# How to counteract a trojan horse when the horse is the anti-virus software?

I have got caught behind the 'irresistible force meets immoveable rock' conundrum.

A predatory country has been making very long-term plans for building an empire.

This country, as part of a very long-term plan, created an apparently government-independent anti-virus company that has created the world's best anti-virus software. World's best, because a great deal of the virus and ransomware has been developed and released by sister organizations created by the government for this purpose, so of course their software knows how to eliminate these threats.

It is so good, it developed a word-wide reputation, and was adopted by many of the biggest firms for their firewalls. In fact, the developers of the BIOS and operating systems, and even the chip designers, worked with this company to implement 'hooks' directly into the very basic system boot software. Of course the software was rigorously scrutinized by the biggest security firms, and they all conclude it does exactly what it says it does - protects against threats - and nothing more. It contains no malicious code, in even the most thorough testing and software reverse engineering. Even though no one really trusted the government, the antivirus software company remained squeaky clean and apparently completely independent of government intervention, or so everyone assumed.

The problem is, it is so trusted and effective that it becomes generally accepted that it is necessary to be active from the very first steps of boot up, so as to not be vulnerable to any viral code. Since it is the first thing that is run, nothing can get in front of it. Hence, the tremendous thorough dissection of the code.

So, the malicious government decides to act. The Trojan is the action of the software itself. In the ongoing updates of viral signatures and 'threat identifications', the anti-virus software is directed to quarantine essential code in the operating system itself. The anti-virus software prevents the normal operating system from even booting. Since the system can not be booted, the operating system can not be updated. The system is blocked at boot, so not even a 'safe boot' can bypass the antivirus code. No matter what is tried, the antivirus software recognizes the operating system itself as the threat, and stops it. And since the hooks are in the hardware itself, there is no way around then except to completely replace the hardware. This, of course, takes considerable time and expense. The systems, hardware and software, have to be replaced completely. Unfortunately, the world economy does not have time to wait for hardware replacement, The solution has to be relatively immediate, in order to save the world financial system from chaos, not to mention the automated control systems of most of the manufacturing, power grid, and communications infrastructure.

Of course, the virus signatures were all loaded in an 'emergency update' after a 'vulnerability' was 'discovered' in a code library that almost every computer file system routine uses. Thus, essentially every computer in the world was updated in very short order. When the signature file was then downloaded in a regular security update, computers started to fail before anyone could get ahead of the problem.

So now my problem is, 'How can this anti-virus software be stopped?' The antivirus software itself prevents the systems from being updated.

Clarification Note: This is NOT our contemporary world. This is set in the future, when a single operating system has evolved, and all systems integrated, all based perhaps on a Unix-type system. Think of the 'trusted platform module' on steroids.

Automatic initialization of the TPM with Windows Starting with Windows 10 and Windows 11, the operating system automatically initializes and takes ownership of the TPM. This means that in most cases, we recommend that you avoid configuring the TPM through the TPM management console, TPM.msc. There are a few exceptions, mostly related to resetting or performing a clean installation on a PC. For more information, see Clear all the keys from the TPM. We're no longer actively developing the TPM management console beginning with Windows Server 2019 and Windows 10, version 1809.

In certain specific enterprise scenarios limited to Windows 10, versions 1507 and 1511, Group Policy might be used to back up the TPM owner authorization value in Active Directory. Because the TPM state persists across operating system installations, this TPM information is stored in a location in Active Directory that is separate from computer objects.

The anti-virus software uses direct hooks to a similar TPM that happens right at boot. A failsafe system that was thought to be impregnable, and it turns out it is.

No references to Kaspersky or current anti-virus software will be considered. Current software, hardware, and operating systems are not relevant to the question.

For deep background and back story, consider Symantec, now owned by Broadcom, a company that has been sanctioned by the European Union for anti-competitive practices.

