Rogue software

From Wikipedia, the free encyclopedia

This article or section does not cite its references or sources.
You can help Wikipedia by introducing appropriate citations.

Rogue security software is software that uses malware (malicious software) or malicious tools to advertise or install itself or to force computer users to pay for removal of nonexistent spyware. Rogue software will often install a trojan horse to download a trial version, or it will do other unwanted things. The first and still most comprehensive study of rogue and real antispyware programs [1] was carried out by Eric L. Howes, one of the world's most renowned security professionals.

1 Effects
2 False Positives
3 Detection
4 Rogue Software
5 See also

[edit] Effects

The main goal of rogue software makers is to sell their product. Many times fake Windows dialog boxes will appear. Most of the time, they will display a message such as "WARNING! Your computer is infected with spyware! Buy our product to remove it!" Usually, when the dialog box's OK button is clicked, this will direct the user to the software's website. Sometimes, even clicking the upper right hand X button to close the dialog box will produce the same effect or activate the software's installation. (Pressing Alt+F4 can circumvent that trick). Some software, like SpyAxe will automatically download the trial version without any user action (drive-by installation).

[edit] False Positives

A variant of the above technique that rogue security software makers use is that of false positives. A false positive is a fake or false malware detection in a computer scan. This can convince even such users that their computer is infected who may not be deceived by the abovementioned similar claims without a scan. This is quite different from an accidental false positive, which can be produced in a scan by security software from honest companies.

[edit] Detection

Almost all antispyware software will detect rogue software if it is in a computer. Oftentimes, rogue software will install a Trojan horse to download the software from the maker's website, like Titan Shield. Antispyware software can detect the Trojan even before the software is installed. Programs such as Ad-Aware SE, AVG Anti-Virus, CounterSpy, Spybot - Search & Destroy (free), Spy Sweeper, Spyware Doctor, SUPERAntiSpyware (pay), and Windows Defender (free for Windows XP users) can usually detect these. However, often removal of new, aggressive rogue programs requires use of programs such as HijackThis combined with manual removal processes because it can take quite a while before the manufacturers of the abovementioned legitimate programs learn how to automate the process and update their programs. Use of HijackThis without specialist help can cripple a computer, and users are advised to get help from the many voluntary specialists in many forums such as Spyware Warrior, Safer Networking, and many others.