Kaspersky deletes itself, installs UltraAV antivirus without warning

Starting Thursday, Russian cybersecurity company Kaspersky deleted its anti-malware software from customers' computers across the United States and automatically replaced it with UltraAV's antivirus solution.

This comes after Kaspersky decided to shut down its U.S. operations and lay off U.S.-based employees in response to the U.S. government adding Kaspersky to the Entity List, a catalog of "foreign individuals, companies, and organizations deemed a national security concern" in June.

On June 20, the Biden administration also announced a ban on sales and software updates for Kaspersky antivirus software in the United States starting September 29, 2024, over potential national security risks.

In July, Kaspersky told BleepingComputer that it would begin closing its business and lay off the staff on July 20 because of the sales and distribution ban.

In early September, Kaspersky also emailed customers, assuring them they would continue receiving "reliable cybersecurity protection" from UltraAV (owned by Pango Group) after Kaspersky stopped selling software and updates for U.S. customers.

However, those emails failed to inform users that Kaspersky's products would be abruptly deleted from their computers and replaced with UltraAV without warning.

UltraAV force-installed on Kaspersky users' PCs

According to many online customer reports, including BleepingComputer's forums, UltraAV's software was installed on their computers without any prior notification, with many concerned that their devices had been infected with malware.

"I woke up and saw this new antivirus system on my desktop and I tried opening kaspersky but it was gone. So I had to look up what happened because I was literally having a mini heart attack that my desktop somehow had a virus which uninstalled kaspersky somehow," one user said.

To make things worse, while some users could uninstall UltraAV using the software’s uninstaller, those who tried removing it using uninstall apps saw it reinstalled after a reboot, causing further concerns about a potential malware infection.

Some also found UltraVPN installed, likely because they had a Kaspersky VPN subscription.

Not much is known about UltraAV besides being part of Pango Group, which controls multiple VPN brands (e.g., Hotspot Shield, UltraVPN, and Betternet) and Comparitech (a VPN software review website).

"If you are a paying Kaspersky customer, when the transition is complete UltraAV protection will be active on your device and you will be able to leverage all of the additional premium features," UltraAV says on its official website on a page dedicated to this forced transition from Kaspersky's software.

"On September 30th, 2024 Kaspersky will no longer be able to support or provide product updates to your service. This puts you at substantial risk for cybercrime."

"Software update" behind forced switch to UltraAV

A Kaspersky employee also shared an official statement on the company's official forums regarding the forced switch to UltraAV, saying that it "partnered with antivirus provider UltraAV to ensure continued protection for US-based customers that will no longer have access to Kaspersky's protections."

"Kaspersky has additionally partnered with UltraAV to make the transition to their product as seamless as possible, which is why on 9/19, U.S. Kaspersky antivirus customers received a software update facilitating the transition to UltraAV," it added.

"This update ensured that users would not experience a gap in protection upon Kaspersky's exit from the market."

The company states that UltraAV has a similar feature set to its products and asked customers to review a FAQ page on UltraAV's website or contact its support team for more information.

---

Update September 25, 10:43 EDT: A Pango Group spokesperson told BleepingComputer after the article was published that Kaspersky "began communicating this transition to U.S. customers on September 5" and that "users with valid email addresses received direct communications and all users had access to transition notifications in-app, on MyKaspersky account pages, and via Kaspersky Labs' webpages."

Pango Group also shared a screenshot of an in-app Kaspersky pop-up notifying customers that their "Kaspersky service will soon be moving to UltraAV" and "UltraAV protection will be automatically activated" on the device as part of this transition.

It's unclear whether Kaspersky users who found UltraAV installed on their computers didn't see this notification or were confused because it didn't explain that Kaspersky would be uninstalled and replaced with UltraAV.

"Kaspersky and UltraAV are implementing the transition in waves to ensure a smooth process and to prevent any gap in protection as Kaspersky exits the market," a Kaspersky spokesperson also told BleepingComputer.

"The first group of U.S. Kaspersky antivirus customers received a software update facilitating the transition on 9/17, with additional waves planned for the coming days."