AntiSpyHunter is a rogue anti-spyware program that masquerades as a trustworthy software by using the name SpyHunter, the trademark name of Enigma’s legitimate anti-spyware program. AntiSpyHunter is not associated with SpyHunter and is violating the use of a trademarked name. It is recommended that users do not download or install AntiSpyHunter on their computers.

AntiSpyHunter may have been installed by a Trojan (Zlob, Vundo or Downloader) found on fake video codec downloads. Once the Trojan is installed, it may generate imaginary system notifications stating that the user’s computer is infected with spyware. In order to remove the imaginary infections, AntiSpyHunter will offer AntiSpyHunter’s full version of the program. AntiSpyHunter’s rogue messages may redirect the user to AntiSpyHunter’s rogue website to further download the full AntiSpyHunter program. AntiSpyHunter may also use its fake system scan to emulate a computer system scan and generate erroneous scan results.

MS Antivirus 2008 is a rogue anti-spyware program that comes from the same family as other rogue programs such as Windows Antivirus 2008, Antivirus 2008, System Antivirus 2008, Vista Antivirus 2008 and other clones. While MS Antivirus 2008 may look like it is a worth-while program for spyware removal, we have discovered that it is not. The user may wonder how MSAntivirus2008, MS Antivirus 2008, or MS Antivirus was installed onto his/her computer system without his/her actions. Usually this is done through a Trojan such as Zlob which is sometimes downloaded through a fake video codec, through spam emails or even through other malware or spyware. MS Antivirus 2008 is also known to display several popup alerts that tend to disrupt the user at times when using his/her computer.

Antivir64 or Antivir 64, is a rogue anti-spyware program and clone of Power Antivirus 2009 and Antispyware2008. Antivir64 may have been installed by a Trojan (Zlob, Vundo or Downloader) found on fake video codec downloads. Once the Trojan is installed, it may generate imaginary system notifications stating that the user’s computer is infected with spyware. In order to remove the imaginary infections, Antivir64 will offer Antivir64’s full version of the program. Antivir64’s rogue messages may redirect the user to Antivir64’s website (scanner.antivir64.com) to further download the full Antivir64 program. Antivir64 may also use its fake system scan to emulate a computer system scan and generate erroneous scan results.

CNN.com Daily Top 10 is a spam email created to download and install Trojan-Downloader.Agent.EL onto the user’s computer system. Once the user receives CNN.com Daily Top 10 email, he/she will believe it’s a legitimate email sent by CNN.com and will open it. CNN.com Daily Top 10 email contains the top ten stories of the day, however, none of the links provided redirect the user to any top story. If the user clicks on any of the links, he/she will be redirected to a website where a screen may display a message stating that the user needs the latest Flash player version to be able to see the site.

Once the user downloads the update, he/she will be downloading Trojan-Downloader.Agent.EL disguised as the get_flash_update.exe file. The Trojan-Downloader.Agent.EL will open a conduit in the user’s computer through which additional malware and rogue anti-spyware programs will be downloaded and installed. The most common rogue installed by Trojan-Downloader.Agent.EL is Antivirus XP 2008.

In addition, the user’s desktop background and screensaver may be hijacked. The user’s desktop may display a rogue alert notification stating that the user’s computer in flooded with spyware and the screensaver may switch to SysInternals BlueScreen Screen Saver. These malicious mechanisms may cause a crash in the computer’s operating system which will finally lead to a Blue Screen of Death (BSOD). The BSOD message may read:

“PAGE_FAULT_IN_NONPAGED_AREA
PANIC_STACK_SWITCH
MAXIMUM_WAIT_OBJECTS_EXCEEDED
NO_MORE_IRP_STACK_LOCATIONS
BAD_POOL_HEADER
IRQL_NOT_LESS_OR_EQUAL
KMODE_EXCEPTION_NOT_HANDLED
BOGUS_DRIVER
SYSINTERNALS_GREAT_SITE
UNEXPECTED_KERNEL_MODE_TRAP”

Trojan-Downloader.Agent.EL downloads may cause fake popups and system alert messages that interfere with the user’s workflow. Trojan-Downloader.Agent.EL is also known to modify the user’s Windows Registry.

Antivirus XP or AntivirusXP, is a rogue anti-spyware program and clone of Antivirus 2008, Antivirus XP Protection and Antivirus XP 2009. Antivirus XP may be installed in the user’s computer system by Trojan Zlob bundled in a fake video codec installer from an adult website. Once Antivirus XP is installed, the user may receive fake popups stating that the user’s computer is infected with spyware. If the user clicks on any of these popups, he/she will be redirected to a malicous website to further purchase Antivirus XP’s full version.

Antivirus XP may also emulate a computer system scan and display erroneous scan results to trick the user into believing his/her computer is in danger. To remove the imaginary threats generated by the fake system scan, the user is supposed to buy Antivirus XP’s full program. Antivirus XP is not able to detect nor remove any spyware infections found in the user’s computer, Antivirus XP is the threat itself.

SecureExpertCleaner or Secure Expert Cleaner, is a rogue anti-spyware program often bundled with the Trojan Zlob which is found on fake video codecs. SecureExpertCleaner can also be found on rogue websites that provide a trial for the user to download. Once Zlob is installed, it will generate an enormous amount of fake popups and system notifications stating that the user’s computer is infected with spyware. If the user is tricked into clicking on any of these messages, he/she will be redirected to secureexpertcleaner.com where he/she will be forced to purchase SecureExpertCleaner’s commercial version. SecureExpertCleaner will allege it’s able to remove the spyware found on the user’s computer system, however, this is just another mechanism to push the user into buying its full version.

SecureExpertCleaner’s trial version is also able to generate a computer system scan and display erroneous results to scare the user.

PC Protection Center 2008 or PCProtectionCenter 2008, is a rogue anti-spyware program and family of Power Antivirus 2009, XP Antivirus and Antivirus2009. PC Protection Center 2008 may install in the user’s computer system through a Trojan Zlob found on a fake video codec download. Once Zlob is installed, it will issue fake popups and alert messages informing the user about imaginary spyware infections.

PC Protection Center 2008 trial version may also launch its fake system scanner and emulate a computer scan. After the scan is completed, PC Protection Center 2008 trial version is able to generate a list of fake infections as a result. These mechanisms are used by PC Protection Center 2008’s creators to trick the user into downloading PC Protection Center 2008’s full version. PC Protection Center 2008’s messages and scan results will try to push the user into clicking on their links. Once the user click on any of the links provided, he/she will be redirected to PC Protection Center 2008’s website or other malicious websites to purchase rogue PC Protection Center 2008’s full version.