We saw a report at DSL Reports from Lavasoft (and an attendant blog entry) about a new variant of rogue antispyware program SpySherriff on that might be on the loose.
It is reported to “delete Ad-Aware, Spybot and possibly other Anti-Spyware / Antivirus software”. <gulp>
This put our spyware team on a wild goose chase, only to discover that this thing is likely a chimera. We were able to find a copy of SpySheriff on a site, but it looks like the same old program. At that same website, however, one researcher here was infected with a nasty worm (probably unrelated and the infection was also due to running a naked XP system — unpatched, no SP2).
Lavasoft is a highly respectable outfit and I have every reason to believe they are getting user reports so we are really curiosu about this one.
If anyone sees this thing out there, let us know. So far, we have not observed it in the field but one never rests in the antispyware business 😉
Alex