Rogue anti virus and spyware Guide

kenn3th SG

Rogue security software is software that uses malware (malicious software) or malicious tools to advertise or install itself or to force computer users to pay for removal of nonexistent spyware. Rogue software will often install a trojan horse to download a trial version, or it will do other unwanted things. The first and still most comprehensive study of rogue and real antispyware programs [1] was carried out by Eric L. Howes, one of the world's most renowned security professionals.
Contents

* 1 Effects
* 2 False Positives
* 3 Detection
* 4 Rogue Software
* 5 See also

Effects

The main goal of rogue software makers is to sell their product. Many times fake Windows dialog boxes will appear. Most of the time, they will display a message such as "WARNING! Your computer is infected with spyware! Buy our product to remove it!" Usually, when the dialog box's OK button is clicked, this will direct the user to the software's website. Sometimes, even clicking the upper right hand X button to close the dialog box will produce the same effect or activate the software's installation. (Pressing Alt+F4 can circumvent that trick). Some software, like SpyAxe will automatically download the trial version without any user action (drive-by installation).

False Positives

A variant of the above technique that rogue security software makers use is that of false positives. A false positive is a fake or false malware detection in a computer scan. This can convince even such users that their computer is infected who may not be deceived by the abovementioned similar claims without a scan. This is quite different from an accidental false positive, which can be produced in a scan by security software from honest companies.

Detection

Almost all antispyware software will detect rogue software if it is in a computer. Oftentimes, rogue software will install a Trojan horse to download the software from the maker's website, like Titan Shield. Antispyware software can detect the Trojan even before the software is installed. Programs such as , AVG Anti-Virus, CounterSpy, Spybot - Search & Destroy (free), Spy Sweeper, Spyware Doctor, SUPERAntiSpyware (pay), and Windows Defender (free for Windows XP users) can usually detect these. However, often removal of new, aggressive rogue programs requires use of programs such as HijackThis combined with manual removal processes because it can take quite a while before the manufacturers of the abovementioned legitimate programs learn how to automate the process and update their programs. Use of HijackThis without specialist help can cripple a computer, and users are advised to get help from the many voluntary specialists in many forums such as Spyware Warrior, Safer Networking, and many others.

Rogue Software

* ErrorGuard
* SpyAxe
* Malware Wipe
* WinFixer
* SpyFalcon
* PSGuard
* Titan Shield
* SpySheriff
* Pest Trap
* AntiVirus Gold
* WorldAntiSpy
* SpyTrooper
* SpyWiper
* PAL Spyware Remover
* Spyware Stormer
* Spyware Quake
* SpywareNo

from http://en.wikipedia.org/wiki/Rogue_software

kenn3th SG

Bogus Security Pages

Rogue anti-spyware products have long been known for using aggressive, misleading advertising and marketing, but in the Fall of 2005 a number of these programs began to be pushed on users through incredibly deceptive web pages that were often forced on users through browser hijacks. Many of these pages are deliberately crafted to look like the Windows XP SP2 Security Center, and they may be coupled with flashing tray icons that are designed to look like notices from the Security Center as well as false warnings that malware has been detected on the user's PC.

found:http://www.spywarewarrior.com/rogue_anti-spyware.htm#sites

kenn3th SG

If Your PC is Infested w/ Spyware...
Getting help online...

If your PC is already infested with spyware and adware, resist the temptation to succumb to impulse buys of anti-spyware products that you see on the Net, esp. those included in the "rogue/suspect" list on this page or advertised on Google. Instead, you can get help online from a corps of savvy volunteers who specialize in busting spyware.

To get help with a spyware infestation:
1. Clean your PC as best you can

Download and run one (or all) of these free anti-spyware scanners and remove whatever spyware and adware it finds.
Ad-aware Personal Edition AVG Anti-Spyware Windows Defender
Spybot Search & Destroy SUPERAntiSpyware

You should also scan and clean your computer with whatever anti-virus program you happen to have installed on your computer. If you don't have an anti-virus program, you can scan your computer with one of these online anti-virus scanners:
BitDefender ScanOnline Microsoft Malicious Software Removal Tool ewido online scan
Command on Demand Panda ActiveScan Trend Micro Anti-Spyware for the Web
eTrust AntiVirus Web Scanner Trend Micro HouseCall (ActiveX)
McAfee FreeScan Trend Micro HouseCall (Java)

... or download and run one of these free standalone virus removal tools:
avast! Virus Cleaner Microsoft Malicious Software Removal Tool Dr.Web CureIt!
AVG vcleaner Panda PQRemove
McAfee AVERT Stinger Sophos SAV32CLI

2.

