WiniBlueSoft

WiniBlueSoft is a new fake antimalware. This rogue detects fake infections on a clean system and displays lots of warning messages to remove them.
Many files are created on the system (with a random filename) to simulate an infection. Those files are not executable and filled with junk.



WiniBlueSoft also display a fake Windows Security Center Window.



BleepingComputer WiniBlueSoft removal guide.

Home Antivirus 2009

HomeAntivirus 2009 is a new fake antivirus/antimalware software. This rogue saves files in the system (filled with junk) and detects them as infections to scare users. These files have a random filename, are not executable and are not infected. Home Antivirus 2009 displays alerts to be registered to remove those files.



HomeAntivirus2009 replaces the original Windows Security Center by its own, and force the Control Panel to be displayed with the classic view.

Thanks to Grinler
BleepingComputer Home Antivirus 2009 removal guide.

Antivirus'09

Antivirus 2009 (aka Antivius'09, Antivirus09) is a fake security software (rogue).

Antivirus'09 is installed through Fake online antivirus scanners. This Javascript animation detects inexistent infected files on the system to scare users and propose a free scan with Antivirus'09.


Once installed, Antivirus'09 will detects many inexistent infected files and displays alerts to be registered.




Thanks to Bharath

P Antispyware 09

PAntispyware09 is a new rogue. It is from the same family as MS Antispyware 2009, Pro Antispyware 2009, SysAntivirus 2009, WinSpywareProtect.



Thanks to Bharath
BleepingComputer Removal Guide.

TotalAntiSpyware, SysCleaner, WebAntiSpy, Rebrand Software

Rebrand Software is a company who sells empty projects. Some of these products are Security Softwares. Rebrand customers buy a Kit and finalize their new softwares with their own Graphics/Name. Total Antispyware, Sys Cleaner Pro are made with those ready-to-make kits:

Installers screens of SyscCleanerPro, TotalAntispyware, and an Empty Project:






Graphic User Interface (GUI) of TotalAntiSpyware and an Empty Project:




One of the new Rebrand Software product is an HijackThis-Like Software (note the misplaced button bug):




syscleanerpro.com (64.191.12.38)
av-antispyware.com (64.191.12.38)
antispylist.com (64.191.12.38)
addantivirus.com (64.191.12.38)
antispyme.com (64.191.12.38)
totalantispyware.com (64.191.12.38)
totalantispyware.net (64.191.12.38)
totalantispyware2009.com (64.191.12.38)
system-cleanerpro.com (64.191.12.38)

Is Web Antispy going to be the next of these DIY Rogues ? At this time WebAntispy page is hosting TotalAntispyware Rogue.

webantispy.com (65.110.60.123)



Thanks To Sparsha

Antivirus Plus

AntivirusPlus is another fake security software (rogue). This scareware is not new, but it was not very active. Recently, more fake online scanners advertise Antivirus Plus for removal tool.

easyincomeprotection.cn (94.247.2.215)
easybestprotection.cn (94.247.2.215)
easypersonalprotection.cn (94.247.2.215)
freedefense2u.cn (94.247.2.215)
myascertainpoison.cn (94.247.2.215)
mycheckdiseasestore.cn (94.247.2.215)
mydefense4you.cn (94.247.2.215)
refugepro.cn (94.247.2.215)
yourguardforyou.cn (94.247.2.215)
yourguardonline.cn (94.247.2.215)
yourguardpro.cn (94.247.2.215)
yourguardstore.cn (94.247.2.215)

av-plus-support.com (94.247.2.215)
myplusantiviruslive.com (94.247.2.215)

easyaddedantivirus.com (94.247.2.215)
myplusantiviruspro.com (94.247.2.215)
yourcountedantivirus.com (94.247.2.215)
addedantivirusonline.com (94.247.2.215)
addedantivirusstore.com (94.247.2.215)
realantivirusplus.com (94.247.2.215)
addedantiviruspro.com (94.247.2.215)
addedantiviruslive.com (94.247.2.215)

If the rogue detects a lot of infections (all inexistent), once registered, it propose to remove them. If we don't accept (ALT-F4 to quit) they have all disappeared on next execution.

Virus Sweeper

Virus Sweeper is a new rogue. It belongs to the same family as Ultra Antivir 2009, Virusdoctor, VirusMelt, VirusAlarm. The GUI is always the same, only the title name is changing. Note that 2 GUIs exist, one with a Vista skin, the other with a XP skin.





As for the previous rogues of this family, the software is hosted on google code.

Virus Sweeper comes from fake online scanners. Nonexistent files are detected on a clean system, installation of the software is proposed to users for a free scan.
Virus Sweeper drops many files on the system with different filenames taken from a dictionary. These files are not Win32 executables and are detected as infections.

BleepingComputer Removal Guide.
Malwarebytes VirusSweeper Blog Post.

Antivirus XP Pro 2009

Antivirus XP Pro 2009 is a fake security software (rogue). It displays fake alerts and detects fake infections on the system. AntivirusXPPro2009 is from the same family as Renus 2008

A real malware modifies the desktop (desktop hijack) and promote the rogue with popups.



Looking into the code, we can see that just after being registered, the rogue removes the malware and its restriction that prevent users to restore the original desktop background. Then it displays the "Register Success" Message box.

Desktop Hijack

This kind of Desktop Hijack is used to scare users. The evil code installs restrictions to prevent infected users to restore the original background picture.



The message in the taskbar is from the malware and leads to Antivirus XP Pro 2009 fake security software (rogue) website.

One of the Hijack symptom is the presence of this start key:
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe

WinPC Antivirus

WinPC Antivirus is a Fake Security application. It replaces WinPC Defender.

These rogues are from the same creators of XP Police Antivirus, IE-Security, WinDefender 2009 and Total Secure 2009.



Once registered, all the fake malwares detected are now missing. And it looks like designers forgot to remove a part of the GUI Skin.
(Click on the Help & Support button redirects to win-pc-defender Website).



Thanks to Bharath
WinPC Antivirus on MAD Blog
Bleepingcomputer Removal guide