Coments are closed
Free anti-spyware is software that is designed to combat the installation of spyware on your device. Spyware is usually bundled into third party applications (often freeware) and so the user actually gives the spyware permission to be installed onto their device without knowledge of doing so when installing the legitimate program. Beware Of Fake Anti-Spyware Programs. The scam usually starts with your search for 'best spyware removal program' or something similar. Search results, or paid ads on search results pages, may lead the unwary to a site which promises a free scan to detect spyware on your computer.
Rogue security software is a form of computer malware that deceives or misleads users into paying for the fake or simulated removal of malware. Rogue security software, in recent years, has become a growing and serious security threat in desktop computing.[1]
Rogue security software mainly relies on social engineering in order to defeat the security built into modern operating system and browser software and install itself onto victims' computers.[1]
Most have a Trojan horse component, which users are misled into installing. The Trojan may be disguised as:
Some rogue security software, however, propagate onto users computers as drive-by downloads which exploit security vulnerabilities in web browsers, pdf viewers, or e-mail clients to install themselves without any manual interaction.[2][4]
More recently, malware distributors have been utilizing SEO poisoning techniques by pushing infected URLs to the top of search engine results about recent news events. People looking for articles on such events on a search engine may encounter results that, upon being clicked, are instead redirected through a series of sites[5] before arriving at a landing page that says that their machine is infected and pushes a download to a 'trial' of the rogue program.[6][7]
Once installed, the rogue security software may then attempt to entice the user into purchasing a service or additional software by:
Developers of rogue security software may also entice people into purchasing their product by claiming to give a portion of their sales to a charitable cause. The rogue Green antivirus, for example, claims to donate $2 to an environmental care program for each sale made. [9]
Some rogue security software overlaps in function with scareware by also:
Sanction by the FTC and the increasing effectiveness of anti-malware tools since 2006 have made it difficult for spyware and adware distribution networks—already complex to begin with[11]—to operate profitably.[12] Malware vendors have turned instead to the simpler, more profitable business model of rogue security software, which is targeted directly at users of desktop computers.[13]
Rogue security software is often distributed through highly-lucrative affiliate networks, in which affiliates supplied with Trojan kits for the software are paid a fee for every successful installation, and a commission from any resulting purchases. The affiliates then become responsible for setting up infection vectors and distribution infrastructure for the software.[14] An investigation by security researchers into the Antivirus XP 2008 rogue security software found just such an affiliate network, in which members were grossing commissions upwards of $USD150,000 from tens of thousands of successful installations per month.[15]
In December 2006, the Washington Attorney General announced that it had reached settlement in a suit against Secure Computer LLC, the White Plains-based vendor of the Spyware Cleaner rogue security software, under the Computer Spyware Act passed by the Washington State Legislature in 2005. Secure Computer, under consent decree, agreed to pay more than $USD75,000 in restitution to consumers.[16]
In December 2008, the US District Court for Maryland—at the request of the FTC—issued a restraining order against Innovative Marketing Inc, a Kiev-based firm producing and marketing the rogue security software products WinFixer, WinAntivirus, DriveCleaner, ErrorSafe, and XP Antivirus.[17] The company and its US-based web host, ByteHosting Internet Hosting Services LLC, had their assets frozen, were barred from using domain names associated with those products and any further advertisement or false representation.[18]
Law enforcement has also exerted pressure on banks to shut down merchant gateways involved in processing rogue security software purchases. In some cases, the high volume of credit cardchargebacks generated by such purchases has also prompted processors to take action against rogue security software vendors.[19]
The following is a partial list of rogue security software, most of which can be grouped into families. These are functionally-identical versions of the same program repackaged as successive new products by the same vendor.[15][20]
|
|
|
Most computer users will have their own experience or know someone who has experienced rogue software being installed onto their system. Although it comes in many forms, rogueware is often referred to as fake antivirus software which is a kind of program that tricks its way onto your computer and pretends to be a real antivirus application. It then runs what is essentially a simulation that tells you your machine is infected with viruses, trojans, worms and other scary programs, and you need to buy their software to remove the problems. This is of course a lie and the issues are fabricated by the fake program to scare you into buying it. There are also similar fakes around that tell you the hard drive is dying and you need to pay a fee to “recover” your files.
Quite often a fake antivirus interferes with current security software and disables Windows functions to try and stop you from disabling its process. It will usually prevent you from running any EXE files such as web browsers, security scanners, Task Manager, Regedit, Command Prompt and just about any other executable. Basically it locks down your PC just enough to make it virtually unusable while also protecting itself from deletion.
The thing about fake antivirus software is it’s mostly non destructive meaning your files aren’t at risk like they would be with a virus or worm which destroys data. Instead they essentially cripple the computer and nag you into paying (which does nothing apart from allow you to stop the fake program) or until you find a way to kill the program and clean up the system. Of course, there are other types of rogue and malicious software around, ransomware being similar but even more aggressive locking you out of Windows completely until you pay a fee.
Thankfully, removing fake antivirus, internet security, antispyware and hard disk recovery programs is quite easy with a little experience, and there are several tools around that can help. Some will be able to kill the process allowing all your software to run normally, using your favorite malware scanner to clean up the leftovers. Other programs can kill and clean at the same time. Here’s some tools for you to try out.1. RogueKiller
Redneck rampage collection isotopes. RogueKiller by Tigzy is a highly effective tool at killing most types of rogue software dead in its tracks. This includes just about all fake antivirus or fake hdd rogues, fake police and other types of ransomware, TDSS trojans and several zeroaccess infections. As well as being able to scan and kill malicious running processes, drivers and services using its blacklist, RogueKiller can also perform several repairs to the system some of these programs can leave behind.
