Sunbeltblog reported about new rogue antispyware SpyHeal. This is probably the replacement for Spyware Quake (or SpywareQuake).
Sysprotectionpage(dot)com showed spyheal(dot)com as one of the new partner sites and some rogue anti spyware apps also.
After opening Sysprotectionpage(dot)com, i have got message:
Warning!
W32.Myzor.FK@yf is a virus that infects files with .exe extensions. It attempts to steal passwords and private information from the infected computer.
Type: Virus Infection
Length: 138,293 bytes
Systems Affected: Windows 95, 98, ME, NT (all versions), 2003, Windows XP (all service packs)
Systems Not Affected: DOS, EPOC, Linux, Macintosh, Novell Netware, OS/2, UNIX
Technical details: 1. Creates files in %Windir% directory. By default, this is C:\Windows. 2. Adds values to registry keys:
HKEY_LOCAL_MNACHINE\Software\Microsoft\Windows\CurrentVersion\Run
3. Scans the hard drive for .exe files and infects any executable files.
Searches for passwords/information, which it may send to a remote attacker. Recomendations: Click “OK” to download officially approved security software. Always keep your patch levels up-to-date.
What strange :), i have open this page in linux -“Not Affected System“, but got the fake message!
For protect your PC, add these sites to your blocklist: Sysprotectionpage(dot)com, spyheal(dot)com
