A computer worm is a self-replicating computer program. It uses a network to send copies of itself to other nodes (computer terminals on the network) and it may do so without any user intervention. Unlike a virus, it does not need to attach itself to an existing program. Worms almost always cause harm to the network, if only by consuming bandwidth, whereas viruses almost always corrupt or modify files on a targeted computer.

Payloads

Many worms have been created which are only designed to spread, and don't attempt to alter the systems they pass through. However, as the Morris worm and Mydoom showed, the network traffic and other unintended effects can often cause major disruption. A "payload" is code designed to do more than spread the worm - it might delete files on a host system (e.g., the ExploreZip worm), encrypt files in a cryptoviral extortion attack, or send documents via e-mail. A very common payload for worms is to install a backdoor in the infected computer to allow the creation of a "zombie" under control of the worm author - Sobig and Mydoom are examples which created zombies. Networks of such machines are often referred to as botnets and are very commonly used by spam senders for sending junk email or to cloak their website's address. Spammers are therefore thought to be a source of funding for the creation of such worms, and worm writers have been caught selling lists of IP addresses of infected machines. Others try to blackmail companies with threatened DoS attacks.

The Conficker worm has yet again proved it came from Hell itself by teaming up with the popular rogue anti-spyware program Spyware Protect 2009. As soon as Conficker enters the system, it downloads the scareware program, which in turn floods users with fake threat reports, urging them to pay for the full version of Spyware Protect 2009. This new trend is nothing short of terrifying, especially having in mind how widespread Conficker has lately been (according to some estimates - up to 15 million infected PCs worldwide, although the number can actually be even larger).

What is Rapid-antivir-2009.com?

Rapid-antivir-2009.com is a malicious website. This website promotes rogue anti-spyware application called Rapid Antivirus. Basically, Rapid-antivir-2009.com is a browser hijacker. It redirects the user to Rapid-antivir-2009.com website, where he can scan his computer for free or buy totally worthless and even dangerous rogue anti-spyware application.

Subsequently, Rapid-antivir-2009.com generates fake pop-up alert notifications stating that user's PC is infected with spyware or trojan viruses and suggest to perform free system scan. If the user clicks on that window, he will be automatically redirected to Rapid-antivir-2009.com. Most importantly, don't buy Rapid Antivirus, because it won't help you to to delete all those infections. Instead, remove Rapid-antivir-2009.com hijacker and block following websites:



rapidantivirus.com
www.rapidantivirus.com
scanner.rapid-antivirus-2009.com
security-check-center.com
rapid-antivir-2009.com

Rapid-antivir-2009.com is Extremely dangerous

What is Free-web-scaners.org?

Free-web-scaners.org is dangerous rogue website and browser hijacker. It promotes rogue anti-spyware application called Antivirus XP Pro. Once active, the hijacker redirects browser to Free-web-scaners.org. Free-web-scaners.org hijacker is installed without uer's permission together with trojan Zlob. Meantime trojan Zlob is used to download and install additional malware or adware and to advertise free online scanner.

The fake online scanner then reports that user's PC is infected with spyware. User is advertised to buy the licensed version of Antivirus XP Pro if he wants to remove those infections. However, the truth is that these results are all fabricated in order to trick the user into purchasing Antivirus XP Pro application. Free-web-scaners.org may also decrease system performance and cause system errors. It is highly recommended o remove the Zlob Trojan and Free-web-scaners.org hijacker from the system as soon as possible.

Free-web-scaners.org is Extremaly dangerous

Overview -

This detection is for a worm that exploits the MS08-067 vulnerability in order to spread. It may also download and execute various files onto the affected system.

