Antivirus Elite displays fake alerts in malware payloads in order to persuade users into buying the rogue antispyware product. It also has the capability to display popup advertisements.

Trojan-Dropper.Nemqe is a trojan which on execution drops and installs additional malware onto the users computer.

Trojan-Dropper.Nemqe behaviour:

• Sets the drive to autoplay by creating autorun.inf file in its root directory. If the drive is shared across the network then other remote computers can be infected any time they try to access this share.
• Hosts file modification that may block access to the security web sites.
• Produces outbound traffic.
• Downloads/requests other files from Internet.
• Registers a Browser Helper Object.
• Contains characteristics of an identified security risk.

APcSecure is a rogue antispyware program. It’s another clone of Winiguard rogue security application.

ProtectDefender is a fake security program. ProtectDefender is a clone of previous ArmorDefender from WiniSoft / trojan.fakesmoke family.

ArmorDefender is a rogue antispyware program from WiniSoft family. This time ArmorDefender comes in a new GUI.

Desktop Defender 2010 is a rogue security tool. It’s a scam and should be removed.

Win Security 360 is a rogue antispyware program promoted through malware and fake online scanners.

Aliases: Rogue:W32/AntivirusXP2008.W [F-Secure], Trojan.Win32.FakeAV [Ikarus], Trojan:Win32/FakePowav [Microsoft]

DefendAPc is a rogue security tool from WiniGuard, Trojan.Fakesmoke family. DefendAPc is installed using search engine results hijacking click fraud and black hat seo (seo poisoning) techniques.

Alias: RogueAntiSpyware.DefendAPc [PCTools], DefendAPc.FakeSmoke [Sunbelt]

ErrClean is a Rogue application which produces many bogus system error detections in order to persuade the user into buying their product before they can remove these spurious detections. It also uses aggressive and deceptive advertising to persuade users to download and purchase their product.

Aliases:RogueAntiSpyware.ErrClean [PCTools], Downloader.gen.a [McAfee], Win32/WinFixer [Microsoft], not-a-virus:FraudTool.Win32.SysKontroller.b [Kaspersky], not-a-virus_Downloader.Win32.WinFixer.cn [Kaspersky]

PCsProtector is a Rogue security application that produce bogus detctions and attempt to persuade the user into buying their product in order to remove these detections.

Aliases: RogueAntiSpyware.PCsProtector [PCTools], FakeAlert-JM [McAfee], Riskware.FraudTool.Win32.AntiAID [a-squared]