It's one of the most prevalent malware in the wild (often referred to as "scareware").
It's very simple but unfortunately works pretty well.
It looks like a security product (most likely an anti-virus or an anti-spyware) and happily detects hundreds threats / viruses / whatever nasty you can think about when it comes to your computer.
The trick appears when you finally click on "Clean" to get rid of all those viruses. You get redirected to a webpage asking for you credit card details...
Needless to say that those fake AVs exist only for this: stealing your money.
Don't be fooled. If you want a real AV product, go for the well known brands. There are even free AVs.
In the case you are somewhat tech-savvy, check whois databases.
Domain names used for serving malware are never up for a long time.A brand new domain name is always suspicious.
Here's an example of a rogue AV, stupidly called Soft-Cop.
The installer is a NSIS package that is surprisingly small for an AV product (61489 bytes).
Once installed, it happily runs a full scan and obviously finds hundreds of imaginary threats as shown below.
Geez! That's a lot for my freshly installed Windows :)
The guy(s) behind this is(are) so stupid that they even show off the infected file paths. Cool, let's have a look...
Mmmm, am I day-dreaming or what?
Those files do exist on my hard-drive (well, they didn't before the scan)
Ok, nothing to get excited about. That piece of crap just generates random file names, creates these files and fills them up with random bytes.
Not sure what's the purpose of that to be honest...anyway...
Another "hacker" trick is to make users think that running processes are from Microsoft (one can put whatever he wants in PE resources).
Oh man... Ok, why not, but in this case, could you at least give some plausible names to your files?!?!
Do you guys think that anyone could believe that SoftComp.exe is the Windows Calculator? O_o
What the hell are you smoking?
Last but not least, let's scare users a little bit!
Like other rogues, our lame brand new friend displays annoying alerts pushing you to happily give your money...
Rogue AVs are a real threat. Many end-users just can't make the difference between a real security software and a rogue. And unfortunately, some of them end up giving away their credit card details.
That's the sad part of the story.
Now, this is another point of view.
I've seen many rogues. They're all the same...
Shitty code, stupid so-called "tricks", two-cent social engineering...
Yeah, from the bottom of my heart, you guys, writing scarewares, you really suck.
But thank you so much!
Having a look at your shit in a disassembler is even better than reading
The Daily WTF. :D
But still, you suck...
