Registry Elite

Registry Elite is a fake registry cleaner. It detects Fake registry problems, file association errors and other symptoms on a brand new system (383 errors on this capture test (Windowns XP SP3 installed few minutes ago).



registryelite.com (67.227.208.84)
tweaklogic.com (67.227.208.84)

Registry Elite is a clone of PC Doc Pro

PC Doc Pro

PC Doc Pro is a fake registry cleaner. It detects Fake registry problems, file association errors and other symptoms on a brand new system (192 errors on this capture test (Windowns XP SP3 installed few minutes ago).



pcdocpro.com (72.52.146.60)
spydocpro.com (72.52.146.60)
spyresearchcenter.com (72.52.146.60)

PC Doc Pro is a clone of Registry Elite

PcsSecure

PcsSecure is a fake security software (rogue) from the Winisoft family (APcSafe, APcSecure, DefendAPc, SysDefenders, InSysSecure, SysProtector, APcDefender, PcsProtector, GreatDefender, APCprotect, ProtectPcs, SysDefence, TheDefend, GuardPcs, IGuardPc, SiteAdware, AntiTroy, AntiKeep, AntiAdd, RESpyWare, REAnti, KeepCop, SiteVillain, LinkSafeness, SecureKeeper, AntiAID, System Warrior, System Veteran, System Fighter, Block Protector, Block Keeper, Block Scanner, Block Watcher, SoftBarrier, Shield Safeness, Soft Stronghold, Soft Veteran, SoftCop, Soft Soldier, Trust Fighter, Trust Soldier, Safe Fighter, Trust Cop, Secure Warrior, Secure Fighter, Secure Veteran, Security Soldier, Security Fighter, Save Armor, Save Defender, Trust Warrior, Soft Safeness, Safety Keeper, Save Keeper, Quick Heal Cleaner, System Cop, Block Defense, Save Defense, Trust Ninja, Save Soldier, Save Keep, Winishield, Wini Fighter, WiniBlueSoft)



PcsSecure comes from fake online antivirus scanners or fake video codecs, creates random files on the system and detects them as infected. It also display a lot of disturbing warning messages to scare users.

If your PC is infected with some of the WiniSoft family rogue, use MBAM to remove the infection.

SpyEraser

SpyEraser is a fake security software. It detects non existent infections to scare users pushing them to buy a license.



spyeraser-security.com (193.104.110.81)
spyeraser.ir (193.104.110.81)
spyeraser-software.ru (193.104.110.81)
spyeraser-trial.com (193.104.110.81)
spyeraserstore.com (193.104.110.81)
vipimagine.cn (193.104.110.81)

APcSafe

APcSafe (A Pc Safe) is a fake security software (rogue) from the Winisoft family (APcSecure, DefendAPc, SysDefenders, InSysSecure, SysProtector, APcDefender, PcsProtector, GreatDefender, APCprotect, ProtectPcs, SysDefence, TheDefend, GuardPcs, IGuardPc, SiteAdware, AntiTroy, AntiKeep, AntiAdd, RESpyWare, REAnti, KeepCop, SiteVillain, LinkSafeness, SecureKeeper, AntiAID, System Warrior, System Veteran, System Fighter, Block Protector, Block Keeper, Block Scanner, Block Watcher, SoftBarrier, Shield Safeness, Soft Stronghold, Soft Veteran, SoftCop, Soft Soldier, Trust Fighter, Trust Soldier, Safe Fighter, Trust Cop, Secure Warrior, Secure Fighter, Secure Veteran, Security Soldier, Security Fighter, Save Armor, Save Defender, Trust Warrior, Soft Safeness, Safety Keeper, Save Keeper, Quick Heal Cleaner, System Cop, Block Defense, Save Defense, Trust Ninja, Save Soldier, Save Keep, Winishield, Wini Fighter, WiniBlueSoft)



APcSafe comes from fake online antivirus scanners or fake video codecs, creates random files on the system and detects them as infected. It also display a lot of disturbing warning messages to scare users.

