Topic: New 'rogueware' variants spotted

[Clive]

Security researchers have warned of three new variants of fake anti-virus programs, also known as 'rogueware', in circulation.

The malware attempts to convince anyone unwise enough to install it on their system that they should hand over money in order to wipe non-existent viruses from their system.

The three programs use different names but look very similar.

"Three of the new families we've seen this week, called SaveKeep, SaveSoldier and TrustNinja are at the end the same rogueware but rebranded, which is one of the common strategies they use," said Luis Corrons of PandaLabs.

Using programs that claim to be legitimate anti-virus software has become a common tactic among cybercriminals.

AntiVirus XP and VirusRemover 2008 both emerged last year, aiming to con surfers into paying money to have non-existent infections removed.

[Simon]

Thanks for the heads up, Clive. 

[chorleydave]

I've spent most of the day cleaning a friend's computer from one of these programs called "Personal Antivirus".  I had to remove it manually as none of the usual anti-malware programs could remove it (i.e. Malwarebytes, AVG, Superantispyware etc.).  In fact, these programs wouldn't even install until I changed the name of them and then they found it but couldn't cure it.

[sam]

Thanks for the heads up, Clive. 

more doom and gloom eh Clive? 

[Clive]

Beware the Ides of March.   

[davy51]

I got one of these last week in a drive by
It didnt ask for permission to download
It disabled my firewall and all antivirus and spyware hunters

Anytime i  went online to run a anti virus or spyware scan it would reboot the computer

Almost impossible to get rid of it locked the program so I couldnt delete it had to use an unlocker before I could delete it

Mine was TSSD!IK

[GillE]

Politicians are rogueware.  Every few years they keep coming back and asking for your vote.  If nobody fed them, perhaps they would go away.

[Clive]

Almost impossible to get rid of it locked the program so I couldnt delete it had to use an unlocker before I could delete it

Mine was TSSD!IK

That must have been very scary davy.  Where did you manage to get the unlocker?   

[davy51]

That must have been very scary davy.  Where did you manage to get the unlocker?   

I got it here Clive it will unlock most programs unless they are protected by some brands of firewalls
http://ccollomb.free.fr/unlocker/

[Clive]

Thanks very much davy.  That might prove very useful!   

[davy51]

Your welcome Clive
I have others if you ever need them