Broadcom provides a broad range of semiconductor and infrastructure software applications that serve the data center, networking, software, broadband, wireless, and storage and industrial markets. Common applications for its products include: data center networking, home connectivity, broadband access, telecommunications equipment, smartphones, base stations, data center servers and storage, factory automation, power generation and alternative energy systems, displays, and mainframe operations and management, and application software development.

• I've been lead to believe that most of the banking system is (still) run on UNIX servers, programmed in COBOL (the same with many govt. servers), so whilst the support computers networks might well go down, the central systems will not be affected. Feb 27 at 1:44
• @EveninginGethsemane: Programmed in COBOL, yes, there is a lot of COBOL code moving numbers around. Unix, no; more usually some sort of IBM mainframes or mid-range machines. (And in general, Unix and COBOL do not usually go together.) Feb 27 at 8:37
• @EveninginGethsemane there are worse things than COBOL in ancient shambling computer systems. There's the dreaded MUMPS. Feb 27 at 11:10
• @AlexP It is decidedly NOT set in the real world, and has nothing to do with Kaspersky, it has to do with the trusting nature we have in software companies, hardware developers, and 'private enterprises'. It's all about putting all of our eggs in one basket, one company, "I Robot" type thing. Feb 27 at 15:20
• But if you WANT the statistics on the penetration of Kaspersky, here it is. enlyft.com/tech/products/kaspersky-anti-virus "We have data on 2,262 companies that use Kaspersky Anti-Virus. The companies using Kaspersky Anti-Virus are most often found in United States and in the Computer Software industry. Kaspersky Anti-Virus is most often used by companies with 50-200 employees and 10M-50M dollars in revenue. Our data for Kaspersky Anti-Virus usage goes back as far as 6 years and 4 months." Feb 27 at 15:34

# Virtual machines

Most server software nowadays is virtualized in part because of [redacted] like this. If the system is so compromised, you are losing a virtual system, not an actual one.

# Open source

As a project manager, I have a torturing hell of a time getting a dozen adults to agree on following procedures and standards when making software. I can't fathom them all together keeping even a small secret.

If people in your world are able to keep a secret like that, then it might also be true there that all Australians are actually actors trying to convince people the Earth is not flat.

Anyway, even in such a setup simply making the whole thing open source means at some point a 12-year-old will figure the Trojan and stealthily inject a Trojan into the Trojan that keeps computers safe. That 12-year-old doesn't even need to be a genius. Just a few days ago someone who is guaranteed to be mentally no older than 12 did manage to inject a fake READ.ME file into the Linux repository which impersonated Linus Torvalds for authorship, with a technique I've seen my nephews try on me before. The fake READ.ME file claimed that Linus was giving up on Linux and switching to Windows XP because that was a better OS. Imagine if the kid had put some actual Trojan there...

• Note that this anti-virus system is based in part on HARDWARE, built in to the chipset, that directly hooks in to the antivirus software at first boot. Consider that, despite all of the different operating systems, open source software, and such, ALL IBM, Apple, and Android systems depend on a uniform BIOS type basic boot system, built in to ROM and updatable through EPROM memory. It is underneath all of the other operating systems. Most current microprocessors, in fact, have their own internal code put in at manufacture, the basis of RISK systems. A system BELOW the operating system. Feb 27 at 15:31
• There was no secret to keep. The software was open to the prevue of everyone. The coders and system analysts did what they were asked, openly. The software took a list of known threats and prevented the system from executing the code. The trap was known only by a very few, not even the programmers. That is what makes it elegant. Simply put a snippet of code of an absolutely essential operating system file in the next download of virus signatures. The software does exactly what everyone knew it would do. Stop the code from executing. Only it was essential code, not a viral code. Feb 28 at 18:31
• Everyone willingly and knowingly loaded it into their system and allowed the signature updates, intending for it to do what it did. Feb 28 at 18:31
• "There was no secret to keep. The software was open to the preview of everyone" If that was open source and nobody noticed the gaping security hole that a 12-year-old would, then either everybody but one coder in this world is stupid or, as I said in my answer, people in this world are really able to make millions of people keep a secret. Feb 28 at 18:51
• There is no 'security hole'. There is no flaw in the software. Every antivirus program on the market today can do exactly the same thing. Some even do it unintentionally because the antivirus signature looks too much like something in the operating system, or a valid commercial program. That is what makes this so elegant. No one could have expected it, it could not be discovered until it was executed. Feb 28 at 23:57

## Go Offline

The program has to grab this new data from the web, disconnect the computer from the web and the issue is gone, on that computer.