After the program has started, it will immediately run a quick scan of running processes and services, and then kill anything found to be malicious. If you wanted to, you could close it after the fake av process has been killed and run a malware scanner such as Malwarebytes to take care of the cleaning process. The program itself does have several options to fix problems such as removing suspicious entries from the Run and RunOnce registry keys, suspicious tasks and also anything malicious in the startup folder. Any shortcuts hidden by fake hdd programs can also be restored.
Simply press Scan and the registry will be checked and you can then selectively remove any entries which don’t appear to be connected with the rogueware before clicking Delete. If during the scan anything in the Hosts file or the Proxy and DNS settings is found to be non standard, you have the option to view what it is and reset any of these back to the default using the three buttons on the right. The MBR option supports up to five physical devices and if an infection is detected in the boot record of a drive, the program has the ability to repair it, reverting back to a standard boot loader.
The RogueKiller.exe has a neat trick because it will sometimes start even though the fake antivirus has blocked executable files from running, for example it bypassed Smart Security but couldn’t do the same on System Care without renaming the exe to Winlogon.exe or Explorer.exe. The program sends anonymous statistics back to the developer and in the RogueKiller window it says that if you don’t agree to this, you shouldn’t use the program.
Download RogueKiller
2. RKill
The Rkill tool was originally designed to quickly kill the process of a fake antivirus or other piece of rogue software so that you could run another tool to clean it up. It’s now become more useful with a few more added abilities that can help you fix and restore some basic system settings that often get affected. These include executable file associations which stop executable files from running and system policies that can disable certain system functions like Task Manager or the Command Prompt.
Although these extra repair functions are very useful, RKill is still not meant to be a removal tool for the fake antivirus or rogueware but a means to stop it from running so you can run other programs to deal with it. The malicious executable file and any startup registry entries will still remain until they are removed by third party software such as Malwarebytes or Hitman Pro etc. You should also not reboot the computer between using RKill and running a malware scan because the rogueware will simply reactivate itself again on startup.
Usage for RKill is simply to download the program and launch it, all other operations for scanning and killing processes, checking the registry, services, digital signatures and the HOSTS file is fully automatic with no interaction required. You will find on the website there are several different links to download, they are in fact the same file but with different names to bypass the rogue process. We found that most newer fake antivirus rogues also block .com and .scr extensions as well as .exe, although renaming the file to winlogon.exe, explorer.exe, userinit.exe or wininit.exe seemed to work pretty much all the time. After RKill has completed, you should now be able to install or run any antivirus/antimalware programs to complete the cleaning process.
Download RKill
3. Using a Product Key to Kill the Fake Antivirus
Although we obviously don’t recommend you do this, but if you were to purchase fake antivirus software, what you should be sent is activation details to register the program. This will consist of something like a user name or email address and a product key which you then enter into the program. After that you will soon discover the software actually does nothing and will just enable you to stop or exit the program. This is useful though, because with the rogue process stopped the system can be scanned normally and the rogue program can easily be removed.
We came across a great website resource called S!Ri.URZ that will give some information and screenshots for most of the fake software out there. What it also lists where possible, is the product key to activate the fake program and any username or email that needs to be entered. Most rogue software will have a “Buy now”, “Activate software” or “Remove all threats” button easily visible so you can enter a serial. Input the details from the S!Ri.URZ website and if activation is successful, the program can now be closed completely allowing real security software to run. As you can see above, we registered System Doctor 2014 using the key provided and the rest was easy after it was closed.
On the next page we have 3 more solutions and some tips if you’re having problems.
12Next › View AllI have tried both both Malwarebytes & Superantispyware but it didn’t resolve the problem but the RogueKiller tool did it all. Thanks for the suggested tools and it is really helpful
ReplyThe number of times I’ve run into the fake antivirus malware on my and other peoples systems beggers belief… I just wish I could get my hands on the cockroaches that develop this infestation.
ReplyThank god something like this came out. I work as a tech at a major university in the technology building. The Rtard teachers constantly get these stupid things. It makes me laugh that the teachers in the COLLEGE OF TECHNOLOGY manage to get these. At least twice a week Ill have to get one of these fake anti viruses off.
ReplyI suggest you only use Malwarebytes as it is a fantastic free software that removes much more than the Fake Antivirus software and will not cause any side effects on any operating system,
ReplyWooh this is great software.Thank you Raymond
Replyit really works………
i tried too….
many many thanks to you……
Great tip, Raymond!
ReplyI usually prefer to use Super Anti Spyware. It covers both rogue antiviruses and other kinds of spyware. The free version offers cleanup and the pro version offers realtime protection as well as other features.
Interesting find, nontheless :)
i used Superantispyware it removes and i’ll try this Fake antivirus thanks Raymond …
ReplyHey Ray,
Thanks for this great post again as it really help my friend’s computer in removing the fake anti-virus.Kudos !!!
Replythanks for the info ray! :D
Replyuse malwarebytes guys… it really knows how to destroy fake antivirus
ReplyIt’s also an amazingly fast download too!
I clicked on the link to download, and first thought, “nothing happened”, then checked my download file.
Yep! there it was!
Thank You Raymond!
Steve
Replycool … just with file size 83k only!
ReplyNice one to give it a try.
Thanks Raymond for sharing this.
amon
thanks Ray…
Replynice tool. thanks.
Replythanks ray…….
Replyreally great information Ray
Replythank you ray ,thats going straight on my usb stick
ReplyVery useful ray.
ReplyGood one, Ray…
ReplyWow.nice to know.Thanks for sharing Ray.
Replythanks Raymond
ReplyThanks Ray for this important advice.
And also thanks for the guy from Malaysia – Olsen – who developed the software Remove Fake Antivirus.
good info ray. thanks
Replythanks good one