Aliases

* Worm:Win32/Conficker.A (Microsoft)

* Crypt.AVL (AVG)

* Mal/Conficker-A (Sophos)

* Trojan.Win32.Pakes.lxf (F-Secure)

* Trojan.Win32.Pakes.lxf (Kaspersky)

* W32.Downadup (Symantec)

* Worm:Win32/Conficker.B (Microsoft)

* WORM_DOWNAD.A (Trend Micro)

What is Virusheat?
VirusHeat (a.k.a VirusHeat 3.9, VirusHeat 4.3 and, more recently, VirusHeat 4.4) is the newest threat from rogue anti-spyware manufacturers. Easy to mistake for VirusHeal, since not only is the name different by just one letter, but its features aren't much better either. The alerts claim that your PC is infected with various trojans, including smithfraud.G, which is a hoax used by malware vendors. VirusHeat is most commonly installed with the help of Zlob or by downloading it from virusheat.com (85.225.120.53). Their website does not look like anything original, and is full of false claims. According to the content, the "company" is based in Riga, Latvia and was created in 2000. However, they fail even the basic security tests.

What is Nano Antivirus?

Nano antivirus is another rogue release of Pro Antispyware 2009. After loosing battle on infecting PC's with that scumware, rogue software companies decided to push another clone to force you pay. The differences are insignificant : small changes in design and new names of fake threats in its scan results. In other respects the design stayed the same. Do not believe this rogue! The results are clearly fake, as NanoAntivirus could not detect even simpliest of spywares by itself. And don't be fooled by its version : Nano Antivirus 3.8 is the first and, likely, the last version of this bogus software.
You are at risk of getting Nano antivirus if you use file sharing networks much or just by browsing various websites. Ever-popular fake online scanner websites might suggest using a wondrous tool to fix all your security problems, but all you get is another Rogue in your PC that will slow it down and ask you to pay for removing infections that aren't there.
The payments aren't safe, as your credit card details pass through criminal web servers which might keep the information to use your cards for their own needs. So we suggest following your bank statement or changing your credit card after infection with Nano Antivirus. The company that claims to produce this scam, "Surround Software Solutions" does not exists so there are poor chances to contact them for refund.

Nano Antivirus is Extremely dangerous

What is Antivirus 360?

Antivirus 360 is a new rogue anti-spyware program - a fake spyware remover, which tries to trick the user into purchasing it's "licensed version" by intimidating him with fake threats. The name "Antivirus 360" is obviously an attempt to look similar to Norton 360, which is a known and respected all-in-one security tool by Symantec. Antivirus 360 typically makes it's way into the user's system by using the infamous trojan Zlob or by manual download.

What is SpyCrush?
SpyCrush, also known as SpyCrusher, is another variation of rogue anti-spyware, such as SpyLocked and VirusBurst. After infection by this parasite, you will receive fake security warnings, which state that your system is damaged by spyware and you need to buy SpyCrush or SpyCrusher in order to heal the infected system. These warnings will be exaggerated and false, as SpyCrush has neither any spyware detection nor removal capabilities. Stay away from SpyCrusher and remove it immediately after infection.
SpyCrush is closely related to VirusProtectPro, as it is hosted not only in the same data center in Kharkiv, but even at the same C class range (85.255.117.206), so it is highly probable that it belongs to the same person.

SpyCrush is Extremely dangerous

What is VirusProtect Pro?
Virus Protect Pro is a new (July 2007) rogue anti-spyware tool that you want to keep away from your PC for sure. Well, more like new name for old things, as it is very similar to Spylocked and Spydawn. A new name was used to trick users into spending money for a thing, harmful for their PC. We have got some of our users complaining about popups asking to purchase full version of this crap without ever installing it in first place. Although the origin of software is not clear, Zlob is the culprit or such problems usually.

To avoid problems, stay away from this software! We provide instructions on how to remove it from your PC. The domains related to this parasite are virusprotectpro.com (85.255.117.205) and virusprotectpro.biz. Be sure to block these domains using your HOSTS file for maximum security. Also, avoid installing "free" codecs from low reputation sites.

Last removal instructions update: August 28th, 2007