The best part is that you don’t have to anything, because all the computers running the internet will also stop working. So there won’t be any way for the malicious info to spread.

So it might spread a bit, but would be stopped relatively quickly by the fact that it would quickly eliminate anything that could spread it.

Of course, this answer isn’t very satisfying and could also be countered by setting a timer on when the devices would die. It does however come with the challenge of trying to turn on the impacted things back on without causing more damage. Additionally depending on the timers length other challenges would arise for the antagonists. If it’s too short then they might shut down before they can send it, if it’s too long someone might find out and be able to stop it.

• "a timer on when the devices would die" 🤔 the thing with using timers to set something off is that If you know it's there they're easily circumvented by keeping the system clock on your PC adjusted to b4 that date or time, adjusting that is easy on most PCs, I used to have a game with n Easter egg I liked that was set off that way, any time I wanted to hear it I just changed the date and time on my PC to make it ping 😁 Feb 28 at 1:41
• Once the signature file is loaded into the antivirus software, going off line does no good. As soon as someone tries to boot the system, the antivirus software does what it is expected to do - use the downloaded signature file already loaded in the system memory file to stop an unwanted process. Only the process is the operating system. The antivirus software does not need to be on line to do this. And you can not boot the system to add any patches. Feb 28 at 18:36
• It is not a virus, it does not replicate, it does not go from computer to computer, it does not spread. The antivirus software goes directly to the antivirus signature download site, downloads the new signature, and the system stops cold. Every single system that uses the antivirus software stops pretty much at the same time. All downloads are pre-scheduled in all computers to update at pretty much the same time, automatically. The system would have to be off line BEFORE the new virus signature file was downloaded. Feb 28 at 18:41
• @JustinThymetheSecond so none of the computers that make up the internet are effected by this whole thing? The internet isn’t just a big cable it’s a network of computers, and it takes time and many connections to get from point a to point b. Yes the computer would have to be offline before it’s download and my point is that the internet would cease working so that it would go offline unless other measures are taken. Feb 28 at 19:42
• Every computer on the Internet that uses this antivitus program and is set for automatic update is hit by it, as soon as the update is downloaded. Then, it does not matter if they are on the Internet or not, the trojan is already in the computer. Mar 1 at 0:00

# You don't fix this quick

The question is in itself quite ridiculous. It is like wanting a city to be rebuild in a month after a disaster leveled it, or an EMP fried every electricity wire and you want it fixed in a week. It is simply not done.

Essentially you brick each connected device in the world. Even if you somehow make software that unlocks the computers instantly the moment they get into contact with it, it won't work quick. There is no way to connect to the internet from the bricked conputer. Even if you unlocked your computwr it has no way to connect to the internet. Any server is bricked as well. There is nothing to communicate to. Even your router can be affected. You have to assume only data holders like USB sticks have small enough chips not to have the anti-virus on it.

To undo the effect you need to boot from such data holders. Even if the normal OS is held hostage, you can make an USB boot OS that isn't affected, possibly updating the normal OS so the files aren't affected. It will take a lot of time, but you can spread such solutions slowly. All datacenters, servers, personal and company computers need to get it. You need to copy it to many data solutions unaffected by the anti-virus and in a few months the whole of the world can be unlocked with perfect logistics.

But don't forget that basically everything is ran by computers nowadays. From mundane things like doors, traffic lights and street lights to even some fridges. To insanely vital things like virtually all transportation (cars, ships, trains, planes), powerplants, food processors, whole factories. Basically you've reduced the whole world that is used to modern comforts to a world they can barely operate. Within a day there will be looting, on day two major and many minor cities will run out if food for the majority.

