New Rogue: ProtectionBar

[TeMerc]

Found this article from Panda, on HNS site:

Panda Software warns of a new adware program called ProtectionBar, which tries to trick users by installing false security programs on their computers. These programs inform users that their computer is infected by threats that do not exist or show fictitious errors. Then they threaten users so that they buy the license in order to delete the malware supposedly detected. The aim of this system is to earn a profit for the developers of these programs, who will share it with the creators of ProtectionBar.

This system for earning an income is nothing new. Supposed anti spyware programs have been detected in the past, like RazeSpyware or SpySheriff, which kindly offered to clean users’ computers of spyware that didn’t exist or had been installed by the application itself for a modest fee. Certain coincidences in all of these applications could suggest that they belong to the same creator.

http://www.net-security.org/secworld.php?id=4073

http://protectionbar.com/

As usual, the site is chock full of company info and privacy polices......NOT


List of other anti spyware cleaners they sell: (most already on Rogue list)
WinAntiSpyware
AntiVirus Golden
DriveCleaner
PestTrap
System Doctor
VirusBlast
AdProtect


http://protectionbar.com/remove_spyware/

Looks like a bunch of apps to add to the Rogues list.

[ChrisRLG]

Bump

[TeMerc]

This 'ProtectionBar' is turning into somewhat of a mystery. No one can seem to find it, to try and DL and test.

I think the 'bar' is just the bogus scan which appears when you enter the scan page. they then try and push a bunch of already known Rogues.

Altho VirusBlast seems to be new. But thus far, no one has been able to find any actuall infect code in any of the files.

[TonyKlein]

This 'ProtectionBar' is turning into somewhat of a mystery. No one can seem to find it, to try and DL and test.

Well, it is certainly rife, and it probably gets stealth/bundle installed like much 'Zlob' related cr@p.

You'll see these HT entries:

O2 - BHO: (no name) - {5753791b-f607-48ca-814e-91c14d081f9e} - C:\Program Files\Media-Codec\isaddon.dll
O3 - Toolbar: Protection Bar - {d1ac752e-883f-4ed8-8828-b618c3a72152} - C:\Program Files\Media-Codec\iesplugin.dll