All for One!

All for One!

While checking the different sites used by WiniFighter rogue campaign, we observed that this rogue uses many fake/scare scanner page templates which is/was used by different family of rogue security applications.

On one particular site we found 15 different fake/scare scanner pages.

Template 1:

Template 2:

Template 3:

Template 4:

Template 5:

Template 6:

Template 7:

Template 8:

Template 9:

Template 10:

Template 11:

Template 12:

Template 13: The Classic BSOD which is used by many rogue security applications. recent reports here and here

Template 14:




Template 15: This uses a look alike of KOS and more info here

The download from this site displays Fake Windows Security center page and fake Security center alerts to lure users into purchasing WiniFighter rogue application.

Bharath M N

Watchers Being Watched!

Watchers Being Watched!

We have seen a lot of rogue security applications using fake scanner pages as an initial step to lure users into purchasing their application. In their contonued effort to scam users the rogue developers have also used logos, images, names of legitimate security applications.

I recently read an article from Brian Krebs covering the money flow around the rogue security applications. In the article he had also mentimentioned that Kaspersky was tracking at least 25 different rogue anti-virus products that use Chronopay for payments.

Lately one such rouge campaign caught my eyes. This time WiniFighter rogue was using a fake/scanner page which was a look alike of Kaspersky Online Scanner 7.0!

May be this how they thank Kaspersky for keeping a track record of their activities?

Screenshot of WiniFighter fake/scare scanner

Screenshot of legitimate Kaspersky Online Scanner 7.0

You can find the legitimate Kaspersky Online Scanner 7.0 here

Bharath M N

PC Antispyware 2010

PC Antispyware 2010

PC Antispyware 2010 is a new rogue security application. More info here

Bharath M N

Windows System Suite

Windows System Suite

Thanks to S!Ri

Windows System Suite is the new rogue security application from Virusdoctor rogue family.

Screenshot of Windows System Suite rogue security application

Windows System Suite removal instructions here

Bharath M N

Smart Protector

Smart Protector

Thanks to S!Ri

Smart Protector is new rogue security application from the System Guard 2009 rogue family.

Screnshot of Smart Protector application

Screenshot of Smart Protector website

Installing Smart Protector does not detect anything on the system as the scanner database is empty.

When we replaced the files with its predecessor scanner database file the rogue came alive with its true colors.




Smart Protector removal instructions here

Bharath M N

Privacy Center

Privacy Center

Thanks to S!Ri

A new variant of Privacy Center rogue is making its rounds. The new variant is a combination of old Privacy Center and Secret Service

Screnshot of Privacy Center application

Bharath M N

Windows Antivirus Pro

Windows Antivirus Pro

Windows Antivirus Pro is a new rogue security application. This one is a new nasty clone from the ASC-AntiSpyware rogue family.

Windows Antivirus Pro rogue is distributed through fake code infection.

Screnshot of Windows Antivirus Pro application

They also place the following malicious BHO which displays annoying popups luring users to purchase the rogue security application.

O2 - BHO: ICQSys (IE PlugIn) - {F54AF7DE-6038-4026-8433-CC30E3F17212} - C:\WINDOWS\system32\dddesot.dll

The rogue also hijacks the desktop displaying the following warning message.

Due to the ransomware behavior of the rogue its much more difficult to remove the infection.

Try out the steps mentioned by Grinler on Bleepingcomputer to remove Windows Antivirus Pro infection.

Bharath M N

AVCare

AVCare

AVCare is a new rogue security applications. The Rogue uses fake/scare scanner pages to lure the users into downloading this rogue security application.

Fake/Scare scan page used by AVCare

Screnshot of AVCare application

AVCare removal instructions here

Bharath M N

Powered by Ctrl+C N Driven by Ctrl+V

Powered by Ctrl+C N Driven by Ctrl+V

We have seen lot of rogue security application using the same code and almost similar tactics to scam the users.

Lately we saw XP Deluxe Protector rogue security application using an old fake/scare scanner template which was extensively used by the Antivirus 2008 rogue variants in early 2008.

Screenshot of classic Scare/Fake scan page template used by XP Deluxe Protector

The installer pushed by the fake scanner page then displays a fake Windows Security Alert which further downloads and installs XP Deluxe Protector rogue security application

Site involved:
Antispy2009 net
Downloadsoftwareserver3 com
Xp-deluxeprotector com

Bharath M N

Security Mechanic

Security Mechanic

Security Mechanic is a new rogue security application. This one is a clone of Spy Protector rogue security application.

Screnshot of Security Mechanic application

Fake/Scare scan page used by Security Mechanic

Security Mechanic removal instructions here

Bharath M N