Rogue AV/AS prolific

[AplusWebMaster]

FYI...

Conficker hype used by rogue gangs
- http://www.f-secure.com/weblog/archives/00001639.html
March 30, 2009 - "... We found out that rogue security software folks have picked up on this. For example, lets have a look at remove-conficker .org, a domain which was registered today... They advertise a tool called MalwareRemovalBot. It's fake. Interestingly, it doesn't always find non-existing malware infections on your PC - only sometimes. But one thing is for sure, it does not remove Conficker.C. We tried it and it didn't do a thing to remove it. When it did find something that it claimed to be malware... And then it asked us to register and pay $39.95 for the removal functionality... When following up on this we did a Google search for "remove conficker.c" and saw several purchased ads that lead to the same type of "security" software as well... Like AdwareAlert and AntiSpy2009 It's clear that it's an affiliate program going on..."

(Screenshots available at the F-secure URL above.)

[AplusWebMaster]

FYI...

More Conficker rogue AV...
- https://forums2.symantec.com/t5/blog...article-id/173
04-02-2009 - "We have found spam samples attempting to capitalize on the frenzy over Conficker (a.k.a. Downadup), offering the latest in antivirus security software that purportedly protects users from the Conficker threat. Some of these SPAM messages even use names and images of software much like our own Norton AntiVirus 2009... it even mentions the name of one of our Symantec employees frequently cited in the press... In an attempt to increase financial gain, the product website is made to look like the product is one of our Norton consumer security solutions, by using the AntiVirus 2009 name and even comparing itself with other antivirus solutions such as Spybot, Kaspersky, and AVG... After clicking on the link inside the message, we find that it redirects to a website where the user is promptly given directions on how to make a payment. Whether or not any product will be made available after the payment is made is still unknown at this point. Even if it were, its effectiveness would be questionable because it will most likely be a rogue application or pirated software."
(Screenshots available at the Symantec URL above.)

[AplusWebMaster]

FYI...

- http://www.darkreading.com/shared/pr...leID=216403298
April 8, 2009 - "Rogue security software infections by just one family of malware jumped 66 percent in the second half of the year, according to Microsoft's new Security Intelligence Report (SIR)*... Microsoft says the Win32/Renos scareware attack was found on 4.4 million computers, for instance, and Win32/FakeXPA and Win32/FakeSecScan on 1.5 million machines. Other rogue AV types were also detected, bringing the total numbers of those types of infections to the 10 million mark..."
* http://www.microsoft.com/sir

[AplusWebMaster]

FYI...

New rogue: P Antispyware 09
- http://sunbeltblog.blogspot.com/2009...pyware-09.html
April 14, 2009 - "P Antispyware 09 is yet another rogue from WinSpywareProtect family of rogue security products."

New rogue: Antivirus'09
- http://sunbeltblog.blogspot.com/2009...antivirus.html
April 15, 2009 - "Antivirus'09 is a new rogue security product. This rogue uses fake/scare scanner pages to trick users into downloading the rogue application."

(Screenshots available at both URLs above.)

[AplusWebMaster]

FYI...

New rogue: AV Antispyware
- http://sunbeltblog.blogspot.com/2009...tispyware.html
April 19, 2009 - "AV Antispyware is the latest rogue from WinSpywareProtect family of rogue security products... Sites Involved:
64.191.12.38 Av-antispyware com
195.88.81.74 Files scanner-antispy-av-files com
195.88.81.116 dl scan-antispy-4pc com
195.88.80.207 Int reporting32 com ..."

(Screenshot available at the URL above.)

[AplusWebMaster]

FYI...

- http://preview.tinyurl.com/cqv4se
23 April 09 - PandaLabs blog - "... Cyber-criminals have chosen Rogue Anti-Malware as their primary method of payment because it has become easier for them to make money by affiliate systems and utilizing these types of attacks. It’s no wonder why we have seen more Rogue detections in the first quarter of 2009 then all of 2008... PandaLabs predicts that incidents of rogue AV scams will grow 100 percent quarter over quarter through the end of Q3*... Remember, It's just as important to update your web applications as it is to update your operating system. If you use Wordpress as a platform for your blog or website, then I recommend viewing the official hardening guide**."

* (Chart available at the URL above.)

** http://codex.wordpress.org/Hardening_WordPress

[AplusWebMaster]

FYI...