In one swoop you have doomed humanity to be reduced to a fraction it was. You can't even start your computer as there is no power. The anti-virus isn't even in play any more.

## Why lock up computers?

Seeing the above it wouldn't make sense for that government to do this. Even if they can fully maintain their own networks they are very likely dependent on the rest of the world.

In addition it doesn't make sense. They could gather priceless information. Even just using the anti-virus for information gathering means they can have far reaching control of economics, politics to even the culture. They have an insanely powerful tool placed on the lowest parts of the system, access to anything and they squander it for oblivion? It seems unlikely.

• Bricking a computer is like closing the barn door after the horse has escaped. The antivirus signature is already downloaded, and the compute (ANY computer with the antivirus software) is permanently locked up, because you can not boot it from ANY source. The anti-virus software operates at the boot-up level, before any operating system is installed. It is using antivirus utilities built right into the chip. Essentially, part of the chip, as in The Trusted Platform Module microsoft.com/security/blog/2021/06/25/… Jul 4 at 22:39
• Weather it makes sense or not is out of scope for the question. In the story line, it makes perfect sense. The Internet is not the problem. It can still function. The problem is the antivirus system in every computer. Jul 4 at 22:42

For such idea to work the anti-virus would need more access to the ROMs than simple hooks. Otherwise it could be worked around by booting from the USB an alternative system. When the alternative system is running, if the virus signatures were not written in the BIOS, the quick solution would be to replace the file/library with the signatures with an old version taken from a machine that was switched off for maintenance or other reasons. Next step would be re-booting the system offline and uninstall the anti-virus. What I said will work only for machines that did not disable the USB ports, many do it for security reasons, but they should be enough to bring the systems back online.

Another way to work around the problem would be to remove the drives from the infected machines, mount them as slave on uninfected machines (again the old ones switched off), boot and delete the signatures library. It is still a hardware solution that takes time, but less than what it takes to update the ROMs.

Things would be tougher to fix if the system were based on a kind of TPM that cannot be disabled by BIOS and allowed the anti-virus to play with the secure boot (or similar) keys. But a boot system that can be disabled so easily without possible workarounds via the BIOS console would require widespread complicity from the producers, the rogue anti-virus firm could not do all the damage alone.

Update: Answering the comment by @Justin Thyme the Second I'll try and clarify what I meant.

Tim Berners Lee said Nobody can spy or everybody can spy. He meant that if you put a backdoor in a software, even if you have a legitimate reason, you can be sure that sooner or later many malicious hackers would find ways to exploit that backdoor.

On the same line if hardware producers build in the hardware they sell remote switches that cannot be disabled, then the predatory country with their anti-virus company are just one of the many possible problems, any private big corporation with the backing of any more or less "democratic" government has the power to do a lot of harm.

In that case the only solution would be a hardware fix.

• The antivirus software is built right in to the equivalent of the Trusted Platform Module, right in the actual processor. You can not bypass it. It operates at the most basic level of the boot process. Computers do not actually use ROM any more, they use programmable ROM. Even the processor chip itself has programmable ROM embedded in it, so the boot software can be updated. It is a fundamental process of RISK processing. Think "BIOS", and you have a scope of the problem, except what used to be 'BIOS' is now in the processor itself. Jul 4 at 22:48
• Think in terms of a rogue operator infiltrating Microsoft or Apple or Cisco. Jul 4 at 22:56
• @JustinThymetheSecond "Think in terms of a rogue operator infiltrating Microsoft or Apple or Cisco" With the power those companies are grabbing there is no need for a rogue operator. They themselves could act a rogue companies. Jul 6 at 12:10
• Actually, they are indeed very predatory companies. If they could become their own nation, they would. But perhaps the worst offender is Broadcom. Jul 6 at 12:26
• @JustinThymetheSecond My comment was not about their current behaviour, but about what they could do with the power they are assuming. Jul 6 at 12:46