Security Cadets » Rogue Programs

Sunday NewsBot: Weekly Round Up (22/11/2009)

AndyAtHull — Sun, 22 Nov 2009 18:18:06 +0000

Welcome to another blog post of Sunday NewsBot. All articles in the NewsBot Centre are imported from blog and site feeds from the world of security and technology and gathered in our centre. This weeks top articles are:

There are more articles located within the NewsBot Centre. Plus there is also an chance to have your blog feed included. Details about it can be found here.

Sunday NewsBot: Weekly Round Up (15/11/2009)

AndyAtHull — Sun, 15 Nov 2009 18:13:36 +0000

There are more articles located within the NewsBot Centre. Plus there is also an chance to have your blog feed included. Details about it can be found here.

Sunday NewsBot: Weekly Round Up (18/10/2009)

AndyAtHull — Sun, 18 Oct 2009 17:00:41 +0000

Welcome to this weeks round-up. Before we go firther, SCars Beta testing is going well. Places are always available for this. Please re-visit the blog post to express your interest.

All articles in the NewsBot Centre are imported from blog and site feeds from the world of security and technology. This weeks articles are:

There are more articles located within the NewsBot Centre. There is an oppertunity to put your blog feed forward and have a chance to be added to our NewsBot service. Details about it can be found here.

Sunday NewsBot: Weekly Round Up (27/09/2009)

AndyAtHull — Sun, 27 Sep 2009 17:51:58 +0000

Welcome to this weeks round-up. All articles in the NewsBot Centre are imported from blog and site feeds from the world of security and technology. This weeks articles are:

Sunday NewsBot: Weekly Round Up (20/09/2009)

AndyAtHull — Sun, 20 Sep 2009 17:26:16 +0000

Welcome to this weeks round-up. All articles in the NewsBot Centre are imported from blog and site feeds from the world of security and technology. This weeks articles are:

Sunday NewsBot: Weekly Round Up (13/09/2009)

AndyAtHull — Sun, 13 Sep 2009 17:40:01 +0000

Welcome to this weeks round-up. All articles in the NewsBot Centre are imported from blog and site feeds from the world of security and technology. This weeks top articles are:

Sunday NewsBot: Weekly Round Up (06/09/2009)

AndyAtHull — Sun, 06 Sep 2009 17:55:43 +0000

Welcome to this weeks round-up. All articles in the NewsBot Centre are imported from blog and site feeds from the world of security and technology. This weeks top articles are:

Sunday NewsBot: Weekly Round Up (30/08/2009)

AndyAtHull — Sun, 30 Aug 2009 18:00:32 +0000

Welcome to this weeks round-up. This week I have put a timer on this article being published due to work commitments I have. I did think about changing it to a Monday NewsBot, but decided against it.

Also, on a side point away from our weekly round-up, our application (formally codename ProjectX) SCars, is in full swing and several components are finished. There is no predicted release date, but we will hopefully provide a run down of what we’re actually programming soon. We are after a few graphic designers to help us with graphics on the application. Please contact me, AndyAtHull, via my forum account for details. Let us crack on.

All articles in the NewsBot Centre are imported from blog and site feeds from the world of security and technology. This weeks top articles are:

Sunday NewsBot: Weekly Round Up (26/07/2009)

AndyAtHull — Sun, 26 Jul 2009 17:57:52 +0000

Welcome to this weeks round-up. All articles in the NewsBot Centre are imported from blog and site feeds from the world of security and technology. This weeks top articles are:

There are more articles located within the NewsBot Centre. You can also add your feed to our NewsBot should you wish, details about it can be found here.

Sunday NewsBot: Weekly Round Up (07/06/2009)

AndyAtHull — Sun, 07 Jun 2009 17:00:23 +0000

Welcome to this weeks round-up. All articles in the NewsBot Centre are imported from blog and site feeds from the world of security and technology. This weeks top articles are:

There are more articles located within the NewsBot Centre. You can also add your feed to our NewsBot should you wish, details about it can be found here.

Sunday NewsBot: Weekly Round Up (26/04/2009)

AndyAtHull — Sun, 26 Apr 2009 18:48:57 +0000

Welcome to this weeks Sunday NewsBot. All articles in the NewsBot Centre are imported from blog and site feeds from the world of security and technology. This weeks top articles are:

There are more articles located within the NewsBot Centre. You can also add your feed to our NewsBot should you wish, details about it can be found here.

ComboFixTool – What’s that all about?

AndyAtHull — Sun, 29 Mar 2009 14:51:46 +0000

First there was SmitFraudFixTool and then VundoFixTool came onto the scene. What do all these have in common?

… Well, they all imitate legit removal tools for malware. And probably created to gain financial advantages from the traffic the original tools get.

This time they have released another version called ComboFixTool which imitates the legit tool ComboFix.

