3 replies to this topic

[josee]

This File comes with LinkSafeness Fake ntivirus (Rogue)

[josee]

Ups , i think i make a mistake when uploading file on my first post

Attached Files

•  t5bgc2co.zip   357.36K   13 downloads

[alexeck]

FakeSmoke: starts with the WiniGuard back around Oct 2008 and whose family of all rogues so far as seen below

The installation is in 3 parts.
The primary installer (Setup.exe) which is a progress bar which drops two secondary installers.

The first to be ran is what creates over 700 Fake files in both %WINDWS% and %SYSTEM% and the second is the rogues install wizard.

The file that opens the Windows Security Center is also found in the %LOCAL_SETTINGS%\Temp with the two secondary installers.

BlockKeeper
BlockProtector
BlockScanner
BlockWatcher
LinkSafeness
OmegaAntivir
SafeFighter
SafetyKeeper
SaveArmor
SaveDefender
SecureKeeper
SecureVeteran
SecureWarrior
SecurityFighter
SecuritySoldier
ShieldSafeness
SiteVillain
SoftBarrier
SoftCop
SoftSafeness
SoftStrongHold
SoftVeteran
SystemFighter
SystemVeteran
SystemWarrior
TREAntivirus
TrustCop
TrustFighter
TrustSoldier
TrustWarrior
WinBlueSoft
winiblusoft
WiniFighter
WiniGuard
WiniShield

[Fatdcuk]

Hi josee,

The file was already known to the MBAM database as Rogue.Multiple as we have a good string lock on it currently.
.