Two new rogues have hit the scene, ContraVirus and SpyCrush. Each is targeted by special removal tools already. Read More Here
As usual, if you're infected with either of these or any other SmithFraud\Zlob variants, be sure to have us look at a log in our Countermeasures: Extraction Forum.
Lavasoft released their new version of Ad-Aware yesterday, Ad-AWare 2007, after much beta testing. Well, I guess it wasn't quite enough. Several users have complained about glitches, system crashes and Vista incompatibility too.
F-Secure security firm researches the most popular launch points for malware. Nicely done with detailed analysis and screen shots. Read & Discuss Here
Cexx forums was returned to service shortly after me posting my previous entry about it. Sorry for my delay in reporting that here.
Well it looks as tho the recent story about Dreamhosts being hacked has affected Cexx forums in that when you go there as of this writing, you get a blank page. The admin is well aware and is working to restore status as quickly as possible. Keep an eye on this blog for its return to service.
Zango recently filed a lawsuit against Spyware Doctor. Just earlier today, Zango was denied a TRO. They then claimed that because Spyware Doctor changed its detection of Zango that they were victorious by forcing their hand.
Read & Discuss Here
McAfee SiteAdvisor team posts up a state search engine safety write up. This follows previous write ups and of course it's never very good news. Another reason for users to use things like SiteAdvisor or other related browser
protection devices. Read & Discuss Here
The spam and phishing forum has been very busy this week. Friday brings no end. A bit on the major spammer arrested and why it won't impact your inbox.
And then a look into what the future of spamming techniques holds
Then we have a bit of a technical read about the effectiveness of anti virus software
Lastly there is a new MSN IM worm spreading
Enjoy and don't forget to let us know what you think.
IM threats increase over 70% since last year, averaging a new threat every day. Read & Discuss Here
Google has recently rolled out a security blog and released a technical paper and now the just bought out an anti-malware company as well. And one of their employees wrote a cool app for webmasters to check and see if their sites have
malicious code. Read & Discuss Here
And I stumbled upon a neat write up showing a bunch of firewall testing tools to see how secure you really are. Read & Discuss Here
Digg links for both on respective page.
Read about the latest image spam technique and about how phishers try to flood phishing filters with a huge jump in URLs since last month in the forum. Read & Discuss Here
Users who routinely adhere to good security behavior and type in urls to their banks as opposed to following links can be duped into giving their info anyway. It seems as tho the creators of this malware have injected to to add fields for additional info. They never cease to amaze me in their abilities to circumvent almost any sort of barrier put up. The good folks at Symantec provide anlysis. Read & Discuss Here
Read about the man who owns the Internet, its pretty interesting.
Then there is the big deal about Dell & Google, they are making money installing some 'extra' software.
Speaking of Dell, you will soon be able to buy them at Walmart.
And a lemon law for computers?
Finally for some laughs watch some funny techy videos.
Don't forget to take the time to comment on what you see, I'm always interested in seeing what people like and don't like.
Another great achievement for my good friend BillP, developer of WinPatrol.
Scotty has been awarded as one of Top 100 Best Products Of 2007 by PCWorld
Check it out.
As it's turning out, ValueClick has given me reason to make an entire thread dedicated to their recent activities with rogues. It will be updated as news warrants. Just today there are two items posted by MS MVP Mike Burgess on his Hosts News. You can read about those here
And in Zango news, they recently filed a lawsuit against PCTools. But upon further investigation by Sunbelt researchers, it appears that all is not as clear and concise as Zango would have you believe. What a shocker, huh? More on that here
Fake Dell online store email installs trojan. Read & Discuss Here
Casino software vendor threatens Spybot group because they detect their software. It appears to be installed via malware. But they don't seem to care. I bet you can't guess what Spybot gang told 'em? Read & Discuss Here
I've set up a new poll in the forums. It has to do with 'crapware'. You know, the extra junk software new PCs come with from OEMs such as Dell, Gateway and HP. There is a video from CNET too. Watch the vid, take the poll and add your own comments
Eric Howes has updated the Rogue\Suspect Anti-Spyware List. Just click the link to the right to view the latest additions.
