Security News SmartService acts like an Adware Bodyguard by Blocking Antivirus Software

[Solarquest]

In the past, adware and potentially unwanted programs were designed to show advertisements or change your homepage without fear of legal action due to working under legal entities or using End User License Agreements (EULA). Emboldened by the lack of legal action against them, these types of companies have started to increasingly exhibit behavior that clearly puts them in the category of backdoors, rootkits, & Trojans.

SmartService: A PUP & Adware's Bodyguard
This is clearly shown with an infection called SmartService that is being heavily distributed with almost all current adware or "offer" bundles that people typically encounter when installing free downloads.

While BleepingComputer was getting many reports about people unable to launch their security programs, it wasn't until after I received a sample from Zemana malware researcher Djordje Lukic that I realized that this was being installed as part of a PUP installer called sMark5 that states it is an anonymous VPN service. sMark5 has been around for quite some time, but only recently started adding SmartService as part of its payload.
....
....
When SmartService is installed it will create a Windows service, which loads a driver that blocks many security programs from being executed on the computer, prevents the terminating of protected processes, and prevents the deletion of registry keys associated with these processes. This service essentially acts as a bodyguard to the other crapware that is installed along with it.
.....
.....

 

[shmu26]

Why doesn't the AV prevent SmartService from being installed in the first place?

 

[Amelith Nargothrond]

Why doesn't the AV prevent SmartService from being installed in the first place?

Good question. This is malware behaviour.

 

[Arequire]

Why doesn't the AV prevent SmartService from being installed in the first place?

Good question. This is malware behaviour.

They do.

As most security software is detecting SmartService, as long as you have an updated anti-malware or anti-virus program running, you should not get infected by this program.