KernelMode.info

PostPosted:**Fri Jun 03, 2011 8:04 am**

Vaccine

Korean Rogue

VaccineScan

http://www.imgdumper.nl/uploads4/4de895 ... accine.png
http://www.virustotal.com/file-scan/rep ... 1307000642

VaccineU

http://www.imgdumper.nl/uploads4/4de895 ... ccineu.png
http://www.virustotal.com/file-scan/rep ... 1307034650

PostPosted:**Fri Jun 03, 2011 1:36 pm**

Windows Rescue Center

Yeah, sounds like I need to go rescue my Windows or something.

Fake scanner pages: (time sensitive!)
hxxp://przedluzanie.home.pl/indexz22z.php (main redirect)
hxxp://defender-jcdaz.in/c07bc4cb73a6bc24/sx3/2/ (09573a2f2c34d727bfb9154e68e97562)
hxxp://defender-jcdaz.in/936778ea093f2a51/sa1/13 (d7cbe6b3c7fdd9e420aa7456c92e2b86)

PostPosted:**Sat Jun 04, 2011 4:10 pm**

Windows Salvage System

5/43 >> 11.6%
http://www.virustotal.com/file-scan/rep ... 1307201388

PostPosted:**Sat Jun 04, 2011 10:11 pm**

Braviax
Image of the gui changed, that all

3/43 >> 7.0%
http://www.virustotal.com/file-scan/rep ... 1307221293

PostPosted:**Sun Jun 05, 2011 9:44 am**

PrivacyAlpha

9/42 >> 21.4%
http://www.virustotal.com/file-scan/rep ... 1307266487

PostPosted:**Sun Jun 05, 2011 3:03 pm**

Windows Efficiency Analyzer

A better way to make your computer more efficient is to not download and install these crapware.

PostPosted:**Tue Jun 07, 2011 2:28 am**

Windows Protection Alarm

BEEP BEEP BEEP BEEP BEEP BEEP

PostPosted:**Tue Jun 07, 2011 3:51 pm**

XP Security 2012

(FakeRean/Braviax)

Not satisfied with 2011, they decided to bump the year number to 2012. However, they STILL haven't fix the darn "Unregistred Version" typo yet!!

Fake scanner page: hxxp://print.graphytop.be/SpryAssets/wp-page.php?k=Olympic-Stadium-Design

Purchase website: (I like the part where it says "Buy XP Security 2012 at 2010 price!" and that the testimonials from Twitter are longer than 140 characters and ripped from AVG website)

PostPosted:**Tue Jun 07, 2011 4:41 pm**

@ngyikp

Not Found

The requested URL /SpryAssets/wp-page.php?k=Olympic-Stadium-Design was not found on this server.

Is it suppose to be or stuff was removed? Any alive links?

Thanks.

PostPosted:**Wed Jun 08, 2011 2:28 am**

EP_X0FF wrote:@ngyikp

Not Found

The requested URL /SpryAssets/wp-page.php?k=Olympic-Stadium-Design was not found on this server.
Is it suppose to be or stuff was removed? Any alive links?

Thanks.

Fake 404, the error page looks like Apache default, but the server is running IIS :p (comparision: hxxp://print.graphytop.be/404)
Spoof the referer from Google.com and it works.

KernelMode.info

Rogue Antimalware (FakeAV, 2011 year)

Vaccine

Windows Rescue Center

Windows Salvage System

Braviax

PrivacyAlpha

Windows Efficiency Analyzer

Windows Protection Alarm

XP Security 2012 (FakeRean)

Re: Rogue antimalware (FakeAV, FakeAlert)

Re: Rogue antimalware (FakeAV, FakeAlert)