Well the malware authors have really outdone themselves here. This trojan presents a MS looking blue boot up screen and asks for your CC info. Decline it, and the PC reboots. Read More Here
Well it seems the gang at Enigma have decided to make an attempt to reign in the affiliates which were 'spamvertising' forums and social networking sites.
After a long discussion at Spyware Warriors, they finally got it. But only time will tell if new policies, if any, are effective or if the existing ones are enforced.
One thing is for sure......if they are not enforced the community will know. Very quickly.
Well the gang behind the most current crop of forum spam has taken exception to the publicity. And you would think they would actually like it. But of course it's not exactly of the flattering kind of publicity. One could paint it as not flattering. Especially if it's really just an unethical method of advertising your product. And it's not even done in a manner which is obvious. The push generically named removal tools for the latest malware and install the samething in each instance, Spy Hunter.
They posted a press release asking for discussion on the matter with the security community. They threaten a possibility of legal action even. Maybe they ought to spend their money on good, honest affiliates instead of lawyers. Now that would be good publicity. Read More Here
Microsoft has developed a malware portal of sorts. Has all kinds of info on it. It is still in beta tho. It lists the most active viruses, malware, email spam and much more. Read More Here
I've just updated a couple of threads in our Latest Malware Threats Forum. I updated the SmitFraud post to show links to changelogs and tools and added one for SDFix, a bot detection and removal tool.
Noted Microsoft evangelist Mark Russinovich weighs in on Vista and malware.
Essentially, he says regardless of UAC, malware writers will conquer Vista as they always have with other OSes.
I've already seen malware on Vista systems so it's no big shock. Read More Here
AVG\Grisoft announces that their product, Internet Security 7.5 now supports Windows Vista. Read More Here
Could the fact that botnets are getting stronger and smarter coincide with phishing attacks decrease overall, but targets increase?
Check out the links and decide for yourself.
For some other information about the previously blogged about 'Spyware Help: Intent Matters Alot:Part 2 ' group, read this blog by Security Cadets.
It's been a little over a year since I last blogged about it, and it seems it's time for another go.
The last week or so, I have noticed a pattern of links showing up on Digg which purport to take care of all your woes dealing with the latest SmithFraud\Zlob variant, Spylock(ed). They were posted usually a couple of days apart and rarely had more than one digg.
Now it's not so bad that websites offer to fix you up with the latest rage-in-the-cage type malware infection. I'm all for sites which do this, it's what I do too.
The big difference here is of course, you won't find me, nor anyone associated with me, plastering forums with a tag team duo to direct users to my site. Like here, here, here and here. These people, much like the first group I blogged about have only one thing in mind: to make money of site traffic\clicks. That's it. They don't care about your machine whatsoever.
This group appears to be related to SpyHunter\Enigma Software Group. They have been pretty quiet for some time. But it appears
that with each of the downloads from 411 sites, they are installing SpyHunter.
So once again, a once dormant rogue rears its ugly head out from the shadows, to spam forums and newsgroups and the occasional social networking site. You really can't change this tigers stripes.
Greed is as greed does to take a cue from Forrest.
MSNBC has a three part series exploring the cyber criminal world and activity within. 150 millions infected PCs. Botnets sending out spam by the millions. Gang fights with eachother. All for their piece of your stolen identity. Read More Here
MS monthly updates available, several critical rated. Read More Here
Once again, Paperghost has compiled several edits from the Zango Wikipedia page to point to where information seems to be 'disappearing'. Coincidently those edits are coming from the same IP as the Zango home office and actually point directly to edits made by their fearless, yet obviously not-too-bright ring leader, Daniel Todd. For the entire scoop, which is now up to part four read here and laugh at their stupidity.
