|
|
Fake alert malware prey on innocent victims by displaying misleading scan alerts. They trick the user into buying fake antivirus, to fix such falsely exaggerated scan reports. This class of “scareware” software depends on extreme social engineering tactics and comes bundled with Backdoors, Password Stealers, Downloaders, Droppers, Browser Helper Objects, etc.
Each of the above class of malware are used either in the distribution of the fake antivirus itself or in the propogation of other kinds of malware once the fake antivirus is installed on the victim’s machine. Working towards a common goal – extorting money from an innocent victim – these scareware applications have added a new class of malware to their armory – rootkits.
Apart from hiding the scareware’s files, rootkits ensure that access to genuine security vendors’ sites is disabled. The rootkit we noticed, named “tdss[random characters].sys” was blogged about by Computer Associates recently and was associated with the AntiSpywareXP2009 scareware. We, however, noticed that this rootkit was protecting rogue components belonging to WinWebSecurity scareware. This implies that:
McAfee AV, will detect & clean this rootkit component from DAT version 5496 onwards. However, a user stuck with a machine that does not have antivirus with updated signatures, will have to clean this rootkit manually.
If you are a Windows user, apart from the usual safe computing practices that include using a firewall, an updated Windows operating system and an antivirus software, consider the following steps to minimize the chances of getting infected by such scareware:
On a final note, the Federal Trade Commission has recently won a restraining order against Innovative Marketing and ByteHosting Internet Services – companies responsible for marketing the scareware applications WinFixer, WinAntivirus, DriveCleaner, ErrorSafe and XP Antivirus. However, we will have to wait to see if this move actually has any impact on curbing the distribution of scareware.
|
|
Antispyware XP 2009 is a rogue spyware it is a clone of ANTIVIRUS 2009. Antivirus 2009 is an unwanted program, from the authors of Antivirus 2008 . These applications have resembling interface and “features”. After stealth installation, Antivirus 2009 will show tonns of fake spyware\adware detection messages and offers to remove reported threats (after you purchase commercial version). But in real Antivirus 2009 is not a spyware cleaner, it’s just an imitation of spyware remover. Antivirus 2009 can also slow your computer and cause system errors and crashes. I equally had the same problem and there is an easy way of removing it . First of all do CTRL+ALT+Delete then go to processes . Disable AntispywareXP 2009. After that the program was probably stored by default at C:/program files/AntispywareXP 2009
So go to your computer then click on C: Then on program files and find AntispywareXP delete the hole folder and it should disappear. Go on add or remove program it will be there just press remove and it will completely disappear.
Why didn’t McAfee detect and prevent the install of “AntiSpywareXP2009 ” on one of my computers? My version of McAfee on that computer is up todate.
Today within 15 mins of downloading McAfee on a new machine the “AntiSpywareXP2009″ popped up. How do I prevent this?
Nice blog Lokesh but Is this threat perceptible under McAfee rootkit detective radar?
Submit your own comments / message for this post