Just had a run-in with the 'System Security 2009' Trojan

[santamargarita]

This thing hijacks your computer and starts scanning for Trojans. You have to start up in safe mode then follow the directions: http://www.411-spyware.com/remove-system-security-2009. I fairly certain I got it from a free CD ripper I downloaded - which is gone now.

It's about like George Bush wanting Henry Kissinger in investigate 911.

[Why Syzygy]

1. Was it "audiograbber"

do you know? I've always safely used it. But just downloaded it yesterday on my clean system and haven't installed yet. Or do you know what ripper it was?

[santamargarita]

2. I can't prove it, but it always wanted me to check for an update

Here is where I got it: http://www.innosetup.com

[EvolveOrConvolve]

3. I've been using JR's software for years

and never run into any sort of problem. And, I'd never heard of him releasing an audio ripping application, and a quick perusal of his site shows that he doesn't offer one. His applications are used by us uber-nerds that are software developers to make our lives easier.

Are you sure that you haven't had your hosts file hijacked, or some other nasty thing that is causing your problem?

[Why Syzygy]

4. Have you used any new malware removers

or free scanners lately? Still looking, but ...

In March 2009, we notified our customers on a new variant of the infamous Vundo trojan family which we detected as Ransom-F and raised its risk assessment to a Low-Profiled threat. It was possibly the first indicators of a shift in the FakeAlert criminal model from instilling fear, to holding information technology resources for ransom but certainly not the last.

Last week, we came across to a new variant of a rogue security program branded by its creators as “System Security 2009″ and detected them as FakeAlert-CO, and some of its past similarly branded cousins as FakeAlert-SystemSecurity.

The updated variants were discovered from a web page hosted on trustedw{blocked}security.com.As most other rogue security programs to date, FakeAlert-CO displays spurious alerts and making fraudulent claims of infections that requires the user to pay a fee to “repair”. Following the trend of Ransom-F, we noticed “new features” in FakeAlert-COthat resembles some common characteristics of ransomware trojans.

Once installed, FakeAlert-CO may either terminates all running user process or prompts the user to reboot. (...)

http://www.avertlabs.com/research/blog/index.php/2009/05/12/fakealert-trojan-holds-systems-for-ransom/