MedicCop is a rogue Anti-Spyware program. This security risk can be downloaded by clicking on certain Internet advertisements, but it must be manually installed. When a user downloads MedicCop and runs a scan, the program reports false scan alerts. The user is then prompted to pay for a full license of the application in order to remove the threats.

Type: Misleading Application
Name: MedicCop
Risk Impact: Medium
Systems Affected: Windows 2000, Windows Server 2003, Windows Vista, Windows XP
Behavior: MedicCop is a misleading application that may give exaggerated reports of threats on the computer.

How to remove MedicCop:

Download and install SUPERAntiSpyware and Malwarebytes Anti-Malware. Both security programs come with free versions.

I recommend that you run multiple passes of SUPERAntiSpyware and Malwarebytes Anti-Malware.

It’s important that you keep your security programs up to date. I highly recommend downloading the WOT (Web of Trust) add-on for IE and/or Firefox. The WOT add-on warns you about risky sites before you click.

Related Articles
How to Remove Antivir Solution Pro
Beware of this Fake Antivirus Program AV Security Suite

Most rogues do their dirty work by using an overwhelming number of detections (some, and maybe most, are false positives) to scare a novice into purchasing the rogue to remove what was either not there in the first place, or is trivial (like a tracking cookie or a missing help file).

Some like the one I am about to discuss, only showed a few…but those few strike terror in the mind of a novice.

The rogue programs on maxpcsecure (http://maxpcsecure.com/) cover the full spectrum of these “free scans”: “Max Spyware Detector”, “Max Registry Cleaner”, “Max RAM Optimizer”, and about eight more with the typical titles.

I was prompted to test some of these programs (using my VM and Sandboxie) because of a “review” made on the McAfee Site Advisor page (http://www.siteadvisor.com/sites/maxpcsecure.com/msgpage/showthread.php?p=3652575&posted=1) by a user with the screen name of “Rachnap”. I won’t quote the whole thing here, but it begins “Mywot.com is a hoax site having fake reviewers.” (For the full “review”, go to the link I just provided). That was enough to energize me to do my due diligence on this maxpcsecure.

Here are some of the things I found running these scans:

The following two screenshots display the completed scan. I ran SuperAntiSpyware, MalwareBytes, and Spybot S&D afterward. Other than the usual inconsequential tracking cookies, THE RESULTS OF THOSE SCANS DID NOT SHOW ANY TROJAN SPYWARE:

Here is where maxpcsecure is one of those that only show a few detections, but those few may scare novices into purchasing the removal program. My sense is that novices would be terrified by the use of the word “Trojan”, and consequently make the purchase. Notice also the descriptive paragraph on the left (it’s the same for both “Trojan.WebSearch”, and “Trojan.scar.pcp”.) It begins with “A destructive program”.

While that’s generally true of Trojans, if a novice reads that in conjunction with these bogus detections, they would likely get more terrified.

And, guess who can provide for removal of these Trojans? You got it!:

I also ran the “Max Registry Cleaner” scan:

This is a more typical rogue with hundreds of detections. If I had 1431 “invalid entries”, most of them shown as “high risk”, the machine wouldn’t even boot. Granted, there can be a high number of TRIVIAL “invalid entries”, but this beast shows most of them as high risk.

I would award maxpcsecure a blue ribbon in the “Rogue Hall of Shame“.

Finally, this Rachnap person, in a “review” post on SA (http://www.siteadvisor.com/sites/maxpcsecure.com/msgpage?page=3#reviews), made this remark:

“we invite our critics to prove us wrong and we will give a free copy of our product”

I would claim my “free copy”, but I don’t want any crapware/scareware/rogue on my machine.

An email from Uniblue to a colleague offering payment for placing a Uniblue link on his site has prompted me to come out of lurk mode and resurrect the Uniblue discussion.

This has been discussed before . . . if you do a search on “Uniblue” here on WOT, you’ll get 8 hits.

Uniblue has a yellow rating, but it is, and has been, a controversial item. Some swear by it, and yet others (myself included) think it’s nothing but a scam. (And I’ll detail why I have that opinion in a bit).

It is a particularly devious scam, IMO, because Uniblue leverages their “process library”, a legit product, to appear as a legit site . . . while at the same time promoting their rogue products.

I evaluated “RegistryBooster“, a Uniblue product, and a prime example, IMO, of the rogues they offer.
“RegistryBooster” is a registry cleaner.

