A new clone from the MalwareCatcher rogue security software family has now been released. 

The fraud tool is called SecurityAntivirus and will add hundreds of registry keys within:

In light of recent rise in use of Adobe Reader exploits, we ask each of you to update to the latest version of the software. This popular software is on so many of your machines and it is imperative that you get the patches for recent Internet security vulnerabilities.

We’ve already seen a high amount of bad online behavior taking advantage of the H1N1, or swine flu, outbreak in the past few months. Early this spring, cyber scammers were quick to capitalize on swine flu fears to infect computers, steal personal information, and make profits. After all, from the cyber criminals' perspective, the topic has all the right characteristics needed to pull off an online scam: a global nature, a hot media-hyped issue, and high levels of curiosity and concern by the general public.

The U.S. Federal Bureau of Investigation has issued a new advisory for law firms and PR companies to take heed of:

By way of an ongoing FBI investigation, it’s been found that hackers are increasingly targeting U.S. law firms and public relations groups with spear phishing e-mails containing malicious payloads, in an attempt to break into their computer networks to steal sensitive information.

According to the FBI’s e-scam advisory:

PAntispyware09 is a new rogue anti-spyware application and a clone of MsAntispyware2009. It will give exaggerated threat reports on the compromised computer, then ask the user to purchase a registered version to remove threats which do not exist.

Antivirus09 (or Antivirus’09) is a new rogue that follows the normal rogue procedure. It is distributed through a web page that presents the user with a fake online scanner.

 

 

 

 

 

 

 

 

 

Buyers Beware

by Erin on March 13th, 2009 in Lavasoft Products, Security Alerts.

A word of caution to all of you online shoppers browsing the Web for the best buys: if it looks too good to be true, it just may be.

We’ve recently come across a website that is misrepresenting itself as a Lavasoft affiliate, and selling copies of our Ad-Aware Pro software that are not legitimate or supported by our company.

Be on the lookout: a new warning has been issued to consumers about economic stimulus scams via incoming e-mail and fraudulent websites.

Antispyware Pro 2009 is a new rogue anti-spyware application. It will give exaggerated threat reports on the compromised computer then ask the user to purchase a registered version to remove threats which don't exist.

Lavasoft Malware Labs recently had a closer look on an IP range full of hoax sites. Reverse IP on 78.129.142.235 will reveal around 200 fraudulent domains which are hosted in United Arab Emirates.  Most of the sites hosted under 78.129.142.235 will use and take advantage of already existing products from the security industry and other popular software. The examples below display their way to make illegal domains look reliable.

hxxp://7zip-2009.info
hxxp://Directx-full.info
hxxp://Icq-full.info
hxxp://Messengerplus-2009.info
hxxp://Safari-full.info
hxxp://Winrar-2009.com
hxxp://Www-kaspersky.info

Today a new rogue was discovered called Spyware Fighter.  It is following the normal patterns with false detections and trying to scare the user into buying a license to clean them.

 

Further it has the classic user friendly home page available under a few similar named domains.

 

SpywareFighter was added to detection in release 0146.0017.

Some new rogue anti-virus programs to be aware of...First out is XPVirusProtection with a standard looking website.

Homepage

© 2010 Lavasoft. All rights reserved.