Visit a spyware removal forum

Once you've cleaned your PC as best you can, visit one of the following spyware removal forums:
SpywareInfo Spybot S&D
Aumha SpywareBeware
Bleeping Computer Spyware Warrior
CastleCops Tech Support Guy
Cexx.org TomCoyote

3. Follow the instructions for posting a HijackThis! log

Most of the above forums will request that you post a HijackThis! log. HijackThis! (HJT) is a free program that will scan key system settings on your PC and generate a plain text log that you can copy and paste into a post. The volunteers at the above forums will examine that HJT log and recommend a course of action to fix your PC. HijackThis! can be downloaded from http://www.spywarewarrior.com/uiuc/merijn/HijackThis.exe

Each forum has its own set of instructions and procedures for requesting help and posting a HJT log, so abide by the requirements of the forum you're visiting. Also, do not attempt to use HJT on your own to fix problems. Let one of the expert volunteers examine your HJT log and advise you on what to fix.

4. Help the volunteers help you

In order to help you clean your system, the volunteers at these anti-spyware forums need a good sense for what's going on with your computer. When you're ready to post and request help...

* Start a new discussion topic/thread.
* Give your discussion topic/thread a distinctive title.
* Describe the symptoms and problems you're experiencing.
* Describe what you've already done to solve the problem.
* Copy and paste your HJT log into your post.
* Be patient while waiting for a response.

Note that some of the forums listed above may require you to register for free before posting.

5. Follow removal instructions precisely

Once a volunteer does give you advice for cleaning your PC, follow those instructions precisely and report back what the results are. Also, you may be asked to download and run other specialized anti-spyware tools to remove the particular spyware that's on your computer.

The volunteer spyware busters who work these anti-spyware forums do this kind of thing all day long, so you'll be in good hands. At times they can be a bit overwhelmed, so please be patient while waiting for help.

Once your PC has been cleaned, be sure to take steps to prevent it from being overrun with spyware adware again.

Found at: http://www.spywarewarrior.com/rogue_anti-spyware.htm#sites

kenn3th SG

Trustworthy Anti-Spyware Products
Protecting your PC w/ quality anti-spyware applications...

When choosing anti-spyware protection, you should rely on products with deserved reputations and proven track records. That means avoiding the new and unknown, and not succumbing to impulse buys of anti-spyware products that you see on the Net, esp. those included in the "rogue/suspect" list on this page or advertised on Google.

At the very least, you should have an anti-spyware scanner, and there are several reputable anti-spyware scanners available on the Net -- some even for free. But anti-spyware protection goes beyond having an anti-spyware scanner like Spybot Search & Destroy or Ad-aware. Even after installing and running an anti-spyware scanner, you should take steps to lock down your browser and protect your system against further infestation by spyware and adware.

What follows below is a set of recommended steps for installing anti-spyware protection for your PC. If your PC is already infested with spyware or adware, see the instructions for getting help included later on this page.
1. Install an anti-spyware scanner (or two...)

One basic tool in every user's toolbox of software ought to be an anti-spyware scanner. There are several excellent anti-spyware scanners available -- some free, some for pay. These include (but are not limited to):
Ad-aware
AVG Anti-Spyware
Pest Patrol
Spy Sweeper
Spyware Doctor
SUPERAntiSpyware
Windows Defender

Disclaimer: the maintainers of Spyware Warrior have enjoyed consulting relationships with Sunbelt Software, makers of the CounterSpy anti-spyware application. Given that relationship and the inherent conflict of interest it represents, we refrain from recommending CounterSpy. Spyware Warrior has no financial relationship with any of the companies whose products are listed or recommended above. We are not employees, affiliates, representatives, or other agents of any of these companies.

In addition, there are other "freeware" scanners that you may find useful:
Spybot Search & Destroy

Anti-spyware scanners work much like anti-virus applications (such as Norton Anti-Virus, McAfee VirusScan, et al), except that instead of scanning your PC for viruses, trojans, and worms, they scan your computer for spyware, adware, and dialers.

You should not rely exclusively on this short list of anti-spyware applications, however. Rather, you should investigate and test a range of reputable anti-spyware programs to find the programs that are best suited to your own privacy and security needs.

We recommend using at least two anti-spyware scanners regularly, as one will often pick up items that the other misses. Even after you install an anti-spyware scanner, be sure to keep it updated because new spyware and adware appears on the Net almost daily.

Anti-Spyware for the Mac

We're starting to get more and more questions from Mac users about anti-spyware. At this time, the only anti-spyware program that we know of for the Mac is:

MacScan

Anti-Virus & Firewall Applications

In the past year, several anti-virus, anti-malware, and personal firewall applications have incorporated robust anti-spyware detection and removal. These programs include:

Agnitum Outpost Firewall Pro
F-Secure Anti-Virus & Internet Security
Kasperksy Anti-Virus & Security Suite
Norton Anti-Virus & Internet Security
NOD32
Panda Titanium & Platinum
Trend Micro PC-cillin
ZoneAlarm Pro & Security Suite

Although these anti-virus and personal firewall products may offer some protection against spyware and adware, we still recommend that users not rely exclusively on one of these products in lieu of a dedicated anti-spyware product, such as those listed earlier on this page.