- http://www.f-secure.com/weblog/archives/00001684.html
May 18, 2009 - "How big an issue are Rogue antivirus applications? Let's take a look. What is your browser's user agent? Any ideas? The Firefox browser should look something like this: You can determine yours from http://whatsmyuseragent.com . Now let's take a look at this user agent:
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; AntivirXP08; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

Do you see it? Right there in the middle, "AntivirXP08". What is that all about? Some rogues modify the browser's user agent. We've seen hundreds of AntivirXP08 string variations. The modified string is possibly used to identify the affiliates responsible for the installation which drives "business" to the rogue's website. Modified user agents could also be used deliver different content. A victim with AntivirXP08 doesn't need to be convinced to download an installer, instead they can be targeted to complete the scam and to buy the rogue. How many infected user agents are out there? Toni examined one of our sinkholes and its April 2009 logs contained 63,000 unique IP addresses using agents that contain AntivirXP08. 63 thousand. That's a lot of infections, right? And that doesn't include other strings we've seen such as "Antimalware2009". It's a small measure of a very large problem."

(Screenshot available at the F-secure URL above.)

[AplusWebMaster]

FYI...

Rogue AV hosted in USA...
- http://sunbeltblog.blogspot.com/2009...ight-here.html
June 15, 2009 - "Contrary to popular belief, not all malware is hosted in Eastern Europe or China. In fact, there’s a whole bucketload of malware hosted in Scranton, PA. Here are malware domains associated with IP 64.191.92.197..."

(Long list and screenshots available at the URL above.)

[AplusWebMaster]

FYI...

Rogue AV terminates EXE files
- http://blog.trendmicro.com/rogue-ant...tes-exe-files/
July 26, 2009 - "This weekend, we at TrendLabs came across a FAKEAV variant similar to the one peddled in the solar eclipse 2009 in America attack in this recent blog post. This one, however, introduces another new scare tactic (so far the latest new ploy we’ve seen is the ransomware/FAKEAV that encrypts files in the infected computer and offers a bogus fixtool for a price). This FAKEAV variant terminates any executed file with an .EXE file extension and displays a pop-up message saying that the .EXE file is infected and cannot execute... This way, users are left with no choice but to activate the antivirus product since no other application works. This Trojan is detected by Trend Micro as TROJ_FAKEAV.B. It avoids terminating critical processes to prevent system crashes. Unfortunately, cybercriminals work hard in creating so many gimmicks, that we can only guess what comes next in FAKEAV..."

(Screenshot available at the URL above.)

[AplusWebMaster]

FYI...

Malicious Twitter Posts Get More Personal
- http://blog.trendmicro.com/malicious...more-personal/
July 27, 2009 - "... malicious Twitter posts are getting dangerously more customized, increasing the possibility of users getting hooked into malicious schemes. A Twitter spambot is said to have been used in launching this recent attack. The spambot creates Twitter accounts and fashion them to appear as legitimate accounts by posting seemingly harmless posts like those sharing certain music they listen to, or websites they visit. The spambot accounts then posts tweets directed to unknowing users, sharing a link to a PC repair tool they allegedly came across and used... the spambot posting tweets directed to specific users is a noteworthy social engineering technique that was clearly not seen as suspicious by Twitter admins. The spambot accounts were apparently created prior to a spam cleanup recently conducted by Twitter. Additionally, the spambot uses the URL shortener Doiop.com to mask the original URL in the posts, and for a not so good reason. The URL directs to a URL that triggers a couple of redirections that ultimately lead to the download of the file RegistryEasy.exe, which is detected as TROJ_FAKEAV.DAP. TROJ_FAKEAV.DAP comes off as an application that repairs registry problems. However, in true FAKEAV style, it merely displays false results to convince the user into purchasing the product... in the root of one of the URLs the user is redirected to, an advertisement for an application dubbed as Bot Lite is posted. Bot Lite is, as the post describes, a light Twitter bot that virtually anyone can use... Bot Lite does function as a spambot for Twitter. Its file name is bot_lite_100.exe. Its detection name is HKTL_FAKEBOT. HTKL_ is the detection prefix used by Trend Micro for hacker-tools which are considered to be Grayware. Grayware refers to applications that have annoying, undesirable, or undisclosed behavior but do not fall into any of the major threat (ie. Virus or Trojan horse) categories..."

(Screenshots available at the URL above.)

- http://ddanchev.blogspot.com/2009/07...curity_27.html
July 27, 2009