Well its been a couple of weeks since I installed Vista and last blogged...............about anything. But beginning this week, I'm going to try and post every other day at least.
The last two weeks, Jr. had his spring break and with Vista installed, there was lots of learning new things. So this blog suffered.
Apologies for any who came here looking for anything new. The forums of course are where all the action is.
I've finally gotten around to installing Vista Ultimate, and it's pretty neat so far. Not so great that I'd be telling people to buy it, mind you, but it is neat. I have a couple of threads in our Vista Forum. Check 'em out.
BillP has just released a new version of WinPatrol with some nice tweaks to make using Scotty in Windows even better...if that's even possible. Read More Here
One of the mods at my forum, good friend and developer, Steven Burn who has had a great freeware site, Ur I.T. Mate Group has also been keeping up the hosts file entries for hpHosts for the last several months.
There have been some changes and all users have had to re-register. So if you had not been a member previously now is the time to go and register
McAfee's SiteAdvisor blog maps the malware world of domains. Providing stats on where the worse countries are who host the malware sites on the web. The most volatile countries? Russia and Romania. Worse overall domain? .info, with .com right behind it.
Read More Here
Merijn, creator\developer of many specialized tools, notably HijackThis!, has sold said tool to Trend Micro. Read More Here
I'm happy to announce users can now buy security software via TeMerc Internet Countermeasures. You can read all about it here
BillP Studios released the official version of WinPatrol 2007. [Read More Here]
I'll be keeping a fairly close eye on Vista related stuffage now that it is released to the mainstream public. [Read In Our Vista Forum]
Users of MySpace face a malicious software via ads in the form of WinAntiVirus\DriveCleaner\ErrorSafe. These are all rogue anti-spyware applications. It's the latest of dangers for the multitude of users. [Read\Discuss]
Microsoft has announce extended support for Windows XP and Windows Media Center Edition. This is good news for most of those users. As it is, the over all consensus has been that most will wait a while before upgrading to Vista. I don't see this as a good sales bolstering move. [Read\Discuss]
This one is a password stealer so users need to verify before clicking links and always pay attention to re-directs to log in pages. Always click your original saved bookmark to get back to the correct page. Never trust re-direct links which require you to 're-log in'.
[Read\Discuss]
This latest email nasty has many variants with multiple titles and has changed its over all theme from news to romance. Be sure you don't answer any emails from unknown sources and have your av up to date. [Read\Discuss]
BillP, creator of WinPatrol has just announced WinPatrol 2007 Beta. And it has a kewl new feature: 'Delayed Start'.
[Read Discuss Here]
Well it seems a mystery has begun. The cached post of Mr.ButtWipe where he called me a troll has reappeared in his blog archive. Interesting isn't? I'm sure he'll attribute that to some sort of blog glitch or something.
Another thing occurred too. Two of the names he mentioned as 'good guy' MS MVPs cannot be found on the public awardees site. There is tho one of them who is actually an MVP. It will be interesting when he is contacted about Mr.ButtWipe dropping his name and declaring him a 'good guy MS MVP'. I'm sure that he will be sure to add that amazing acknowledgement of being considered as a good guy MS MVP. I know I'd run and add it to my profile.
Speaking of my profile, you can see it off over there, to the right. Is there any such link on Mr.ButtWipes blog? Or any of his sites? I don't think so.
Well Brian, I suppose I also ought to give your name a search for in the MVP profiles, and see if it pops up, eh? Does Diane know you're up to no good? I can't imagine she would approve. Unless of course she is your female alter ego. Much along the lines of all the users who post in your defense.
[Read Discuss Here]
Well PCButts is making a saddened attempt to discredit me. He says I'm a troll because I am trying to get him to come out from behind the relatively appropriate handle of PCButts1. Of course we all know him more to be PCButtWipe1.