Disclaimer: the maintainers of Spyware Warrior have enjoyed consulting relationships with Sunbelt Software, makers of the CounterSpy anti-spyware application. Given that relationship and the inherent conflict of interest it represents, we refrain from recommending CounterSpy. Spyware Warrior has no financial relationship with any of the companies whose products are listed or recommended above. We are not employees, affiliates, representatives, or other agents of any of these companies.

2. Install anti-malware protection

Basic Free Protection

Scanning for spyware and adware isn't enough to protect your PC. You also need to take preventative steps to ensure that unwanted software doesn't come back. One effective way to prevent spyware and adware from returning is to install an anti-spyware prevention program such as:
SpywareBlaster
SpywareGuard

SpywareBlaster and SpywareGuard are excellent, free programs from JavaCool. I recommend installing and using both, as they protect your computer in different ways. SpywareBlaster "inoculates" your Internet Explorer browser against the installation of unwanted spyware and adware from the internet. SpywareGuard actively monitors your PC and prevents spyware infestations. Both are easy to install and update.

Advanced HIPS & Rootkit Protection

In the past few years a new generation of anti-malware protection products has emerged. This new type of anti-malware protection, called HIPS (Host Intrusion Protection System), works at the kernel level to intercept malware before it hits your hard drive and infects the system. Although this technology is still maturing, a HIPS defense may be worth looking into for some users. For a run-down of the latest HIPS applications, see this discussion on the Spyware Warrior forums:
Sandbox, HIPS, Virtualization, & System Hardening Apps

Advanced users may also be interested in the broadening array of anti-rootkit programs that are available:
Rootkit Info & Detection Apps

Please keep in mind the HIPS and anti-rootkit applications are both emerging technologies that may not be appropriate for home users who aren't technically savvy.

kenn3th SG

3. Lock down your browser

One of the most prevalent means for spyware and adware to be installed is through Internet Explorer. To prevent spyware and adware from installing without your knowledge and permission, you need to "lock down" Internet Explorer. There are several ways to do this.

Securely configure the Internet zone

First, you can securely configure the Internet zone of Internet Explorer and add sites that you trust to the Trusted sites zone. This means that by default web sites will not be able to use "active content" (i.e., ActiveX controls, Java applets, and scripting) until you explicitly choose to trust those web sites. See this page for instructions on how to securely configure Internet Explorer:

Internet Explorer Privacy & Security Settings

By turns, you could also use this free program, which will automatically configure Internet Explorer for you:

Enough is Enough!

One potential downside to securely configuring the Internet zone is that some web sites will not work properly until you add them to the Trusted sites zone -- a process that some users find cumbersome.

Add bad sites to the Restricted sites zone

Second, you can use another approach to "locking down" Internet Explorer which avoids the hassle of broken web sites by adding known "nasty" sites to the Restricted sites zone. Doing so gives your PC protection against known threats while still allowing most web sites to work by default. To put the clamp down on a long list of undesirable web sites, you can install and use this free program:

IE-SPYAD

If you choose to use the Restricted sites approach of IE-SPYAD, be sure to update your copy of IE-SPYAD regularly, as new web sites are constantly being added to the list.

4. Use an alternative browser

Internet Explorer is not only the most popular browser on the Net, it is also the browser most widely and easily exploited by spyware pushers to install spyware and adware behind users' backs. Thus, you might decide that Internet Explorer is simply not worth the hassle or risk. In that case, you can install and run an alternative, non-IE browser such as:
Mozilla
Firefox
Opera

All three of these browsers are mature, robust, and fast. Moreover, they have built-in pop-up blocking and several other nice features that Internet Explorer simply lacks. More importantly, all three of these browsers are much less susceptible to unwanted adware and spyware installations. And all three are free.

Note: even if you do switch to an alternative browser, you should still lock down Internet Explorer, as described above. Given that Internet Explorer has effectively been integrated into Windows, it can still be exploited by adware and spyware that gets installed to your system through other means. Thus, locking down Internet Explorer remains important even if you're not regularly using Internet Explorer to browse the internet.

5. Keep your system safe & secure with Windows Update

To prevent unwanted spyware and adware from being installed behind your back, you need to install all the latest "Critical Updates" from Microsoft. Doing so is easier than you might think.

Microsoft has an entire Windows Update site devoted to automatically updating users' systems with all the latest fixes and patches for a wide range of Microsoft software, including Windows, Office (Word, Excel, PowerPoint, Access), and Internet Explorer.

