Spyware Guard 2008

Spyware Guard 2008 is a new rogue application. Does that name sound familiar? Well, yes, there is a legitimate application named SpywareGuard (note that there is no space between Spyware and Guard, and there is no 2008) from Javacool Software. Please do not get confused!!

Spyware Guard 2008 is hosted at www.spywareguard2008.com (67.19.176.187), registered by ESTDomains (whois lookup). Here's a screenshot of the website:

The IP address 67.19.176.187 also hosts a fake online video page, with the domain name http://porn-movies-online.net. This page pushes yet another variant of Zlob fake codec hosted at http://pyroscanner.com (67.19.176.188).

By the way, the Spyware Guard 2008 installer is named as SpywareGuard2008.exe, and here's how the rogue application looks:

VirusTotal scan results of the installer can be found here. Stay away from this rogue!