Signed software abused to deploy antivirus-killing scripts