ProtectDefender is a rogue security product in the WiniGuard family — one more clone from the same rebrand mill that flooded late 2009 (clones coming thick and fast). It presents fake scan results and scare warnings to push a paid unlock. Do not purchase it; remove it with the Malware Removal guide for Windows.
GhostAntivirus is a new rogue anti-virus application. It is a clone of InternetAntivirusPro.
Researchers at McAfee labs monitor Koobface activities 24/7 via custom honeypots and while reviewing one such update we noticed a variant that had debug/log features. Unlike the traditional captcha breaking technique to create new accounts, this variant of the worm converts the infected machine to a bot. When we analysed the malware trapped in our botnet, we found that this variant of Koobface has a special feature for logging all activities carried out during the infection process in a log file . Log file is created under system root with date and time stamp for eg, C:\fb_reg20090612.log. ...
Following the addition of Win32/Hamweq to the MSRT last month, MMPC will continue cleaning PCs in 2010 by adding another prevalent worm, Win32/Rimecud, to this month’s removal tool. This is due not only to Win32/Rimecud’s high detection numbers, which immediately follow those of Win32/Hamweq, but also to the similarities the two families share with each other. In fact, as part of its payload, Win32/Hamweq may download Win32/Rimecud, contributing to Rimecud’s suitability as the next target for MSRT. ...
SysDefenders is a rogue security product in the WiniGuard family — another early-2010 rebrand in a line that was already spinning out new names every few days by late 2009 (The biggest rogue family). Same playbook: fake infection results, scare warnings, and a paid unlock that does not protect the machine. Do not buy it. If it is installed, follow the Malware Removal guide for Windows.
Malware authors love to innovate when it comes to persistence and hiding their nefarious creations from detection, and although most of the schemes are not unknown to analysts, they still show that malware authors are constantly on the prowl and evolving their techniques. The example I have is of yet another registry-centric malware which by the nature of its construction has several advantages to defeating naive security software. The sample, detected as Troj/RegExec-A, is essentially a multi-component threat of sorts comprising of at least 3 components (Dropper/installer, Payload and Loader.) ...
Guard Pro is a rogue antispyware software, or a phony. Guard Pro uses fake system scans and warnings to frighten people into buying the software. Guard Pro will show system scan results that report numerous infections, which are all fake, and will not remove the supposed infections until the user buys the product. Do not fall for this, it is a complete scam, Guard Pro is the infection itself. Guard Pro will also show system warnings and alerts stating the PC is infected or under attack and prompts the user to buy the software. ...
Google’s Android mobile operating system has been out for a while and is generating more and more interest. Now there has been some buzz about fraudulent applications being posted on the Android Market. See these postings: Both of these apps were written by an anonymous developer known as 09Droid. In fact, he had a whole collection of online banking applications for sale on the Market: ...
The Internet Storm Center reports that malware which claims to be “new Outlook Web Access settings” is still being sent out by cyber criminals. We saw those malware emails in the middle of October already.
InSysSecure is a rogue security program, designed to rip people off. InSysSecure uses false security warnings, alerts and system scans to frighten people into thinking their computer systems are infected, all the while InSysSecure is the actual infection. if your system is infected with above malware, you should remove it soon, Click Here to learn how to remove it.
Unlike the first malware authors who wrote viruses seeking fame through destruction, their motivation has changed to financial gain. Nevertheless, there are still the ones out there who share the first authors’ intent. I was analysing a simple Trojan today and saw the following message: It is not uncommon for malware authors to leave messages in their code for Researchers to read. This one did bring a smile to my face, so he was rewarded by it being named BackDoor-EKD which is an increment of one from BackDoor-EKC 😉
SysProtector and ApcDefender are two new rogue antispyware programs released in the past 48 hours. SysProtector and APCDefender are potentially very dangerous PC infections. These rogues use fake security alerts and warnings to trick people into thinking their PC is under attack, all the while they drop fake files on the system. These rogues will also prevent other programs from opening, hijack the web browsers and render the PC nearly useless. Below is a screenshot of a hijacked browser, showing fake threat warnings. ...
No Malware is a rogue security program, or a phony. NoMalware is designed to trick people into purchasing the software, which is actually useless, a PC infection in itself. NoMalware will use security scans to alert the user that their PC is infected. These security scans are not real, the infections reported are false. NoMalware will show these falsified scan results and refuse to remove the supposed infections unless the user buys the software. Do not fall for this scam. Victims that purchase NoMalware quickly lean that the software does not prevent infections or remove infections form their PC’s. ...
The massive growth of gold farming – the exchange of real money for virtual goods – might result in an increase in gaming Trojans and other malware aimed at gamers in the future. A well-respected researcher has described the incredible growth of “gold farming,” an significant industry and source of employment in China and other parts of Asia. He estimates there are 400,000 people, working for gold farming companies. They spend as much as 12 hours per day playing online games in order to accumulate virtual goods which can be sold to some of the 50 million on-line game players world wide for real cash. ...
PcsProtector is a rogue security product in the WiniGuard family — the first clone of that line spotted in 2010. Same operators, new paint: fake scan results, scare warnings, and a paid unlock that does not protect the machine. By late 2009 the family was already a revolving door of rebrands (The biggest rogue family; clones coming thick and fast). PcsProtector continues that pattern into the new year. Do not buy it. If it is installed, remove it with the Malware Removal guide for Windows rather than licensing the scareware.