rogues

Alias: SysProtect, SafetyDefender, SpywareQuake, AdultFriendFinder, YourOnlineSecurity, BloodWorm, BloodHound, BlackWorm Virus, WinAntiVirus, PestTrap, MalwareWipe, Sinnaka.A@mm, The SpyGuard, SpyAxe, SpywareStrike, WinFixer, TopAdwareReview

Description:
One of the most common computer hijackings nowadays is done by one of three advertising trojans (Zlob, Vundo or Smitfraud). These trojans hijack a user's computer and generate warning messages claiming that the user's computer is infected, then the trojan directs the user to one of many rogue security websites to download a spyware remover. The spyware remover will run a free scan and falsly identify infections in hopes of scaring the user into buying the full version of the rogue remover. Many of the rogue websites look similar to the screenshot below:



Many websites are associated with these three trojans. Below is a list of current ones:

5starvideos.com
catsearches.com
dailyfreepass.com
digipassword.com
dns404.net
dnserror404.com
downldboost.com
fhgstr.com
freetestonline.net
Goforsearch.com
Gogates.net
Guardsoftware.net
h00auth.net
hdnsservidce.com
Idrct.com
Igte.net
Interestsdirs.com
iqsearch.net
moviereality.com
moviestemptation.com
mshelpdesk.net
necessaryupdates.com
needupdate.com
newdumpsev.com
Newsearchs.com
notfound404.com
onlinesecurityhelp.com
onlinesecuritysolution.net
onlinesecuritytest.net
Onlyfavorite.com
p2pfiles.net
patchyoursystem.com
Pc2006.net
pcsecuritycheck.net
pcsecurityupdates.com
Perfectups.com
perfectedsecurity.com
personal404.com
Picsbomb.com
Popentertain.com
popfinder.net
Protectsystem.net
qfind.net
realsecurityonline.com
regdoor.com
Safesoftwareguide.com
safetydefender.com
Salesguides.net
search2k.net
Searchem.net
security2k.net
securitycaution.com
securitydownload.net
securityerror.com
securityerrors.com
securityfix2006.com
securityindex.net
securityindex.net
securityindex.nt
securitylist.net
security-look.cc
security-toolbar.com
securityfeature.com
securityupdater.com
securitywarning.net
securitywarnings.net
SpywareStrike.com
syserrors.com
Sysprotect.net
Systemdefender.com
systemsecurityindex.com
systemupdate.net
systemupdates.net
systemwarning.com
testsecurityonline.com
todaywarnings.com
updatescenter.com
updatesearches.com
updatesystempage.com
updateyoursystem.com
uptodatesecurity.com
vcodec.com
vcodecdownload.com
Vidcodec.com
Videocodecupdate.com
videosgalleries.com
vidscodec.com
ware2006.com
warningmessage.com
welcomepage.net
Winprotections.com
yourfreevids.com
youronlinesecurity.com
yoursecuritysystem.com
yoursystemupdate.com

Threat type:

Hijacker - A Hijacker is a software application that takes control of your browser's settings. Usually it changes your home page and redirects it to some unknown site or modifies your search settings. It prevents you from changing back your browser's settings. An infected browser usually operates much slower.

Ransomware - Ransomware is a software application that infects a computer and asks for money to have the infection removed.

Trojan - A Trojans or Trojan Horse is any programs that installs itself secretly, quite often with sinister intent. Once installed, the trojan author (hacker) can gain complete control of the infected PC. Trojans are usually designed to steal sensitive information and/or destroy the system. Trojans can be distributed as unsolicited email attachments, or bundled with freeware and shareware programs.

Advice: Remove This is a very high risk threat and should be removed immediately as to prevent harm to your computer or your privacy.

Detection:
SpyNoMore detects rogues: Yes

Threat risk: Very High Risk

Extremely dangerous malware. Uses stealth installation, randomly named entries and has the capability to self update or resurrect after incomplete removal. Almost impossible to remove manually. Category mostly consists of trojans and spyware.

Symptoms:

Warning messages claiming virus or worm infections

Redirects to rogue security websites

Installations of rogue spyware removers

rogues Signature Details: The following information includes some of the standard signatures associated with this spyware threat. Please do not attempt to manually remove these items from your computer; Removing these items incorrectly or partially can cause your computer to experience critical errors, prevent your computer from restarting or cause loss of Internet connectivity. Should you be infected with rogues, you can clean your computer by downloading SpyNoMore now.

Running Process Signatures:
N/A

File Signatures:
N/A

Registered Dll (Dynamic Link Library) Signatures:
N/A

Folder Signatures:
N/A

Registry Signatures:
N/A

SpyNoMore Collected Residual File Signatures:
N/A

See Also:
SpyFalcon
WinFixer
PestTrap
SpywareQuake
SafetyDefender.com
AntiSpyLab
ProSearching
Bestsafetyguide
Bestsecurityguide