Lavasoft: What’s a Rogue – And Why Do You Need to Know?

You may not be familiar with the term ‘rogue software’ but there’s a very good chance that you or someone you know either has experienced it, or will in the near future. Keep reading for a look at a few important pieces of information on rogues that may help to keep you, your friends or your family from falling for this growing malware threat.

What are rogues? Rogues are fake security software – programs that masquerade as legitimate software needed to secure or protect your PC. Essentially, they are malware, pretending to be genuine Internet security programs. They aim to steal your money and private information, or expose you to other high risk cyber threats.

Just how big and bad is the rogue problem? According to our malware analysts here at Lavasoft, the rise of rogues has been dramatic over the past years, and that upward trend has only continued in the last few months. The graphic, below, illustrates the swelling numbers of rogue security software invading the Internet, showing the amount of rogue programs discovered by Lavasoft Malware Labs per year since 2005.

How can you stay safe from these rogue programs? Here are a few top ways:

• Read the February 2010 Lavasoft News for in-depth news on rogues including facts on how they spread, examples of their bad online behavior, and prevention tips. Be sure to pass on the information to those you think may benefit from it – it just may save them from falling for a fake.

• Use a trusted security program, like Ad-Aware, which detects and removes rogues. If you know that you have genuine anti-malware software on your PC, you can safely ignore other ‘security alerts’ you receive that aren’t from your chosen security provider.

• Be skeptical and don’t be bullied by scare tactics. When in doubt about a certain program, you can access experts at the Lavasoft Support Forums or refer to Lavasoft’s database of rogue security software at the Rogue Gallery.

For those interested in more technical details on rogues, Malware Labs has a whitepaper available: “Fraud Tools and the Malware Economy.”

Erin; Lavasoft

Lavasoft Malware Labs:New Rogue: MyPcSecure

MyPcSecure is the latest rogue anti-spyware application and a clone from the WiniGuardfamily.

MyPcSecure spreads by using fake online scanners. Once installed it will detect several false infections and the user is urged to license the software to remove these infections.

Ad-Aware will detect MyPcSecure as Win32.FraudTool.MyPcSecure and Win32.FraudTool.WiniGuard.

More on the ‘Aurora’ Attacks

In Lavasoft CEO Jason King’s commentary on the cyber attacks that targeted Google and dozens of other high profile targets, he noted that these so-called Aurora attacks were heard about and felt all around the Web, and around the World, making them of interest to us all to see what else develops. In just one week since that report was published, there have been a number of developments and interesting industry commentary on this.

So, for those following this story, here are a few of these updates:

• A security researcher’s analysis uncovered what’s believed to be strong evidence that the attacks came from China. Meanwhile, late last week, U.S. Secretary of State Hillary Clinton gave a speech on Internet freedom and urged China to investigate the attacks.  However, China’s government has formally denied involvement in the attacks, and a Chinese official responded that Clinton’s speech could “undermine China-US relations.”

• Sophisticated, targeted, ‘Aurora-style’ espionage attacks hit at least three large US oil companies in 2008, The Register and The Christian Science Monitor report.

• In his “Beware the Botnets” piece on CSOonline, security blogger Brian Krebs looks at the botnet angle behind the attacks – how botnets have enabled a ‘democratization of espionage.’

• In a new twist on the attack vectors used to hit Google and the other involved companies, according to a report in The Financial Times, attackers may have specifically targeted key employees and impersonated their friends on social networking sites to trick the victims into downloading malware.

We’ll continue to keep you updated here with more news on this as it relates to your security.

Ad-Aware Wins Softonic Award 2009 – Best Anti-Spyware

The results of the Softonic awards – where users pick the best software in 2009 across different categories and platforms – are in. And, the win in the ‘Best Anti-Spyware’ category … for its ‘advanced protection against all sorts of malware’…goes to… Ad-Aware!

Thanks to Softonic for short-listing Ad-Aware as one of the best programs of 2009, and thanks to everyone who took part in these awards, casting their vote for Lavasoft!

The Places They’ll Go; Children Going Online

Learn more about the issues kids of all ages face while navigating the Net.

“It’s 10 p.m. Do you know where your children are?”

That catch phrase of the past still applies today. But now, in our increasingly tech-centered world, it may be more fitting to ask, “Do you know where your children are online?”

The so-called “Internet generation” of today has grown up with computer technology as an ordinary part of everyday life. While young children and teens may be comfortable with their PCs, they are not immune to the boundless nasties of the Internet. Their online behavior may actually put themselves, as well as their families, at risk.

