New rogue: TrustFighter

by LS Anders on October 13th, 2009 in Rogues, Security Alert.

TrustFighter is the latest clone of the WiniGuard family.













For several weeks now, these rogues have been coming out with new names almost every day. Previously we have seen names like SafeSoftness, TrustWarrior, SafeSoldier, BlockDefense - to name a few. However, the GUI (graphic user interface) has not changed, and neither has the behavior of the rogue.

The rogue uses a fake online scanner that finds plenty of threats on the machine.
















The user is then prompted to download and install the rogue. Once installed, the rogue drops several fake files that it then will detect.

Ad-Aware will detect this as Win32.FraudTool.TrustFighter.