Just how fast do those rogue security products mutate

Steven — Fri, 11 Dec 2009 19:53:35 +0000

Tom Kelcher over at the Sunbelt Software blog has a great post up that shows how quickly some of these malware delivering rogue security programs clone themselves into new products.

Leading the charge is the third generation of WiniGuard that apparently is seeing new clones of it launching every 48 hours.

A new rogue security product called IGuardPC, that we added to detections today, is the 50th clone of the WiniGuard family of rogue security products. That makes WiniGuard the largest rogue family ever detected by Sunbelt researchers.
The WiniGuard family began in September of 2008. Operators behind it have added variants that our researcher Patrick has sorted into three generations. The latest generation gets a new clone about every 48 hours to stay ahead of public awareness and anti-malware detections. Most of them are being caught by existing VIPRE detections.

He even provides some screenshots of the various generations of the the program(s) starting with the originating WiniGuard which installs five files

The last of the images is of the newest clone which brings the total to 50 is of IGuardPC

The complete breakdown of the different generation are courtesy of Sunbelt Software

First Generation
10/13/2008 WiniGuard
1/29/2009 WiniBlueSoft
2/20/2009 WinBlueSoft
5/17/2009 WiniFighter
8/12/2009 WiniShield
Second Generation
8/17/2009 SaveKeep
8/24/2009 Savesoldier
8/26/2009 TrustNinja
8/27/2009 SaveDefense
8/28/2009 SafetyCenter
8/29/2009 BlockDefense
9/3/2009 SystemCop
9/11/2009 SafetyKeeper
9/17/2009 SoftSafeness
9/18/2009 TrustWarrior
9/19/2009 SaveDefender
9/22/2009 SaveArmor
9/25/2009 SecurityFighter
9/26/2009 SecuritySoldier
9/28/2009 SecureVeteran
10/2/2009 SecureWarrior
10/5/2009 TrustCop
10/8/2009 SafeFighter
10/9/2009 TrustSoldier
10/13/2009 TrustFighter
10/19/2009 SoftCop
10/21/2009 SoftVeteran
10/23/2009 SoftStrongHold
10/27/2009 ShieldSafeness
10/28/2009 SoftBarrier
10/30/2009 BlockWatcher
11/1/2009 BlockScanner
11/2/2009 BlockKeeper
11/4/2009 BlockProtector
11/7/2009 SystemVeteran
11/9/2009 SystemFighter
11/11/2009 SystemWarrior
Third Generation
10/17/2009 TREAntivirus
11/11/2009 AnitAid
11/17/2009 LinkSafeness
11/17/2009 SiteVillain
11/18/2009 SecureKeeper
11/24/2009 KeepCop
11/26/2009 ReAntivirus
11/27/2009 RESpyWare
11/30/2009 AntiAdd
12/3/2009 AntiKeep
12/7/2009 AntiTroy
12/9/2009 SiteAdware
12/11/2009 IGuardPC
Research by Patrick Jordan

Just how fast do those rogue security products mutate is a post from: winextra
Follow us on Twitter: @WinExtra | Don't forget we're on Facebook as well: WinExtra Fans

Don't forget to check out the WinExtra Community Forums - registration is free.

RogueWare Warning: PC Antispyware 2010

Steven — Sun, 02 Aug 2009 22:39:35 +0000

A new rogue security application called PC Antispyware 2010 is starting to show up. This is another application from the WinReanimator family and delivers the Braviax trojan as part of the install.

Program Splash screen

Program GUI

thanks to Sunbelt Software

RogueWare Warning: PC Antispyware 2010 is a post from: winextra
Follow us on Twitter: @WinExtra | Don't forget we're on Facebook as well: WinExtra Fans

Don't forget to check out the WinExtra Community Forums - registration is free.

Winextra » roguewear

Just how fast do those rogue security products mutate

RogueWare Warning: PC Antispyware 2010