Sunbelt researchers have discovered a bizarre Trojan.
It tries to scare you into buying a security application to handle a non-existent “infection”. Ok, nothing odd there — that’s standard rogue antispyware behavior.
But what’s bizarre is that it collects your payment, and never actually gives you an application. Instead, you get a popup that says “you’re protected”.
We call it the vaporware Trojan. But today, we are rolling out detections for it as Trojan.VirusFighter.
(It’s worth noting that the credit card number and other data are transmitted in clear text to a server in Germany.)
And that’s it — only a popup that tells you you’re protected. Nothing more.
Alex Eckelberry
Update: We want to make sure everyone understands that this trojan is not associated with the legitimate folks over at VirusFighter.