First of all, when you click on the Uniblue “Products” tab, you get redirected to “liutilities.com”, another yellow rated site and this is actually a Uniblue site:

Now here’s the rogue part. Running RegistryBooster, I got 556 errors and a progress bar that indicates these errors as a “high Damage level”. Without getting into the virtues, or lack thereof, of registry cleaners, the “high Damage level” warning implies that these things are NOT trivial (“trivial” being things like orphaned DLL’s and missing help files . . . which is pretty common but not a show stopper):

When a user who is green sees something like “high Damage level”, they’re inclined to think this is disastrous (never mind that if your registry actually had that many serious errors, the machine probably wouldn’t even boot) and purchase the retail version of RegistryBooster to remove those (dubious) errors:

Hence my opinion that “RegistryBooster” is scareware and a rogue. (And RegistryBooster is “from Uniblue”, as the above screenshot shows).

I’ve not dug into the pedigree of Uniblue (such as blacklists, whois info, and robtex . . . and my suspicion is that all of that would be “clean”), but rather just run “RegistryBooster” (in my Windows VM within Ubuntu) to satisfy myself that Uniblue does indeed promote scams/rogues. I might not have such a poor opinion of Uniblue if it weren’t for that “high Damage level” indication in “RegistryBooster”. But then how else are they going to convince you that you should pay for removal instead of using a free registry cleaner like CCleaner?

AntiToolbar is a misleading application! This fake application can be downloaded from the publisher’s site and must be manually installed. When a user downloads AntiToolbar and runs a scan, it displays a large number of fake results about infections on the system. In order to remove the fake infections, the user is required to buy a licensed version of the application.

Type: Misleading Application
Name: AntiToolbar
Version: 0.0.0.0
Publisher: http://www.antitoolbar.com
Risk Impact: Medium
Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000
Behavior: AntiToolbar is a misleading application that may give exaggerated reports of threats on the computer.

How to Remove AntiToolbar
The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Run a full system scan.
4. Delete any values added to the registry.

For specific details on each of these steps, read the following instructions.

If you do not have Norton Antivirus, you can download a free copy of Malwarebytes’ Anti-Malware to remove this software. You can also try this new Fake Antivirus Removal Software.

This post was removed. If you have installed an antivirus program that you believe is fake, you can remove it by reading this post for instructions and free removal software.

If you’re looking for a solution that can tune up your PC, check out the following free PC utility; Advanced System Care.

Thank you.

There are more than 30 misleading applications and or rogue software that have made there way on to the internet in 2009. This type of software is fraudulent, and its sole purpose is to fool computer users in purchasing the full license version to remove the false or exaggerated infection.

Name: Antivirus Agent Pro
Version: 1.0
Publisher: Antivirus Agent Pro
Risk Impact: Medium
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP

Behavior: AntivirusAgentPro is a misleading application that may give exaggerated reports of threats on the computer.

AntivirusAgentPro – Removal Instructions

The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Run a full system scan.
4. Delete any values added to the registry.

For specific details on each of these steps, read the following instructions.

ErrorFix is a misleading application that gives false reports of threats on the computer. Once a user downloads this application, they’re prompted to purchase the full license in order to remove the false infection. This web site has been reported and marked red using the WOT (Web of Trust) Firefox add-on.

Name: ErrorFix
Version: 2.8.3456.520
Publisher: PC Utility Inc
Risk Impact: Medium
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP

Behavior: The program must be manually installed.

Removal Instructions:

1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Run a full system scan.
4. Delete any values added to the registry.

For specific details on each of these steps, read the following instructions.

SpywareCease, like many other misleading applications, gives false reports of threats on the computer. Once a user downloads this application, they’re prompted to purchase the full license in order to remove the false infection.

Name: SpywareCease
Version: 3.4
Publisher: SpywareCease.com
Risk Impact: Medium

Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000
Behavior: The program must be manually installed.

Removal Instructions:

1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Run a full system scan.
4. Delete any values added to the registry.

For more information on how to remove SpywareCease, click on the link below.

How to remove SpywareCease.

Think about this – You visit a site and it looks legitimate, it offers a program that will scan your computer and remove malware of every kind, fix the Registry and Optimize your computer for that ‘like new’ performance.

It is probably well priced, between $29 USD and $39 USD. The main page will tell you to be wary of fraudulent applications, of which there are many that are merely trying to scam you.