Why? Because in my opinion he is a lying, lowlife scumbag Internet softwaret thief. He even wrote a post about me back in December, but saw better to remove it, but I have a Google cache of the post. [Read Discuss]
Well it looks like the scumbags over at Zango are at it again. Teen porn is their new frontier. This is one heck of a way to start off the New Year. [Read Discuss Here]
Thanks to some info from the Sunbelt blog, this website, which was recently sold for $500,000 has an app associated with it that is less than dependable to say the least, SpywareBot.
Need to purchase to remove 3 mild registry entries, and over look dozens of malware files stored in a regular folder. Can you say 'scam'? Sure ya can, say it with me now.......[Read | Discuss Here]
Scam sites have been on the upswing as of late, so I decided to make a sticky thread just to deal with them. They include sites that try to trick users into downloading some sort of POS anti-spyware (rogues)along with sites that try to goad users into downloading a codec file to view a particular video clip. Nine times out of ten, the user gets infected with Zlob\SmithFraud infections or goodness knows what else is lurking. [Read Discuss Here]
Three new anti-spyware rogues and two more fake codec sites appear for the week, guess the malware scumbags were busy getting ready for a holiday push. [Read|Discuss Here]
PCButts, Internet thief, liar and overall scumbag has now laid claim that he is an MS MVP. On the SiteAdvisor review page he claims he is and has been for 4 years. I think not. [ReadDiscuss Here]
Well today has brought a few very interesting reads about spam\phish. One on how it's not going away, one about a new start up that wants to charge for access to your email account and another about a phishing group which may be responsible for nearly one third of all phish messages sent. Read and Discuss Here
MS has readied a few critical updates for the month of December, go and get yours!! See Here
Phishers use machine gun method to hit-and-run victims with record number of spoofed domains. Read and Discuss Here
Prompted by a comment on her blog by a Patchou troll, Sandi Hardmeier, noted MS MVP gives Mess Plus! another scathing review.
Read and Discuss Here
Well it was yet another Paperghost\Zango bust fest. PG finds a profile on MySpace using an exploit which leads to a Zango site pushing Zango content vids. And of course you need to view the vids with the ever present Zango crapware. This stuff is almost as bad as the
codecs I wrote about last week. Read and Discuss Here
This week was my first article to appear in the Dave's Computing Tips newsletter. Check The Forum
And we broke the record for the most ever users online too. Read and Discuss
Well Paperghost and the team at SpywareGuide have stumbled upon a scam on MySpace to infect users with a variant of Zlob\SmithFraud. Nice. MySpace users beware of any profiles wanting you to download anything to view something. Read and Discuss Here
Two great anti-spyware legends, Ben Edelman and Eric Howes team up to show proof that Zango has not lived up to their recent agreement with the FTC. Go figure.
And to think Zango has always been so candid and honest in all their other dealings when caught using less than ethical tactics. NOT!!
We have a couple of interesting threads in the forum. One about the latest trend by malware authors to get users to malware sites. Look for this to take off.
Another shows a Flickr slide show put together by Sunbelt Software of all the fake security warnings generated by a ton of rogue anti-spyware apps. Read more about both the aforementioned in the Countermeasures News Forum
Over in the Phishing and Spam Forum forum see what could happen when you open an E-Card and it's packed full of nasties.
Well this time the target of Mr. Buttwipe is yet another security tool, created by an MS MVP. And of course he got caught due to his own stupidity.
Gotta love it when morons try to take credit for something and screw up. Read More Here
It seems the Gromozon authors are a little annoyed at the good folks over at Prevx. They have now coded their Gromozon malware with a false claim that the developers at Prevx, are the authors of the infectious code, instead of the ones who have created a tool to remove it. Read More Here
Some new items in the Countermeasures forum today:
The FTC has finally gotten those scumbags at Zango\180Solutions to 'admit' they are lowlife scumbags, and used less than ethical means of delivering their software. Of course paying 3 million dollars and stopping delivery of the software, in their eyes is no admission of guilt, now is it?? ROCK ON FTC!! Read More Here
BillP, creator of WinPatrol has decided to offer his users, or any users for that matter a trial version of their PLUS version. This is an excellent time to see just how well the program works and for a one time fee, you can't beat it. Read More Here
Well this past weekend I got my test box in a heap 'o trouble! In a very small amount of time, less than five minutes, about maybe three, my system got decimated and a reformat was the only option.
