CoreGuard Antivirus 2009

CoreGuard Antivirus is a new fake security scanner (rogue).



Stay away from these sites:
bitcoreguard.net (72.232.187.197)
bitcoreguard.com (72.232.187.197)
guardlab.com (72.232.187.198)
guardav.com (72.232.187.198)
coreguard2009.com (78.46.151.181)
coreguard2009.biz (78.46.151.181)
coreguard2009.net (78.46.151.181)
coreguardlab2009.biz (95.211.14.161)
coreguardlab2009.net (95.211.14.161)
coreguardlab2009.com (95.211.14.161)
guardlab2009.biz (76.76.103.164)
guardlab2009.net (76.76.103.164)
guardlab2009.com (76.76.103.164)

BleepingComputer CoreGuard Antivirus 2009 removal guide.
Thanks to MAD

Virus Shield

VirusShield is a new fake security scanner (rogue). It belongs to the same family as Extra Antivirus, Virus Sweeper, Ultra Antivir 2009, Virusdoctor, VirusMelt, VirusAlarm. Virus Shield comes from fake online scanners.



BleepingComputer Virus Shield removal guide.

ErrorEasy

ErrorEasy is a rogue that belongs to the same family as ErrorFix, RegTool, RegfixPro.
These fake tools are not detecting infected files or malwares but fake registry problems.



Another rogue (ErrorRepairTool) shows a relationship between, PC Utility Inc. (the editor of these tools) and 2Squared.com (a known rogue editor). But PC Utility Inc. claims that their products are legit and there is no relationship with 2Squared.com.

IP of ErrorRepairTool websites and the name of the company in the privacy page:
updatesprofessional.com (174.36.234.248) 2Squared Inc.
updates-micro.com (174.36.234.248) 2Squared Inc.
fixupdates.com (174.36.234.248) 2Squared Inc.
fix-xp.com (174.36.234.248) 2Squared Inc.
registry-updates.com (174.36.234.248) 2Squared Inc.

errorrepairtool.com (75.125.61.163) PC Utility Inc.
errorstool.com (75.125.61.163) PC Utility Inc.
errorsrepair.com(75.125.61.163) PC Utility Inc.

All pages where PC Utility Inc. was quoted have been removed (they were online yesterday). Google keeps some traces about it:


It was exactly the same page, but 2Squared Inc. was replaced by PC Utility Inc.


Back to ErrorEasy. To update itself, ErrorEasy contacts
ErrorEasy.com/databases/getinfo.php
database.registrysmart.com/updates/definitions.db
database.privacycontrol.com/updates/privacy.db

Looks like déja-vu, see RegistryFox Rogue (from another known rogue company: AntiSpyware LLC.).

database.registrysmart.com (75.125.200.226)
adwarealert.com (75.125.200.226)
evidenceeraser.com (75.125.200.226)
registrysmart.com (75.125.200.226)
restore-pc.com (75.125.200.226)

privacycontrol.com (75.125.61.162)
errorsweeper.com (75.125.61.162)
antispywarebot.com (75.125.61.162)
regclean.com (75.125.61.162)
2squared.com (75.125.61.162)

In the code of ErrorEasy, there is a hardcoded URL to 2Squared.com:



The Database is the same as AntiSpyware LLC. rogue.
There is a hardcoded string of 2Squared.com in the PC Utility Inc. tool.
And no relationship ?

Advanced Spyware Detector

Advanced Spyware Detector is a new rogue. It is also know under Advanced Spyware Detect or Advansed Spyware Detector (typo error in the binary tab version and registry keys).

This fake security software detects false positives to justify an infection and scare users.


It replace the desktop background with a fake security message.

Malware Cleaner

MalwareCleaner is a new rogue. This fake security software drops many fake executables on the system to justify an infection and scare users.



BleepingComputer Removal Guide.

ErrorFix, RegTool, RegfixPro

ErrorFix, RegTool, RegfixPro are new rogues. They are from the same family and have the same GUI. These fake tools are not detecting infected files or malware but fake registry problems.







Malwarebytes removal instructions for ErrorFix, RegTool, RegFix Pro.

Extra Antivirus

ExtraAntivirus is a new rogue. It is from the same family as AV Antispyware, PAntispyware09, MS Antispyware 2009, Pro Antispyware 2009, SysAntivirus 2009, WinSpywareProtect.



It has the same name as another rogue but not from the same family. With so many rogues, it's not a surprise that two families have one day the same product name.

Thanks to Bharath

PCCodecPack

PC Codec Pack is the new version of LuxeCodecXP, WinCoDecPRO.

PCCodec Pack displays codec error, redirecting infected user to PCCodecPack web site.



The Fake Alert binary use Lighty Compressor (seen on WinPC Antivirus dropper, and DNS.Changer dropper).

Extra Antivirus

ExtraAntivirus is a new rogue. It belongs to the same family as Virus Sweeper, Ultra Antivir 2009, Virusdoctor, VirusMelt, VirusAlarm.





Extra Antivirus comes from fake online scanners. Extra Antivirus drops many files on the system with different filenames taken from a dictionary. These files are not Win32 executables and are detected as infections to scare users.

BleepingComputer Removal Guide.

AV Antispyware

AVAntispyware is a new rogue. It is from the same family as PAntispyware09, MS Antispyware 2009, Pro Antispyware 2009, SysAntivirus 2009, WinSpywareProtect.
As always, detection of fake infections to scare users and a promise to remove all infected files/keys when activated for $49,95 (6 month license).



BleepingComputer Removal Guide.