VirusRescue Looks Like New Rogue

Thanks to a spammer at this site, I found what appears to be a new SpywareQuake, SpyFalcon, and other scam antispyware programs clone. New program is called VirusRescue and fits the same pattern as the others.

I got the program from a link in a pop up after installing one of the media codecs that ended up installing SpywareQuake. So I ended up having two different spyware warnings in my system tray.

This one is from VirusRescue:



This one was also present, coming from SpywareQuake:




It appears the site VirusRescue.com hasn't been added to IE Spyad and other bad site lists yet.

More pictures and details at Security Ticker.

Zero reply bump

Just some links to where it was covered apart from Nicks blog:

http://www.securitycadets.com/2006/08/m ... rusrescue/

http://www.vitalsecurity.org/2006/08/virusrescue-will-someone-rescue-me.html

http://www.realtechnews.com/posts/3393

http://blog.spywareguide.com/2006/08/virusrescue_keeping_up_a_noble.html

http://www.siteadvisor.com/sites/virusr ... m?aff_id=0

http://research.sunbelt-software.com/threatdisplay.aspx?name=VirusRescue&threatid=48317

http://www.bluetack.co.uk/forums/index.php?showtopic=15209

As of their first comment (VirusRescue I mean) no reply yet. Nick or I will keep you posted.

Thank you both for the info and links.

It has also been added to SiteHound's Database as of yesterdays update.