Couple of New Rogues

Couple of New Rogues

P Antispyware 09 and Antivirus'09 are the two new rogue security applications.

More info on P Antispyware 09 here

More info on Antivirus'09 here

Bharath M N

Do it yourself

Do it yourself

Lately we saw a new rogue campaign which is really a good example of clonning/renaming technique used by the scammers.  The campaign allows one to purchase a empty project and customize it with their own Graphics/Name.

S!Ri has posted about the do it yourself rogue campaign in detail here.

Bharath M N

Conficker in Action

Conficker in Action

Conficker now back in action. Kaspersky Lab has couple of intresting posts here and here.

You can find the removal instructions here.

You can also try the stand alone scanners from Sunbelt or f-secure to remove Conficker/Downadup/Kido variants from infected PC's.

Stay Safe!

Bharath M N

Virus Sweeper

Virus Sweeper

Thanks to S!Ri

Virus Sweeper is the new rogue security application from Virusdoctor rogue family.



This rogue family continues to host its installers on Google Code.You can find the removal instructions here.

Bharath M N

WinPC Antivirus

WinPC Antivirus

WinPC Antivirus is a new rogue security application. More info here

WinPC Antivirus removal instructions here

Bharath M N

System Protector

System Protector

System Protector is a new rogue security application. This one is a clone of Spy Protector rogue security application.

System Protector

System Protector Home page

System Protector removal instructions here

Bharath M N

Privacy Center

Privacy Center

Privacy Center is a new rogue from XLG Security Center rogue Family.

Privacy Center removal instructions here

Bharath M N

The Active Rogue Family

The Active Rogue Family

Currently Virusdoctor rogue security family is busy clonning its rogue security application.

First came Virusdoctor then it was VirusMelt and now its VirusAlarm which will be replaced by Ultra Antivir 2009.

We have also observed that this rogue family is housing its installers on Google Code. This was reported here and here

Currently the Google Code project housing Ultra Antivir 2009 is still active. Google Code Team has done a good job in taking down the malicious project in a short span of time.


Virusdoctor removal instructions here
VirusMelt    removal instructions here
VirusAlarm  removal instructions here
Ultra Antivir 2009 removal instructions here


Sites assosiated with the new rogues

206.53.61.76 Virusalarm-scanvirus net
64.86.17.9    Virusalarmpro com
64.86.17.9    Ultraantivirus2009 com

Stay away from this rogue family.

Bharath M N

Rogue Repository

Rogue Repository

Google Code Project is once again being absued by scammers. This time the scammers are using Google Code to store/deliver rogue installers.

We observed that one of the Trojan downloader designed to infect the system with VirusMelt rogue security application was connecting to Google code to download the actual rogue installer.

Screenshot of the VMLT project on Google Code

The scammers have put up the code on Google code not to get highly ranked in the Google search index but to deliver malware to unsuspected users from a trusted source. 

I am positive that Google will take care of such projects in a very short time.

Edit: Thanks to Google Code Team the project has been taken down!!

Bharath M N

Total Security

Total Security

Thanks to Jaxryley @ Malwarebytes and Grinler @ BleepingComputer for the heads up.

Total Security is a new rogue security application. This is a clone of Antivirus 360 rogue security application.

Screenshot of Total Security application

Screenshot of Total Security site

You can find the removal instructions here.

Site involved:

194.165.4.7     Fullantispywareonlinescane.com
89.149.217.205  Antispywareupdateservice.com
212.117.165.126 Platinumsecurityupdate.com
78.47.248.113   Thankyouforinstall.cn
78.47.248.113  Powerfullantivirusproduct.com

Stay away from these sites.

Bharath M N