Keep your systems patched, security defense installed and do your best to keep on safe sites kids, it's a nasty place out there on the Net.
Read More Here
In my previous blog about IE7 I pointed to info indicating that users who had to for whatever reason make a repair to XP would wind up with a broken IE.
It turns out, that this has allegedly been fixed in the IE7 FR version. My source, another MS MVP had been informed of the fix but due to NDA restrictions I can not share any 'official' info about it. But the IE team still recommends users uninstall IE7 before making any repairs.
And that leaves me to think that perhaps it's not quite repaired. At the very least the KB article should be updated.
Well it would seem that if you were one of the 3 million plus users who installed IE7, you better hope you don't have to repair XP. If you do and don't uninstall IE7 first, boy are you in for a surprise! How the hell did they overlook this? Read More Here
There have been several new variants added to some of the more pervasive infections in recent weeks. And a new international player is in the mix as well. SmithFraud, Vundo, HackerDefender and Chinese infections...OH MY!! Read More Here
Final release for IE 7 from Microsoft available.
Read More Here
Fake IE DL site being spread. Installs trojan instead.
Read More Here
Well it seems my hosting company is yet again having problems with forum access.
Apologies to all, guess I'll be looking for a new hosting company come 2007. This is getting ridiculous.
It seems there is some new malware out that is corrupting legit files. Users who scan with Ewido may be presented with findings which appear to be false\positives, but they are not. Read More Here
Microsoft released a record number of patches today, 26 to be exact. But it appears that with so many being released, that Windows Update sites are not delivering everything. So be patient, and go back later in the day or the next. Read More Here
Adware pusher MVP Award revoked after MS confirms connection to LOP. Read More Here
Two new infection files found by Bleeping computer:
C:\WINDOWS\System32\tazth.dll
C:\WINDOWS\system32\dpfwu.dll
C:\WINDOWS\System32\ficqv.dll
Read More Here
Sorry to say my hosting company is still having troubles with my domain. I apologize for these problems and hope they can fix things on their end.
Access is still sporadic to both forum and site.
Well in all their infinite wonder, Microsoft has elected to award a well known adware pusher to join the ranks of their MS MVP Awardees. Yeah, that's right, a guy who makes a program which installs LOP if the user isn't very careful what he's installing. Read More Here
UPDATED w\Screen shot and file info
Latest SmithFraud infection making the rounds. It places a huge alert saying your infected, which cannot be resized or moved and is on top of all open applications.
So far Ewido finds it as SpySheriff, Ad-Aaware SE finds it as SpywareNo & AdwareSheriff. Spybot S&D does not detect it at all. Read More Here
BillP, developer of WinPatrol has a new build he'd like users to try. It is in beta phase and users should exercise caution if they are not used to the pitfalls of beta software. Read More Here
Well nothing to talk about. No word from my hosting company since last nite.
Both site and forum are up, tho I'm not sure how consistent it's going to be. I still cant publish or update the main site tho.
Well it seems my hosting company has been experiencing some glitches in their hardware\software in the last week. Well, actually more like the last 6 weeks give or take, off and on, mostly with the forum access tho.
At first I was unable to publish the main site, but the forums were there, tho sometimes sporadiclly. Now, as a result of trying some things they recommended I try in my C-Panel, both the site and forums are now offline.
Needless to say this is very frustrating and they have told me that they are working with the vendors to try and resolve the issue.
I'll keep posting updates here as things progress.