The Web provides many benefits to young computer users; it’s an important learning and research tool, not to mention a platform for socializing and games. In fact, almost 60 percent of children three years of age and older are using the Internet, according to industry reports. But, as is true in the real world, the cyber world carries a variety of hazards. What types of threats could they encounter as they navigate the Net?

• Online Predators

  The variety of Web 2.0 applications (like social networking sites, wikis, and other communication tools) means that the Internet is an effortless way for kids to meet old friends and make new ones. One danger that springs from this – usually at the forefront of children’s online safety discussions – is cyber predators; these online intruders take advantage of the Web’s openness and anonymity to prey on young people. Statistics from the National Center for Missing and Exploited Children show that about one in seven young people have received a sexual solicitation or approach while online.

• Cyber Bullying

  More than ever, children use the Internet to socialize and communicate with their peers. However, negative behavior that is carried out in the real world is not left offline. Statistics show that children may be more likely to experience online harassment from their peers, known as cyber bullying, than to be targeted by a stranger. According to i-Safe Inc., a non-profit group dedicated to Internet safety education, 42 percent of kids have been bullied online, and one in four have had it happen more than once.

• Inappropriate Content

  Another cause of concern is the inappropriate or even harmful content that the web may expose young surfers to, such as pornography and violence. Aggressive advertising and commercialism can be equally damaging. Messages targeting young people may attempt to persuade them to hand over money or information in order to get products that they want. In the wrong hands, personal or financial information can lead to invasive advertising, like pop-ups and spam, and even to identity theft.

• Stealthy Security Threats

  Sites that kids frequent may have advertisements popping-up regularly or attempt to download programs without your child asking for them. Novice computer users can easily be enticed to click banner ads and pop-up messages. It only takes one misguided click or website choice to infect your family’s PC with malware, spyware, or a virus. On top of that, even the most mainstream sites are subject to covert attack techniques like SQL injections and drive-by-downloads. Malicious intrusions can lead to privacy invasions, compromised personal information, and financial loss.

How can you minimize the danger of online threats and prepare young Internet users for wise Web use? The more knowledge children and teens have, the better prepared they will be to handle any type of online threat. For specific guidelines, see our Cyber Safety for Kids and Pre-Teens article.

Lavasoft Malware Labs Rogue Gallery

Lavasoft Malware Labs Rogue Gallery

The Rogue Gallery, powered by the Malware Labs at Lavasoft, is a resource dedicated to keeping computer users safe from rogue security software. By providing a comprehensive database of current rogue security applications, you have the ability to clearly see what programs are considered rogue – and avoid them.

Navigate the Rogue Gallery by displaying the latest threats or by searching for specific programs, listed in alphabetical order. Use the “Submit a Rogue” link to quickly and easily send any suspicious programs directly to Malware Labs to be analyzed.

Lavasoft Malware Labs; New Rogue: SpyEraser

Lavasoft Malware Labs came across this rogue today. It’s called SpyEraser and installs and runs from %HomeDrive%\Windows\System32. Usually rogue software creates a folder located in %ProgramFiles% or %ApplicationData% but SpyEraser makes an exception. It behaves like a normal fraud tool by causing annoying security alerts and trying to entice users to purchase their useless application.

Lavasoft Malware Labs; New Rogue Programs

DataDoctor2010 is a new fraudtool which is spread via trojans.

Another WiniGuard clone is out in the wild. It’s now called ProtectPcs.

MalwareDefense is the third new rogue application which Lavasoft Malware Labs have been investigating today and it’s a clone of ProtectionSystem.

SecurityCentral is a new painful rogue application. It will prevent execution of several Windows and security applications and disable Task Manager, DOS Prompt and Regedit to avoid users from killing the process manually. The cyber criminals running out of uniqe names. This rogue have “stolen” the name from another fraudtool which was released in August 2009.

APCprotect is a rogue antispywae application and it is the latest clone of the Winiguardfamily.

Lavasoft Malware Labs; New Rogue: SysDefence

SysDefence is the latest clone of the WiniGuard rogues.

Ad-Awarewill detect SysDefence as Win32.FraudTool.SysDefence and Win32.FraudTool.WiniGuard.

Lavasoft Malware Labs: New Rogue: IGuardPc

A new Winiguard clone has now been released. It’s called IGuardPc.