We strongly urge you to take your system past the Windows Update site and let that site download and install the appropriate fixes for your computer. Doing so just might save you some grief and headaches down the road:

Windows Update
http://windowsupdate.microsoft.com/

Much of the update process at Windows Update is automated, so it's simple and convenient. The Windows Update site will install a small program to analyze the software on your system and recommend the appropriate fixes. This process takes only a few minutes.

Once Windows Update has finished analyzing your system, you'll be presented with a menu of downloads that Windows Update deems appropriate for your computer. At a minimum you should let Windows Update install the fixes marked as "Critical Updates." The other available updates ("Recommended Updates," "Drivers and Enhancements") are optional.
Check the boxes for the updates that you wish to install ("Critical Updates" are checked by default). Then click the appropriate button to start the download and installation process. You'll be shown a summary of the updates that you've selected, and then you'll presented with a "License Agreement." After you click through the "License Agreement," the download and intallation process will start.

Since the entire download and installation process is automated, there's almost nothing for you to do except reboot the computer after all the updates have been installed.

6. Read Licenses & Privacy Policies

Anti-spyware applications alone can't protect you entirely from unwanted spyware and adware. You have to do your part as well by being vigilant in your online behavior.

One of the more common sources for spyware and adware is "freeware" (e.g., Grokster or KaZaA) that bundles unwanted third-party applications. Another common source involves third-party web sites that automatically start the installation of spyware and adware when you visit those sites. These auto-installed spyware and adware programs may initially appear to be plug-ins necessary for the web site itself, though usually they are not.

Wherever you happen to encounter spyware and adware, you will usually be presented with a EULA (End User License Agreement) and/or Privacy Policy. Do not blindly click through these documents. Read them carefully and look for the tell-tale language that discloses the presence of adware or spyware. For tips on what to look for, see these pages:
DSLReports.com - EULAs & Privacy Policies
The Problem with Privacy Policies
Ben Edelman - Grokster and Claria Take Licenses to New Lows
Ben Edelman - Gator's EULA Gone Bad
EULAlyzer (free EULA parsing/analysis tool)

Most if not all of the "adware-supported" or "advertising-supported" applications on the Net have adware-free equivalents. There's simply no need to use advertising-supported applications. If you're looking for truly free software without any unwanted surprises, see the following sites:

CleanSoftware.org OldVersion.com
FreeWindows.dk The OpenCD
GNUWin II The OSSWin Project
Moochers Pricelessware

location http://www.spywarewarrior.com/rogue_anti-spyware.htm#sites

kenn3th SG

Doing a system restore will nt work as tried and proven by kenn3th, who accidentally downloaded spyware quake, so if worst come to worst, do a reformat of ur computer

orionlight SG

woah trying to snatch the rice bowl of our resident malware remover har? Laughing

kenn3th SG

no la.. she say make a guide and she go edit later. Wink and i am contributing to sgforums Very Happy

orionlight SG

Nevertheless a good read thumbs up for your effort Surprised

ndmmxiaomayi SG

For those using Firefox, here's an addon to get: Show IP.

Once installed, it will show the IP address of a site you are visiting at the bottom right. (Firefox needs to be restarted)

Click on the red IP address and select dnsstuff whois.

After doing a WHOIS, scroll down to Namseserver or netname part.

Make sure it doesn't point to any of these companies:

ATRIVO.COM
netcathost.com
inhoster
EstHost
Tartu Peapostkontor
Estonia
InterCage

This whole range belongs to Inhoster: 85.255.112.0 - 85.255.127.255
Intercage range of IP address: 69.50.184.0 - 69.50.184.255
Netcathost.com range of IP address: 195.225.176.0 - 195.225.179.255

If the IP address WHOIS ever points to these companies, don't download anything from there. Get off that webpage.

Edit: It's not always true that these fake antivirus/antispywares come from these companies. There are a lot that don't come from these companies and one of them is Winantivirus.

ndmmxiaomayi SG

Nah... there's a way to remove it. Cool

System restore doesn't help, you are right.

For those curious on what is used to remove such rogue programs, there are a few removal tools available, depending on the infection you get.

Just give me the HijackThis log and I will get you the solution. Beware though, if you use those programs without having any infections on your PC, you may be in for some nasty surprise.

ndmmxiaomayi SG

For what sia?

Spyware Warrior already got a guide. Very ma fan to do again.

Hmm... thinking of sticking it up. But seems like lots of stickies in this forum. Laughing

YI SG

oh boy.. they seems to be the “in” things this season. haiz..

ndmmxiaomayi SG

Yeah... seen lots of such problems lately.

kenn3th SG

wah, that time u say someone go create a List of rouge spyware.. anyway, thanks.

kenn3th SG

tyty.

ndmmxiaomayi SG

But someone went and do it liao...