Presto TuneUp

PrestoTuneUp is a new fake optimizer/cleaner (rogue). It is a clone of My Supervisor.

PrestoTuneUp is made by the same creators of: FastAntivirus, MalwareCatcher, VirusShield, Extra Antivirus, Virus Sweeper, Ultra Antivir 2009, Virusdoctor, VirusMelt, VirusAlarm.

Presto TuneUp detects nonexistent problems (registry, IE Cache, Cookies,...) to scare users. Unlike FastAntivirus/MalwareCatcher family, PrestoTuneUp doesn't detect malware.



Thanks to Bharath

FastAntivirus

Fast Antivirus (aka Fast Antivirus 2009) is a new fake security scanner (rogue). It belongs to the same family as MalwareCatcher, VirusShield, Extra Antivirus, Virus Sweeper, Ultra Antivir 2009, Virusdoctor, VirusMelt, VirusAlarm. Fast Antivirus comes from fake online scanners and detects nonexistent malwares to scare users.

Like the other members of the family, FastAntivirus2009 uses Google Code pages: hxxp://favprj1.googlecode.com

Crusader Antivirus Rogue

Crusader Antivirus has been classified as rogue. This software is produced by TRITAX Limited Software Company (DuckForce).



Looking at CrusaderAntivirus GUI and code, we can see references and common codes from AGAVA Antispy.





The registration verification code shows the contacted host:


activate.antispy.ru (89.108.66.62)
antispy.ru (89.108.65.143)
agava.ru (89.108.65.143)
(...)
AGAVA JSC: 89.108.64.0-89.108.71.255

Crusader Antivirus is a clone of AVAGA Antispy, but AVAGA is free. Unlike Crusader Antivirus there's no need to register to remove detected items.
Crusader Antivirus is a TRITAX Limited Software Company (DuckForce) product, but it contacts home (antispy.ru) to register itself...

Desktop Hijack

New malware has been found, it hijacks Desktop Background and promotes System Security 2009 Rogue with fake alerts.



It also pops up pr0n pages and display a fake BSOD:



Thanks to Malekal_Morte

CoreGuard Antivirus 2009

CoreGuard Antivirus is a new fake security scanner (rogue).



Stay away from these sites:
bitcoreguard.net (72.232.187.197)
bitcoreguard.com (72.232.187.197)
guardlab.com (72.232.187.198)
guardav.com (72.232.187.198)
coreguard2009.com (78.46.151.181)
coreguard2009.biz (78.46.151.181)
coreguard2009.net (78.46.151.181)
coreguardlab2009.biz (95.211.14.161)
coreguardlab2009.net (95.211.14.161)
coreguardlab2009.com (95.211.14.161)
guardlab2009.biz (76.76.103.164)
guardlab2009.net (76.76.103.164)
guardlab2009.com (76.76.103.164)

BleepingComputer CoreGuard Antivirus 2009 removal guide.
Thanks to MAD

Virus Shield

VirusShield is a new fake security scanner (rogue). It belongs to the same family as Extra Antivirus, Virus Sweeper, Ultra Antivir 2009, Virusdoctor, VirusMelt, VirusAlarm. Virus Shield comes from fake online scanners.



BleepingComputer Virus Shield removal guide.

ErrorEasy

ErrorEasy is a rogue that belongs to the same family as ErrorFix, RegTool, RegfixPro.
These fake tools are not detecting infected files or malwares but fake registry problems.



Another rogue (ErrorRepairTool) shows a relationship between, PC Utility Inc. (the editor of these tools) and 2Squared.com (a known rogue editor). But PC Utility Inc. claims that their products are legit and there is no relationship with 2Squared.com.

IP of ErrorRepairTool websites and the name of the company in the privacy page:
updatesprofessional.com (174.36.234.248) 2Squared Inc.
updates-micro.com (174.36.234.248) 2Squared Inc.
fixupdates.com (174.36.234.248) 2Squared Inc.
fix-xp.com (174.36.234.248) 2Squared Inc.
registry-updates.com (174.36.234.248) 2Squared Inc.

errorrepairtool.com (75.125.61.163) PC Utility Inc.
errorstool.com (75.125.61.163) PC Utility Inc.
errorsrepair.com(75.125.61.163) PC Utility Inc.

All pages where PC Utility Inc. was quoted have been removed (they were online yesterday). Google keeps some traces about it:


It was exactly the same page, but 2Squared Inc. was replaced by PC Utility Inc.


Back to ErrorEasy. To update itself, ErrorEasy contacts
ErrorEasy.com/databases/getinfo.php
database.registrysmart.com/updates/definitions.db
database.privacycontrol.com/updates/privacy.db

Looks like déja-vu, see RegistryFox Rogue (from another known rogue company: AntiSpyware LLC.).

database.registrysmart.com (75.125.200.226)
adwarealert.com (75.125.200.226)
evidenceeraser.com (75.125.200.226)
registrysmart.com (75.125.200.226)
restore-pc.com (75.125.200.226)

privacycontrol.com (75.125.61.162)
errorsweeper.com (75.125.61.162)
antispywarebot.com (75.125.61.162)
regclean.com (75.125.61.162)
2squared.com (75.125.61.162)

In the code of ErrorEasy, there is a hardcoded URL to 2Squared.com:



The Database is the same as AntiSpyware LLC. rogue.
There is a hardcoded string of 2Squared.com in the PC Utility Inc. tool.
And no relationship ?

Advanced Spyware Detector

Advanced Spyware Detector is a new rogue. It is also know under Advanced Spyware Detect or Advansed Spyware Detector (typo error in the binary tab version and registry keys).

This fake security software detects false positives to justify an infection and scare users.


It replace the desktop background with a fake security message.

Malware Cleaner

MalwareCleaner is a new rogue. This fake security software drops many fake executables on the system to justify an infection and scare users.



BleepingComputer Removal Guide.

ErrorFix, RegTool, RegfixPro

ErrorFix, RegTool, RegfixPro are new rogues. They are from the same family and have the same GUI. These fake tools are not detecting infected files or malware but fake registry problems.







Malwarebytes removal instructions for ErrorFix, RegTool, RegFix Pro.