The scammers have stared using "Virus Scanner ActiveX Object Error” bogus error to lure users into downloading rogue security applciation.

The LastDefender is the first applciation to use this:

hxxp://thelastdefender.com ->officaial home page of the rogue:

Fake scanner pages used by the rogue:

hxxp://scanner.lastdefender.net
hxxp://xscanner.lastdefender.net
hxxp://zscanner.lastdefender.net

download available @hxxp://lastdefender.net/setup.php?id=tld

Virustotal Scan Result: 10/32 (31.25%)

AVG 7.5.0.516 2008.03.02 Downloader.Generic6.AGDQ
CAT-QuickHeal 9.50 2008.03.01 TrojanDownloader.FraudLoad.h
Fortinet 3.14.0.0 2008.03.03 W32/Dloader.CDG!tr
F-Prot 4.4.2.54 2008.03.02 W32/Heuristic-217!Eldorado
F-Secure 6.70.13260.0 2008.03.03 W32/Downloader.JDU
Kaspersky 7.0.0.125 2008.03.03 Trojan-Downloader.Win32.FraudLoad.h
Microsoft 1.3301 2008.03.03 Trojan:Win32/Malagent
Norman 5.80.02 2008.02.29 W32/Downloader.JDU
Symantec 10 2008.03.03 Downloader.MisleadApp
Webwasher-Gateway 6.6.2 2008.03.03 Riskware.Fake.Lastdefe.3

Info @ http://bharath-m-narayan.blogspot.com/2008/03/new-scam-tactics.html

The site downloads the file: install_tld.exe

File: install_tld.exe received on 03.03.2008 12:07:01 (CET)

Result: 10/32 (31.25%)

Antivirus Version Last Update Result
AhnLab-V3 2008.2.29.1 2008.03.03 -
AntiVir 7.6.0.73 2008.03.03 -
Authentium 4.93.8 2008.03.02 -
Avast 4.7.1098.0 2008.03.02 -
AVG 7.5.0.516 2008.03.02 Downloader.Generic6.AGDQ
BitDefender 7.2 2008.03.03 -
CAT-QuickHeal 9.50 2008.03.01 TrojanDownloader.FraudLoad.h
ClamAV 0.92.1 2008.03.03 -
DrWeb 4.44.0.09170 2008.03.03 -
eSafe 7.0.15.0 2008.02.28 -
eTrust-Vet 31.3.5582 2008.03.03 -
Ewido 4.0 2008.03.02 -
FileAdvisor 1 2008.03.03 -
Fortinet 3.14.0.0 2008.03.03 W32/Dloader.CDG!tr
F-Prot 4.4.2.54 2008.03.02 W32/Heuristic-217!Eldorado
F-Secure 6.70.13260.0 2008.03.03 W32/Downloader.JDU
Ikarus T3.1.1.20 2008.03.03 -
Kaspersky 7.0.0.125 2008.03.03 Trojan-Downloader.Win32.FraudLoad.h
McAfee 5242 2008.02.29 -
Microsoft 1.3301 2008.03.03 Trojan:Win32/Malagent
NOD32v2 2916 2008.03.03 -
Norman 5.80.02 2008.02.29 W32/Downloader.JDU
Panda 9.0.0.4 2008.03.02 -
Prevx1 V2 2008.03.03 -
Rising 20.34.00.00 2008.03.03 -
Sophos 4.27.0 2008.03.03 -
Sunbelt 3.0.906.0 2008.02.28 -
Symantec 10 2008.03.03 Downloader.MisleadApp
TheHacker 6.2.92.231 2008.03.02 -
VBA32 3.12.6.2 2008.02.27 -
VirusBuster 4.3.26:9 2008.03.02 -
Webwasher-Gateway 6.6.2 2008.03.03 Riskware.Fake.Lastdefe.3
Additional information
File size: 26112 bytes
MD5: a9dfd91bd9a428d2d8bb9e049d178cc8
SHA1: f7c3111aa946edb78feef4fbe565a951563a9031
PEiD: BobSoft Mini Delphi -> BoB / BobSoft