail to detect upwards of 50% of malicious code.

If that isn't enough to make you ponder an existence as an internet hermit, then perhaps the concept of fake anti-virus software will push you over the edge.

Researchers are reporting that increasingly, users are tricked by web site pop-ups and bogus warnings of virus infection detections followed by "suggestions" to download readily-available virus removal programs that are themselves malicious code. Once the user willingly runs the program, their machine is immediately compromised and often proceeds to download additional malcode in the background.

What can you do to protect yourself? Here are a couple of key things to remember.

1. Never, ever install a program or run a command unless you are absolutely certain of its source.
2. Ignore pop-ups, warning banners, and browser redirects. Trust me - the Internet is not one big loving community that exists to help you out. Rely only on warnings from programs you've installed yourself.
3. Always have a rescue CD available for virus removal, and don't be shy about using it if you're concerned. Brian Krebs has an excellent post on finding and using rescue CDs at his Krebs on Security blog.
4. Move off of Internet Explorer. I recommend Firefox with the NoScript add-on, but Google Chrome or Opera are other good options.
5. Keep your computer patched. If you're running Windows, enable automatic updates, and use a free product like Secunia PSI to help keep track of updates to popular applications like Adobe Reader, Sun Java, QuickTime, and other frequently overlooked programs.

Let's be careful out there.