If your PC is infected with some of the WiniSoft family rogue, use MBAM to remove the infection.

Desktop Security 2010

Desktop Security 2010 is a fake security software (rogue). It is from the same family as: Total PC Defender 2010, Desktop Defender 2010, Contraviro, UnVirex.



Desktop Security 2010 displays a lot of disturbing warning messages pushing users to purchase a license.

If your PC is infected with Desktop Security 2010 rogue, use MBAM to remove the infection.

Total PC Defender 2010

Total PC Defender 2010 is a fake security software (rogue). It replaces Desktop Defender 2010. (Contraviro and UnVirex family).



Total PC Defender 2010 displays a lot of disturbing warning messages to scare users inviting them to purchase a license.

If your PC is infected with Total PC Defender 2010 rogue, use MBAM to remove the infection.

APcSecure

APcSecure (A Pc Secure) is a fake serurity software (rogue) from the Winisoft family (DefendAPc, SysDefenders, InSysSecure, SysProtector, APcDefender, PcsProtector, GreatDefender, APCprotect, ProtectPcs, SysDefence, TheDefend, GuardPcs, IGuardPc, SiteAdware, AntiTroy, AntiKeep, AntiAdd, RESpyWare, REAnti, KeepCop, SiteVillain, LinkSafeness, SecureKeeper, AntiAID, System Warrior, System Veteran, System Fighter, Block Protector, Block Keeper, Block Scanner, Block Watcher, SoftBarrier, Shield Safeness, Soft Stronghold, Soft Veteran, SoftCop, Soft Soldier, Trust Fighter, Trust Soldier, Safe Fighter, Trust Cop, Secure Warrior, Secure Fighter, Secure Veteran, Security Soldier, Security Fighter, Save Armor, Save Defender, Trust Warrior, Soft Safeness, Safety Keeper, Save Keeper, Quick Heal Cleaner, System Cop, Block Defense, Save Defense, Trust Ninja, Save Soldier, Save Keep, Winishield, Wini Fighter, WiniBlueSoft)



APcSecure comes from fake online antivirus scanners or fake video codecs, creates random files on the system and detects them as infected. It also display a lot of disturbing warning messages to scare users.

If your PC is infected with some of the WiniSoft family rogue, use MBAM to remove the infection.

Protect Soldier

Protect Soldier is a fake security software (rogue) from the Winisoft family (Protect Defender, Armor Defender, DefendAPc, REAnti, ...)



Protect Soldier comes from fake online antivirus scanners or fake video codecs, creates random files on the system and detects them as infected. It also display a lot of disturbing warning messages to scare users.

If your PC is infected with Protect Defender, use MBAM to remove the infection.

LSP Hijack

Internet Security 2010 is a recent rogue that prevent softwares and media players execution.

The trojan-downloader installing the rogue is also registering a LSP Hijack that blocks some sites, displaying an error message in the brower:

Restricted Site!
This web site is restricted based on your security preferences.
Your system is infected. Please activate your antivirus software.

Hijackthis symptoms:

O10 - Unknown file in Winsock LSP: c:\windows\system32\helper32.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\helper32.dll

Sites blocked by this Malware are:

facebook.com
youtube.com
myspace.com
live.com
craigslist.org
wikipedia.org
ebay.com
blogger.com
amazon.com
twitter.com
go.com
bing.com
flickr.com
wordpress.com
photobucket.com
weather.com
nytimes.com
linkedin.com
pornhub.com
mapquest.com
foxnews.com
hulu.com
livejasmin.com
youporn.com
digg.com
adultfriendfinder.com
mywebsearch.com
rapidshare.com
redtube.com
ask.com
tube8.com
imageshack.us
livejournal.com
thepiratebay.org
xvideos.com
godaddy.com
mozilla.com
washingtonpost.com
monster.com
bbc.co.uk
bebo.com
guardian.co.uk

Do not delete the LSP File without unregistering it, you will break the Internet connection !

If your PC is infected with Internet Security 2010, use MBAM to remove the infection.