The site can vouch for its authenticity as it has verification seals which may or may not be genuine.

Maybe it is McAfee Secured

http://i198.photobucket.com/albums/aa306/cotojo/number2%20album/capture4-1.jpg

Maybe it is Business Verified

http://i198.photobucket.com/albums/aa306/cotojo/number2%20album/capture11.jpg

It could be Hacker Secured

http://i198.photobucket.com/albums/aa306/cotojo/number2%20album/capture10.jpg

Or maybe it has Privacy Verified

http://i198.photobucket.com/albums/aa306/cotojo/number2%20album/capture2-1.jpg

Look at this differently. Many such programs that are fake are also listed on many of the major and popular download sites, who claim they are ‘malware free’.

One good example of this is Spyware Cleaner 2009 which is also being sold by other affiliates through ClickBank and other sites, bear in mind that download sites are also affiliate sites and get a percentage from each sale.

I digress…Seals cost money:

These are just examples of costs, and given what the criminals can make they would be considered ‘cheap’

McAfee SECURE - $300+/month
ControlScan – $149/year
VeriSign Secure Site SSL – $390/year
VeriSign Secure Site Pro – $903/year
C&M Business Verified – $320.00/year
C&M Hacker Secured – $251.99/year

There a many great genuine sites that rely on these, but also the criminals have latched onto this as a way of ‘showing’ security. Their sites may be secure and downloads through https protocol, but that does not make them genuine.

There are sites that sell genuine seals and site owners that purchase them can verify this, just as there are sites that sell ‘fake’ seals which are absolutely worthless. But, for the vendors of seals, it is about making money.

For the criminals, a seal becomes a cheap option as does using secure servers (https) as they can easily make tens of thousands of dollars to stuff in their accounts, so the cost of a genuine seal would be loose change to them, a small price to pay with massive profits for fake products.

Some seals are also considered too cheap, as shown above with a price tag of $320 USD per year, sell only 10 fake programs and beyond that is the ‘profit zone’ which is very, very lucrative for the criminals.

The various rogue / fake applications have made millions of dollars for the criminals as users download the ‘free scanner’ and then purchase the program to clean the non-existent defects from their computer.

The user becomes the victim of fraud and Identity Theft as Credit Card information and Personally Identifiable Information (PII) is entered on the purchase page. ID Theft and Fraud is something that I do know about, having been the victim of this, but NOT through the internet, but that’s another story!

There are many genuine and safe programs, if in doubt seek advice and please, stick to the well known names and also check where you are downloading from.

Always check, double check and check again, do NOT assume that it is safe unless it has been verified as such by those who know what they are dealing with and if using the Free PC Security, has many free programs and I place links to various downloads that are safe and secure. Online security is something I take very seriously along with the safety of others.

There are a growing number of cold telephone calls to users from a company known as Support on Click who are based in India and are reaching out across the globe with their scam calls.

Currently, they have setup operations in the UK, USA, Canada and Australia and are quite aggressive in their approach.

They usually inform the customer that they have been recommended by their ISP and they work alongside them to provide support by means of remote access.

They attempt to use ‘scare tactics’ in a bid to get users to sign up for their ‘computer repair’ service with statements along the line of they already know that the users computer is infected with malware and would be damaged beyond repair unless the user signs up and allows Support On Click to ‘fix’ the non-existent problem.

The calls are completely fraudulent and this company has no idea of what is or is not on a users PC.

I have had calls from these and listened to their rubbish. Now, they even stated that they could repair a PC via remote access when it had lost its internet connectivity! Now, that would be a real bonus wouldn’t it?

I use remote access to fix computers, but I need an active internet connection to do so at both ends.

Interestingly, the company’s affiliated partner is none other than PC Security Shield, better known as The Shield Deluxe 2009, which is a known fake rogue application that will also scam users.

Scams are not limited to the internet, they now also use VoIP, landlines and cell phones to phish for user’s personally identifiable information (PII) and credit card details which will lead to Identity Theft and Fraud.

Computer security is an essential component and all users should ensure that their firewall, antivirus and antispyware are updated and all Operating System patches applied.

Good security does not need to be complicated or expensive as a many of these are free to home users.

One simple tool that I always advocate is the Web of Trust add-on for Internet Explorer and Firefox, which can be customized to suit your needs and also warn you of many dangerous, malicious and fake sites.