What is a rogue?

Rogue security software is a form of computer malware that deceives or misleads users into paying for the fake or simulated removal of malware. Rogue security software, in recent years, has become a growing and serious security threat in desktop computing.

Propagation

Rogue security software mainly relies on social engineering in order to defeat the security built into modern operating system and browser software and install itself onto victims' computers.

Most have a Trojan horse component, which users are misled into installing. The Trojan may be disguised as:

• A browser plug-in or extension (typically toolbar)
• An image, screensaver or archive file attached to an e-mail message
• Multimedia codec required to play a certain video clip
• Software shared on peer-to-peer networks
• A free online malware scanning service

Some rogue security software, however, propagate onto users computers as drive-by downloads which exploit security vulnerabilities in web browsers or e-mail clients to install themselves without any manual interaction.

Operation

Once installed, the rogue security software may then attempt to entice the user into purchasing a service or additional software by:

• Alerting the user with the fake or simulated detection of malware or pornography.
• Displaying an animation simulating a system crash and reboot.
• Selectively disabling parts of the system to prevent the user from uninstalling them. Some may also prevent anti-malware programs from running, disable automatic system software updates and block access to websites of anti-malware vendors.
• Installing actual malware onto the computer, then alerting the user after "detecting" them. This method is less common as the malware is likely to be detected by legitimate anti-malware programs.

Some rogue security software overlaps in function with scareware by also:

• Presenting offers to fix urgent performance problems or perform essential housekeeping on the computer.
• Scaring the user by presenting authentic-looking pop-up warnings and security alerts, which may mimic actual system notices. These are intended to leverage the trust of the user in vendors of legitimate security software.

Sanction by the FTC and the increasing effectiveness of anti-malware tools since 2006 have made it difficult for spyware and adware distribution networks already complex to begin with to operate profitably. Malware vendors have turned instead to the simpler, more profitable business model of rogue security software, which is targeted directly at users of desktop computers.

Rogue security software is often distributed through highly-lucrative affiliate networks, in which affiliates supplied with Trojan kits for the software are paid a fee for every successful installation, and a commission from any resulting purchases. The affiliates then become responsible for setting up infection vectors and distribution infrastructure for the software. An investigation by security researchers into the Antivirus XP 2008 rogue security software found just such an affiliate network, in which members were grossing commissions upwards of $USD150,000 from tens of thousands of successful installations per month.

Preventing Infection

Rogues are some of the easiest of malwares to prevent as they are fairly obvious. Knowing the definition of one is usually enough to prevent them. If you happen to find a website "scanning" you computer and reporting multiple infections, you have most likely run into a rogue's website. The installer that these websites demand you to download is the rogue. Sometimes the website will prevent you from closing the browser window. If you find yourself in one of these situations:

1. Right click on your taskbar and select "task manager".
2. Click the processes tab and find the process relating to the browser you encountered the rogue in. The process is usually the same name as the browser, i.e. iexplore.exe, firefox.exe, chrome.exe, opera.exe.
3. Click on the process and then click the end process button. If you did this right, the browser window should close.

Another extremely important means of preventing rogues and all other malware is using an antivirus. Although antiviruses do not detect all malware and you still have to be careful, antiviruses will help prevent most infections including rogues. If you don't have an antivirus, download and install one of these excellent free ones.

• Avira
  
• Avast
  
• Microsoft Security Essentials
  

You can only run one antivirus on your computer at a time because two can and will cause problems. In this case more is not better!

One other highly recommened program is sandboxie. This free program is probably the easiest and most effective malware and rogue prevention out there.

• Sandboxie

To understand what Sandboxie does and how to use it, read this tutorial.

• http://www.sandboxie.com/index.php?GettingStarted

If a rogue shows up on your computer when you didn't download it, you most likely have other malware and need to remove it. I recommend following the steps in the removal section and then posting in the Infection Help section of the forum to make sure you are clean.

Removing Infection

The best way of removing rogues is using these two great free scanners. They will not only remove rogues but many other types of malware. They may not remove all rogues or malware but they are a great start before getting help in the forums.

 

If Malwarebytes and SUPERantispyware fail to run, you have very deeply rooted malware and I highly recommend you visit the Infection Help section of the forum.

If you have any questions the forums are a great place to ask.

Removing a Rogue

Visit the forums for helpful information on removing rogue software.