Home / malware Rogue:W32/Rogue
First posted on 01 July 2010.
Source: SecurityHomeAliases :
There are no other names known for Rogue:W32/Rogue.
Explanation :
Dishonest antivirus software which tricks users into buying or installing it, usually by infecting a user's computer, or by pretending the computer is infected.
Additional DetailsWhen searching our Virus Descriptions database for a specific program (e.g., Rogue:W32/Example.A), you may be directed to this page if the overview below sufficiently describes the program.
Alternatively, you may be directed to this page if no description matching that specific query is currently available. You can submit a sample of the suspect file to our Response Lab for further analysis via:Â
  À Sample Analysis System
About Rogues
Rogue antispyware is difficult to define as the intentions of the group vary. Typically, the products claim to be a legitimate antispyware application, but are in fact nothing more than an inexpensive clone of unreliable software.
Distribution
Many of the applications use very questionable sales tactics and the quality of their product is suspect. Detecting problems in the demo or trial version, but requiring a license to remove those problems is typical for the family.
Spyware or other malware sometimes silently install rogue antispyware, which then offers to remove the spyware. Trojans and toolbars are other sources prompting for rouges to be installed.
Affiliate marketing programs are often used to sell rogue antispyware. Every time an affiliate product is installed and sold, a commission is paid. The result is a strong pressure to sell, by any means necessary.
Rogues that have been available for a while are also often repackaged and given new names in order to gain new, unsuspecting users.
Activity
Deceptive or high-pressure sales tactics may also be used to convince users into buying a license. For example, free scans are offered but a license is needed before any dangers can be removed:
Free, fully functional trial periods are usually not offered. Users will be told that they need to buy protection even if there is nothing dangerous found.
Many rogue applications present outright false positives as a means to alarm computer users into buying their application, as can be seen in the screenshot below:
Others present false positives due to bugs in the software's code, not because of an outright lie. Code corrections can move a suspected rogue off the antispyware detection lists.
Rogues can be deliberately fraudulent, or just substandard products that present false information. For example, one rogue displays a list of fake "threats" seen below:
Note the misspelling of threats as "threads". The two files listed are common and are found on any installation of Windows. They are text files that contain configuration information for Windows. They are not executable programs.
More
For more information, see Encyclopedia: Rogue.Last update 01 July 2010
