The Anti-virus Times

Thursday, August 23, 2018

If we remove an application from our computer, we can rightly assume that all its components will be uninstalled. Of course, junk like registry keys, temporary files, and empty folders often remain in a system after a program has been removed, but sometimes real surprises can await you.

Once upon a time, a user decided to install a popular free anti-virus that was known to provide "reliable security". The program resided quietly in the system memory just like any normal anti-virus should and occasionally prompted the user to switch to a paid subscription. And this would have gone on indefinitely until the next encryption ransomware outbreak had it not been for the fact that the user liked to read the Anti-virus Times, from which he once learnt that his free anti-virus could nab any suspicious file in the system and send it straight to the developer's server, even if the file contained personal data.

The user got really upset and deleted the free anti-virus and replaced it with Dr.Web Security Space 11.5 which has a built-in firewall.

A day passed, and then suddenly a firewall prompt appeared on the screen, warning the user that an unauthorised outbound connection was about to be established. And that wouldn’t have been a big deal except for the fact that the message referred to the all-too-familiar free anti-virus.

"How could that be?", the user wondered. The free anti-virus had been removed completely by the windows installer and wasn't even listed among the installed programs.

But then the user checked the file path in the firewall's message and miraculously discovered the intruder in the Common Files directory.

So, the free anti-virus was removed but an application featuring the anti-virus developer's logo persisted in a folder whose name matched that of the anti-virus company, and the file was signed using a valid certificate from that very company.

It didn't take long to find out that the program didn't just occupy a small portion of disk space but was being launched routinely every day (this procedure was established in the Task Scheduler) and forwarding some data to a remote host.

To learn more about the program, let's look at the anti-virus developer's official forum. Here is what the developer tells us about the application:

So it appears that the program is tasked with monitoring and resolving issues related to the anti-virus software. It can retrieve updates and determine whether the anti-virus services are working properly.

It can retrieve updates even though the anti-virus is no longer present in the system.

Does the developer's EULA say anything about this?

In the most general sense, this may indicate that one day an advertising module or another application a user has no need for may appear in their system and everything will be perfectly in line with the terms of the license agreement.

Hold on, you're probably saying, but once the free anti-virus is removed, the agreement becomes null and void, right? Then how can the application persist in a system?

Well, the developer can always claim that this happened because of a technical issue and that the agreement terms users accept during installation gives the company this right. Under the agreement, the company doesn’t have to explain anything to users and can't be held accountable by them.

Read the agreement carefully, and you'll understand that in fact the free anti-virus is not obligated to neutralise malware.

#security #free_anti-virus #license_agreement