Make no bone about it. SmitFraudFixTool, VundoFixTool and now ComboFixTool are the fake applications here. Not SmitFraudFix, VundoFix or ComboFix.

What is funny at the time of me writing this is that the offending domain has not been updated. Nor has it’s download. Example below:

(Click to Enlarge)

Another twist on this story are the comments we’ve been getting from the last product this gang released. A victim has claimed to even get a refund on the amount of money they had spent before realising it’s practices from our articles. They’re also receiving help in our support forums.

A discussion has started about ComboFixTool over at BleepingComputer.com. And it’s safe to say that exploiting ComboFix is a dangerous prospect. You should never use the legit tool without supervision due to the nature of it. So when this fake application comes along, the impression it has could well affect this area of ComboFix and possibly push users into confusion.

We have procedures to help you with this kind of problem. Our forums have experts in place to assist you and will provide step-by-step help freely in removing it:

Malware Removal Assistance with an Expert

Update (29/03/2009 – 17:41 PM – BST) – Offending URL’s are combofixtool.org and combofixtool.com. Both sites still not updated with graphics and download.

Update (31/03/2009 – 20:40 PM – BST ) – Both offending URL’s are now down – Result

Selective Linkbacks;

Dell Forums – ComboFixTool – What’s that all about?
Forum Linkback- ComboFixTool – What’s that all about?

Sunday NewsBot: Weekly Round Up (22/03/2009)

AndyAtHull — Sun, 22 Mar 2009 20:01:13 +0000

This weeks Sunday NewsBot marks it’s first anniversary. We started this venture all the way back in March 2008 and the first article was a Microsoft Security Advisory (950627) article. Let’s hope this is the start of many more.

All articles in the NewsBot Centre are imported from blog and site feed from the world of security and technology:

We hope you have a great remaining Sunday wherever you are. There are more articles from the last eight days or so. Just visit the NewsBot Centre for more.

You can add your feed to our NewsBot should you wish, details about it can be found here.

VundoFix also gets imitated: VundoFixTool

AndyAtHull — Sun, 08 Mar 2009 17:26:24 +0000

A few weeks ago I was sat here telling you about a legit tool being targeted. SmitFraudFix was the target and the rogue created was SmitFraudFixTool.

This week another legit tool got targeted.

VundoFixTool

Popular removal tool for the infection Vundo, VundoFix, has been around for a long time. And for the time it’s been here, it’s done a lot of good.

You could say now it’s been a target itself, it’s a compliment. However this won’t help the fact it will fool general members of the internet. That is offcourse one of the reasons it was targeted.

Like SmitFraudFixTool, VundoFix Tool is the fake here. Which also happens to be a copy of MalwareRemovalBot.

We have procedures to help you with this kind of problem. Our forums have experts in place to assist you and will provide step-by-step help freely in removing VundoFixTool:

Malware Removal Assistance with an Expert

Misc. Links:

Forum Mirror – VundoFix also gets imitated: VundoFixTool

SmitFraudFix gets imitated into a rogue dubbed SmitFraudFixTool

AndyAtHull — Sun, 15 Feb 2009 10:01:28 +0000

Have you ever made a removal tool which has become the most popular tool in removing rogue anti-spware programs and variants from rogues on the internet? Then only to have it rogue’d? No, you say? Well …

… Popular removal tool SmitFraudFix (which we mirror) has this week been rogue’d. Enter … SmitFraudFixTool

The above is the GUI of the fake anti-spyware program in question. Which is carbon copy of MalwareRemovalBot (also a rogue).

The author of SmitFraudFix brought this one to my attention on his personal blog. I followed up enquiries with the author about this rogue. And when asked what he thought of his tool being targeted he had the following to say:

“It’s not the first time that rogues are using real tools names to deceive final users. Spyware Warrior list has got a lot of some. But it’s the first time for SmitfraudFix. What a nice GUI!”

“I was really deceived. But when a legit tool is copied, this also means that it is well known. Should I be happy and/or proud of being targeted? I’m not. First feelings are passed. It’s funny, and I’m waiting for the next rogue.” - S!Ri.URZ

My main concerns when rogues like this come out and target legit tools is that it’s there to deceive computer users. Off course it is. Which is why we are posting about this. But you have to remember that SmitFraudFix and SmitFraudFixTool are not from the same author and the latter one is the fake.

We have procedures to help you with this kind of problem. Our forums have experts in place to assist you and will provide step-by-step help freely:

Malware Removal Assistance with an Expert

Or follow the self-help removal guide:

How To Remove SmitFraudFixTool (removal instructions)

Misc. Links:

Forum Mirror – SmitFraudFix gets imitated into a rogue dubbed SmitFraudFixTool
Digg it also at Digg.com

Update:- We’ve changed the title of this article as the previous title may suggest to some that we implied SmitFraudFix became a rogue itself. This is not the case. The URL has also changed.