Rogue security software
 | This article needs additional citations for verification. (January 2009) |
Rogue security software is software that uses malware (malicious software) or malicious tools to advertise or install itself or to force computer users to pay for removal of nonexistent malware. Rogue software will often install a trojan horse to download a trial version, or it will execute other unwanted actions. The first and most comprehensive study of rogue and real antispyware programs was carried out by Eric L. Howes.[1]
Installation
The main goal of rogue software makers is to install and sell their product. In order to attempt to install their program, fake Windows dialog boxes and other browser pop-ups are often displayed attempting to entice the user to click on them. Most of the time, they will display a message such as "WARNING! Your computer is infected with Spyware/Adware/Viruses! Buy [software name] to remove it!", a variant of which will say "Click OK to scan your system" instead of asking the user to outright buy the software. Another variant on this method involves telling the user their "Computer/Internet Connection/OS is not optimized and to Click Here to scan now". Usually, when the dialog box's OK button is clicked, this will direct the user to a malicious website, which will install the program. Sometimes, even clicking the upper right hand X button to close the dialog box will produce the same effect. (Pressing Alt+F4 or using Task Manager with Ctrl-Alt-Delete can circumvent that trick). Some software, like SpyAxe, will automatically download the trial version without any user action, in a process know as a (drive-by installation). Along with the installation of the rogue programs, many sites now attempt to install multiple trojans at one time by downloading what is called a dropper first, which then loads a variety of malware to the computer.
Tactics
Once installed, the programs rely on several tactics to attempt to entice the user into purchasing a "full" version. These include false positives, downloaded malware, false security alerts and locking various aspects of the system to prevent user changes.
False positives
A common method used by rogue security software makers use is that of intentional false positives. A false positive is a fake or false malware detection in a computer scan. This attempts to convince even advanced users (who may not be deceived by previous methods) that their computer is infected. There are two variants of this method. Some rogue software creates a list of non-existent files and infections. Others select files from the computer at random, including valid clean system files. In a few rare instances, the "full" version of the rogue program actually attempts to remove these files, damaging the system.
These intentional false positives should be differentiated from an accidental false positive, which can occur in a scan by real legitimate security software.
Invited real discoveries
A variant on the false positive method is that some programs first download real malware to a computer and then "detect" them. This method is more rare as many of these malicious programs are detected by other legitimate anti-malware programs, limiting the effectiveness of the sell.
False security alerts
Many rogue applications now couple false positives with realistic or dramatic looking system security alerts. They may change the desktop background to a dramatic warning, continuously or sporadically redirect web browsers to a page that informs the user that they are infected and need to purchase a program. They may also change the homepage to a security warning, or bombard the user with continuous security alerts from the task bar, often using the yellow triangle with an exclamation point used by Windows to denote a system error. Some even go to the point of changing the screensaver to the BSOD, to make the user think that windows has crashed due to malware.
Locking various aspects of the system
To prevent removal by the user and entice the user to buy the program, rogue software will often lock various aspects of the system, including the control panel, the Add/Remove Programs feature, the ability to change the desktop, the ability to change the home page, and the ability to go to certain malware removal sites. These are all intended to prevent the user from removing the program and instead try to force them to buy the "full" version.
Detection and removal
Almost all reputable anti-spyware software will detect rogue software if it is installed on the scanned computer. Often, non-reputable rogue anti-spyware software will install a trojan horse to download the software from the maker's website, like Titan Shield.[2] Reputable anti-virus and anti-spyware software can detect the trojan even before the software is installed. Programs such as Ad-Aware SE, AVG Anti-Virus, Avast!, etc, can usually detect these with their real-time protection modules. HIPS software such as the Defense+ module of Comodo Internet Security are also capable of detecting and stopping the methods rogue software use to install onto a computer. However, often removal of new, aggressive rogue programs requires the use of programs such as HijackThis combined with manual removal processes because it can take quite a while before the manufacturers of the above mentioned legitimate programs learn how to automate the process and update their programs. In addition, rogue software sometimes have hidden parts that rebuild the rogue if they are partially removed. Other options for removal include use of a bootable "rescue disk" or reformatting the hard disk and reinstalling the operating system (the only way to ensure that the computer is 100% clean). If the rogue doesn't limit the user, then it is possible to manually remove the software.
Lawsuits
Recently, lawmakers as well as private and public citizens have attempted to shut down vendors of these companies. XPdefender, WinSpywareProtect, WinDefender, WinFixer, MalwareCore, and Antivirus 2009 have been named in lawsuits. Notably due to the vendors of those programs creating extremely similar names, slogans & user-interfaces, all in an effort to confuse users about names of legitimate security programs, EXAMPLE: Norton Internet Security confused with Antivirus 2009.
Partial list of rogue software
There are a large number of fake anti-spyware programs active on the Internet. Typically, widely-distributed Web banner ads falsely warn users that their computers have been infected with malware, enticing them to download the rogue software. Once installed, the software uses human engineering and false positives to manipulate the user into purchasing the software. These programs do not actually remove spyware — or worse, may add more.
The following is a partial list of known rogue software. Often the same software is distributed under several names. Many currently do not have Wikipedia articles.
See also
References
- ^ Spyware Warrior: Rogue/Suspect Anti-Spyware Products & Web Sites
- ^ TitanShield - Symantec.com
- ^ Precise Security - Advanced Cleaner
- ^ Rogue List - AlfaCleaner
- ^ BleepingComputer - AntiSpyCheck 2.1
- ^ BleepingComputer - AntispyStorm
- ^ About.com AntiSPywareExpert
- ^ 2-Spyware - AntiSpywareMaster
- ^ Precise Security - AntiSpywareSuite
- ^ BleepingComputer - AntiSpyware Shield
- ^ BleepingComputer - Antivermins
- ^ BleepingComputer - Antivirgear
- ^ BleepingComputer - Antivirus 2008
- ^ 2-Spyware - Antivirus 2009
- ^ Article noting that Antivirus 2010 and Anti-virus-1 are the same
- ^ http://www.bleepingcomputer.com/malware-removal/remove-antivirus-2010 Details on Antivirus 2010 showing it is rogue, its symptoms and removal
- ^ http://www.bleepingcomputer.com/malware-removal/remove-antivirus-360
- ^ BleepingComputer - AntivirusPro2009
- ^ Symantec
- ^ BleepingComputer - Antivirus Master
- ^ Symantec
- ^ [1]
- ^ SpywareRemove - Awola
- ^ Symantec
- ^ 411-spyware
- ^ a b softratty.com
- ^ a b Symantec
- ^ Symantec
- ^ Symantec
- ^ Symantec
- ^ Symantec
- ^ Symantec
- ^ Symantec
- ^ [2]