Lavasoft Malware Labs came across this rogue today. It's called SpyEraser and installs and runs from %HomeDrive%\Windows\System32. Usually rogue software creates a folder located in %ProgramFiles% or %ApplicationData% but SpyEraser makes an exception. It behaves like a normal fraud tool by causing annoying security alerts and trying to entice users to purchase their useless application.