Sorry for any inconveniences this is causing any of you. With a little luck they will get things fixed quickly.
Tom\TeMerc
New variants of VirusBurst have yet again reared an ugly head. The two latest files:
C:\Windows\System32\httge.dll
C:\Windows\System32\ggagksr.dll
Read More Here
I found the latest from the gang at SurfSideKick while VML trolling. The relationship is noticeable in more than one way. Bleeping Computing have a nice write up here and compares file names and paths.
You can read about what my experience with was here in our forums
UPDATE 2: Forums will have sporadic access until posted here as of 1030AM MST
UPDATED: Forum is now up as of 9:45AM MST
The forums are down due to some hosting maintenance. In the mean time, why don't you check out whats on the the main site. Seems like a perfect opportunity, doesn't it?
From there you can check out a bunch of my favorite blogs or some of the newsletters I link to.
MS releases out of cycle patch for most recent VML IE exploit. Read More Here
IE exploit begins to stretch its legs as more reports come in about entire servers being hacked and more users getting infected. MS responds that they may just even patch out of cycle and then there is a third party patch out too. Read More Here
Another variant was found this week to be added into the removal tools for those infected with SmithFraud\Zlob infections. These guys try hard, but the anti-malware gang stays pretty much on top of these, not likely users will get so heavily infected with this one. Read More Here
Seems some spammers are finally doing what I thought was a regular thing, collecting email addresses via chain letters or jokes. One of my pet peeves is the ridiculous amount of email sent with 150 email addresses in the header. And it usually seems to be that AOL dipshits are the worst offenders. Read More Here
The people behind StopBadware.org seem to have a connection to FunWeb Products. I happened across this while reading the latest from BillP, Bits From Bill whom for those not in the know, is the developer behind WinPatrol.
While investigating the description of an application in the WinPatrol PLUS database he found that one of the board members of the company behind FunWeb, IAC Interactive is also behind the Berkeley
Center For Internet & Society at Harvard Law School. And they just happen to be the primary backers of StopBadware.org.
Interesting to say the least. FunWeb's rep is less than stellar, tho not nearly as bad as other adware bundled types of apps.
Read More Here
The other day I mentioned that a lawsuit against Zango had been dismissed. Sad news all around, except for the asshats at Zango. They proclaimed:
"We have maintained from its inception that this case had no merit. The dismissal vindicates that position," said Ken McGraw, Zango's general counsel in the statement. "[This] serves to confirm that Zango's desktop advertising software is not spyware in any shape or form and that our business model is entirely legitimate," he added.
But the truth of the matter was, the lawyers for the plaintiffs requested the suit be dropped!! Yeah thats right. The merits of the case itself were not in question, but rather the case could not stand up to the qualifications to become a class-action lawsuit. The lawyers at The Collins Law Firm are anxious to talk to any other litigants to move forward and begin action again.
This person has for the last year or so has been laying claim to several pieces of software which are used to fight malware. To just name a few:
SmithRem-Used against many of the SmithFraud\Zlob infections.
NailFix- Used against Aurora\Nail infections.
RogueFix- Used against some variants of SmithFraud
There are others as well. Some of these people he has allegedly ripped off are Microsoft MVPs.
When confronted he slanders his accusers, calls them vile names and is overall not someone who you would trust. He changes his Whois info and tries to hide his identity. He even began to offer help to users via email to avoid any detection by the security community.
Some of the originators of these scripts are contemplating legal action. But we all know how well that works on the Net.
The only other recourse is to try and shame him into doing the right thing. But based on comments found via a Google search for pcbutts it's an unlikely thing he will because it appears the right thing just isn't in his genetic make up.
But you can do the right thing, by spreading the word about this person. You can also do your part by complaining to the ISP hosting his site at:
BillP lets all users of WinPatrol access PLUS Info for September.
The group over at Prevx have made a stand alone removal tool for this nasty bit of work. You can find it at here at Prevx
.jpg)
