VirusProtect 3.9

A new version of VirusProtect rogue has been released:
This rogues looks like: VirusRay, Antivir Gear, VirusProtectPro , SpyDown, SpywareQuake.

Video ActiveX Object Error

Fake Video suggesting Fake Codec installation, linked to IEDefender Rogue.

IE Codec

A New fake Codec installer was found. (Thanks to nosirrah).
Compromised web sites display fake alerts about a software installation to watch a video. This Software installs a componant (BHO) in Internet Explorer displaying Fake Trojan Alerts.

Flash Player incorrect version

Flash Player incorrect version is a fake popup linked to a fake Video ActiveX Object (see Multimedia Decoder codec).





This Trojan installs an Internet Explorer componant that displays alerts, popup, and modifies search results to encourage the user to install IEDefender Rogue.

See SunbeltBlog

VirusProtect 3.8

A new Rogue has been released: VirusProtect.
This rogues looks like: VirusRay, Antivir Gear, VirusProtectPro , SpyDown, SpywareQuake.

Files Secure

A new Rogue has been released: File Secure.
This rogues looks like: IE Defender.

Zlob - Trend Security Advisories

Trend Micro have published an article about Zlob few months ago.

IE Defender

Rogue IE Defender coming with the fake codec multimedia decoder has been incuded to SmitfraudFix.



The authors of IE Defender are claiming on CastleCops forum that their software is "clean and is real antispyware".
Talking about the problem of the trojan fake codec that advertise for IE Defender installation, they post:

we have a partnership for our distributors to advertise our program, we pay them a percent of registration fee. Some of them use illegal methods, that we not accept, our customers send us abuses about it and we closed some of our affiliates accounts without paying them. We are watching on it but there are problems with them sometimes. We're working on this problem and it's very sad for us.

Looking at the servers IP of IE Defender and the Trojan: they are the same. No more to say.

Multimedia Decoder

Multimedia Decoder is another fake codec installing malware.
It displays fake alert to install IEDefender Rogue and Hijacks google pages with an alert and a malware p0rn link.

VirusRay 3.8

A new Rogue has been released: VirusRay.
This rogues looks like: Antivir Gear, VirusProtectPro , SpyDown, SpywareQuake.

Trojan SPM/LX

Smitfraud family Malware.
Displays fake alert messages, Hijacks desktop background.

Spyware.WinAntiVirus

A new version of Spyware.WinAntiVirus has been released.

HijackThis symptoms:
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\printer.exe
O4 - HKLM\..\Run: [WinAVX] C:\WINDOWS\System32\WinAvXX.exe
O4 - HKLM\..\Run: [DoNotDelete] C:\WINDOWS\System32\explore.exe
O4 - HKCU\..\Run: [WinAVX] C:\WINDOWS\System32\WinAvXX.exe
O4 - HKCU\..\Run: [DoNotDelete] C:\WINDOWS\System32\explore.exe
O4 - Startup: info.exe
O4 - Startup: system.exe
O4 - Global Startup: autorun.exe
O4 - Global Startup: info.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O20 - AppInit_DLLs: C:\WINDOWS\System32\sulimo.dat

AntiVirGear 3.8

A new version of the Rogue AntiVirGear has been released.
This rogues looks like: VirusProtectPro , SpyDown, SpywareQuake.

RSS Stream Changelog

SmitfraudFix Changelog is now available in XML format

Zlob Hijacks Winsock LSP

Zlob Malware is Hijacking Winsock.

All begins with the installation of the fake software: Video ActiveX Enhancement 2.07 which installs: AntiVirGear 3.7, BHO, Alerts Popups, IEToolBar...

Now 2 files laf?.dll and laf?.ini are dropped in %SYSTEM% folder (where ? is a number from 1 to 5). Files are detected as Trojan-Downloader.Win32.Agent.doe by Kaspersky Antivirus.

HijackThis Symptoms:
O10 - Unknown file in Winsock LSP: c:\windows\system32\laf1.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\laf1.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\laf1.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\laf1.dll

Use LSPFix to remove the files. (Bleeping Computer Guide)

AntiVirGear 3.7

After the release of different version of VirusProtectPro (3.3 to 3.6) the rogue mutates to AntiVirGear 3.7. A modified version of SpyDown, SpywareQuake.

VirusProtectPro 3.3

VirusProtectPro Rogue, a modified version of SpyDown, SpywareQuake.

Privacy Danger Desktop Hijack

Privacy Danger is a componant of NewMediaCodec/VideoAccessCodec (VideoCach), a fake codec that displays alerts, Rogue popups, installs a BHO...

Desktop background modified:

SpyLocked

SpyLocked rogue, a modified version of SpyDown, SpyCrush, SpywareQuake.

SpyDown

SpyDown rogue, a modified version of SpyCrush, SpywareQuake (a lot of registry keys are the same).

SpyCrush

SpyCrush rogue, a modified version of SpywareQuake (a lot of registry keys are the same) and of VirusBurst(er), thanks to Security Cadets.

SpyMarshal

SpyMarshal rogue:

PestCapture

PestCapture rogue:

SpywareKnight

SpywareKnight rogue.

SpySoldier

SpySoldier rogue.

MalwareWipePro

MalwareWipePro rogue, a new version of MalwareWiped (MalwareWiper, MalwareWipe).

Registry Cleaner

Registry Cleaner rogue installs itself with fake warning messages displayed by a Trojan Downloader.

AntiVerminser

AntiVerminser rogue, a new version of AntiVermins. Creators of the rogue only change filenames and registry keys. Bitmaps remain the same.