Virus Strains

XP Antimalware 2010 is rogue security application that claims to be specifically developed to protect from threats against the Windows XP operating system and is related to Vista Antimalware 2010 and Win 7 Antimalware 2010. It uses scare tactics to try and induce users into paying for its license. XP Antimalware 2010 reaches the user’s system via Trojans that advertise security scans of the user’s computer. Once installed, XP Antimalware 2010 blocks Windows utilities such as Task Manager and Registry Editor to prevent the user from attempting to remove it.

User Protection is a fake anti-spyware program that belongs to the same family of rogue security software as Paladin Antivirus and Dr. Guard, which tries to trick users into paying for a software license. It gets installed on a user’s computer by using Trojan viruses that get downloaded from malicious websites. Once installed, User Protection disables essential system tools such as Task Manager and Registry Editor.

Security Guard is a rogue spyware program that is related to the well known fake security software Cleanup Antivirus. Security Guard tries to trick users into purchasing its license. It enters a user’s computer via Trojans or other malicious software that download and install Security Guard. Once installed, this rogue software creates a number of harmless files on the hard disk. Then it will endlessly perform fake system scans and return results and flag the above created harmless files as security threats.

A fake anti-spyware program much like many other dangerous rogue security applications propagating throughout the internet today, PC Bug Finder Pro uses fear tactics to induce the user into purchasing a software license. PC Bug Finder Pro is heavily promoted online by fake websites which claim to scan the user’s computer and come up with a number of fake threat warnings. These websites urge the user to download a copy of PC Bug Finder Pro.

Win32/Rimecud is a dangerous worm that affects any computer with a Microsoft Windows operating system installed on it. It is used by attackers to gain unauthorized access to user systems. Win32/Rimecud reaches user systems through removable media such as USB flash drives, hard disks etc as well as through spam emails to which Win32/Rimecud is appended as an attachment. Once installed on the computer, Win32/Rimecud creates a number of malicious files to carry out its work. It also creates a number of fake registry entries.

Sdbot.add is a worm that grants access to the user’s system to a remote attacker. Sdbot.add mostly operates through IRC channels, and it drops a rootkit in to the infected system which allows the malware developer to enter the administrator (root) account of the computer. The attacker may then use Sdbot.add to gain private information about the user or the attacker may use it as a zombie to attack a server. Sdbot.add gets installed along with freeware/shareware, through peer-to-peer software or by getting downloaded from malicious websites.

Blaster Keylogger, also known as Lsas.Blaster.Keylogger, is a fake Trojan warning generated by the rogue anti-spyware known as System Security 2009. System Security 2009 gets installed through other Trojans which get downloaded from malicious websites. Once installed, System Security 2009 will conduct fake scans of the system and generate reports which show a large number of non-existent virus threats. Among these falsely generated threats will be the name of Lsas.Blaster.Keylogger.

Explanation: Trojan FakeAV is a name given by security expert Trend Micro for rogue security software. Trend Micro identifies these malicious programs as those which that pretend to be legitimate system security programs to trick the user in to making some form of payment. In the process the Trojan FakeAV gains access to the user’s credit card information. Normally, Trojan FakeAV applications propagate through the internet by using a number of methods:

If you think your computer may be part of a botnet or you just want to ensure it is fully clean then we recommend you simply download a copy of Spyware Doctor with Antivirus and run a full scan.  This will tell you if you are infected with a Botnet.

This is the error most people are seeing. “WARNING WINDOWS SECURITY CENTER! DANGEROUS TROJANS, KEYLOGGERS AND SPYWARES DETECTED IN YOUR COMPUTER!!!

For Security of your data computer is locked...

To unlock your computer buy the antispyware software below and remove all viruses as soon as possible.

The Bagle Bot is a worm that appeared first in 2004 and has had hundreds of iterations. Many of these iterations have engaged in different kinds of malicious activity. It is also known by the names Beagle, Mitgleider and Lodeight. Bagle Bot reaches user systems via malicious websites on the internet. Once downloaded and installed, Bagle Bot proceeds to create its files and modify registry entries. The primary objective of Bagle is to relay spam emails and send them to unsuspecting users. The spam emails themselves depend on the server they are being relayed from.

Trojan Bredolab is a malicious software application that forces its way on to the user’s system and attempts to install other parasites on the system. Also known as Win32 Bredolab, this Trojan reaches user systems through spam email attachments which come with blackhat social engineering methods which are used to trick users into downloading and running a file that will install the Trojan Bredolab on the computer.

The Netsky is a family of computer worms whose primary goal is to generate and send a large number of spam emails. This worm is also known by the name of Win23 Netsky The rivalry between Netsky, Bagel bot and MyDoom to become the most notorious email worm was given a large amount of publicity during its time.

The Trojan Oficla is a malicious software application that modifies systems that it infects and attempts to download fake anti-malware applications. This Trojan, which is also known as Win32 Oficla, reaches user systems via spam emails that warn about a certain alleged payment made by the user, which is of course fake. The user is asked to download a payment inspector attached to the email which will determine whether the payment was indeed made. Naturally, the user will try to download the attachment to prove that they have not made any such payment.

Zwunzi is an adware application that is categorized as a Potentially Unwanted Program (PUP). It comes bundled with other software that normally is not malware and its primary function is to redirect user searches to its homepage. The most common application that the Zwunzi will get installed along with is a free mp3/wma/ogg converter that works very well in a legitimate fashion. However, Zwunzi will perform its actions separately and install a browser plugin that redirects the user to the Zwunzi homepage whenever the user attempts to search the internet via a search engine.

Dr. Guard, which is related to Paladin Antivirus, is a rogue security software application that tries to trick users into purchasing its license by using techniques similar to its relative. Dr. Guard gets installed on a user’s system via Trojan viruses that get downloaded through bogus websites which claim to have security scanners and along with fake video codec packs. Once installed, Dr. Guard disables all security software present on the system, and proceeds to load at startup.

Threat Description: Security Smart is a false security client that is a direct clone of Security tool. Security Tool had a huge impact infecting millions of computers over the last several months. Chances are Security Smart will do th same thing. In most cases users get infected with this client from false video codecs, infected e-mails and drive by download attempts. Security Smart will show FALSE and missleading error messages and scans. The results and warnings of this client are 100% FALSE. Do not fall prey and pruchase this bogus software.

Zlob is a dangerous malware application that has been designed to give backdoor access to an attacker so that he or she may take control of the user’s computer. This has endless implications as the attacker may use Zlob to retrieve private data, stop or damage user processes or use the computer as a zombie to send spam emails. Zlob gets downloaded and installed along with other malicious software such as Trojan viruses from dangerous websites and from attachments that come with spam emails.

Koobface is a worm that usually manifests itself on social networking websites such as Facebook and MySpace. Once a user’s Facebook or MySpace profile gets infected with Koobface, links to various websites are displayed on the profile. If anyone clicks on these links they lead to websites which promote a fake video codec. They will seem to be installing said codec, but in fact they install Koobface on the user’s computer. If Koobface does not find cookies related to social networking websites on the user’s computer, it will simply delete itself.

Info: Virus Protector is a fake anti-spyware program that tries to trick users in to paying for its software license. It gets installed on a user’s computer by using Trojan viruses that get downloaded from shady websites on the internet. Once installed, Virus Protector creates a number of fake and harmless files in the computer’s hard disk. It then proceeds to load itself as a startup program and performs a large number of fake scans on the system reporting that the system is dangerously infected with malicious software.