Microsoft has announce extended support for Windows XP and Windows Media Center Edition. This is good news for most of those users. As it is, the over all consensus has been that most will wait a while before upgrading to Vista. I don't see this as a good sales bolstering move. [Read\Discuss]
This one is a password stealer so users need to verify before clicking links and always pay attention to re-directs to log in pages. Always click your original saved bookmark to get back to the correct page. Never trust re-direct links which require you to 're-log in'.
[Read\Discuss]
This latest email nasty has many variants with multiple titles and has changed its over all theme from news to romance. Be sure you don't answer any emails from unknown sources and have your av up to date. [Read\Discuss]
BillP, creator of WinPatrol has just announced WinPatrol 2007 Beta. And it has a kewl new feature: 'Delayed Start'.
[Read Discuss Here]
Well it seems a mystery has begun. The cached post of Mr.ButtWipe where he called me a troll has reappeared in his blog archive. Interesting isn't? I'm sure he'll attribute that to some sort of blog glitch or something.
Another thing occurred too. Two of the names he mentioned as 'good guy' MS MVPs cannot be found on the public awardees site. There is tho one of them who is actually an MVP. It will be interesting when he is contacted about Mr.ButtWipe dropping his name and declaring him a 'good guy MS MVP'. I'm sure that he will be sure to add that amazing acknowledgement of being considered as a good guy MS MVP. I know I'd run and add it to my profile.
Speaking of my profile, you can see it off over there, to the right. Is there any such link on Mr.ButtWipes blog? Or any of his sites? I don't think so.
Well Brian, I suppose I also ought to give your name a search for in the MVP profiles, and see if it pops up, eh? Does Diane know you're up to no good? I can't imagine she would approve. Unless of course she is your female alter ego. Much along the lines of all the users who post in your defense.
[Read Discuss Here]
Well PCButts is making a saddened attempt to discredit me. He says I'm a troll because I am trying to get him to come out from behind the relatively appropriate handle of PCButts1. Of course we all know him more to be PCButtWipe1.
Why? Because in my opinion he is a lying, lowlife scumbag Internet softwaret thief. He even wrote a post about me back in December, but saw better to remove it, but I have a Google cache of the post. [Read Discuss]
Well it looks like the scumbags over at Zango are at it again. Teen porn is their new frontier. This is one heck of a way to start off the New Year. [Read Discuss Here]
Thanks to some info from the Sunbelt blog, this website, which was recently sold for $500,000 has an app associated with it that is less than dependable to say the least, SpywareBot.
Need to purchase to remove 3 mild registry entries, and over look dozens of malware files stored in a regular folder. Can you say 'scam'? Sure ya can, say it with me now.......[Read | Discuss Here]
Scam sites have been on the upswing as of late, so I decided to make a sticky thread just to deal with them. They include sites that try to trick users into downloading some sort of POS anti-spyware (rogues)along with sites that try to goad users into downloading a codec file to view a particular video clip. Nine times out of ten, the user gets infected with Zlob\SmithFraud infections or goodness knows what else is lurking. [Read Discuss Here]
Three new anti-spyware rogues and two more fake codec sites appear for the week, guess the malware scumbags were busy getting ready for a holiday push. [Read|Discuss Here]
PCButts, Internet thief, liar and overall scumbag has now laid claim that he is an MS MVP. On the SiteAdvisor review page he claims he is and has been for 4 years. I think not. [ReadDiscuss Here]
Well today has brought a few very interesting reads about spam\phish. One on how it's not going away, one about a new start up that wants to charge for access to your email account and another about a phishing group which may be responsible for nearly one third of all phish messages sent. Read and Discuss Here
MS has readied a few critical updates for the month of December, go and get yours!! See Here
Phishers use machine gun method to hit-and-run victims with record number of spoofed domains. Read and Discuss Here
Prompted by a comment on her blog by a Patchou troll, Sandi Hardmeier, noted MS MVP gives Mess Plus! another scathing review.
Read and Discuss Here
Well it was yet another Paperghost\Zango bust fest. PG finds a profile on MySpace using an exploit which leads to a Zango site pushing Zango content vids. And of course you need to view the vids with the ever present Zango crapware. This stuff is almost as bad as the
codecs I wrote about last week. Read and Discuss Here
This week was my first article to appear in the Dave's Computing Tips newsletter. Check The Forum
And we broke the record for the most ever users online too. Read and Discuss
Well Paperghost and the team at SpywareGuide have stumbled upon a scam on MySpace to infect users with a variant of Zlob\SmithFraud. Nice. MySpace users beware of any profiles wanting you to download anything to view something. Read and Discuss Here
Two great anti-spyware legends, Ben Edelman and Eric Howes team up to show proof that Zango has not lived up to their recent agreement with the FTC. Go figure.
And to think Zango has always been so candid and honest in all their other dealings when caught using less than ethical tactics. NOT!!
We have a couple of interesting threads in the forum. One about the latest trend by malware authors to get users to malware sites. Look for this to take off.
Another shows a Flickr slide show put together by Sunbelt Software of all the fake security warnings generated by a ton of rogue anti-spyware apps. Read more about both the aforementioned in the Countermeasures News Forum
Over in the Phishing and Spam Forum forum see what could happen when you open an E-Card and it's packed full of nasties.
Well this time the target of Mr. Buttwipe is yet another security tool, created by an MS MVP. And of course he got caught due to his own stupidity.
Gotta love it when morons try to take credit for something and screw up. Read More Here
It seems the Gromozon authors are a little annoyed at the good folks over at Prevx. They have now coded their Gromozon malware with a false claim that the developers at Prevx, are the authors of the infectious code, instead of the ones who have created a tool to remove it. Read More Here
Some new items in the Countermeasures forum today:
The FTC has finally gotten those scumbags at Zango\180Solutions to 'admit' they are lowlife scumbags, and used less than ethical means of delivering their software. Of course paying 3 million dollars and stopping delivery of the software, in their eyes is no admission of guilt, now is it?? ROCK ON FTC!! Read More Here
BillP, creator of WinPatrol has decided to offer his users, or any users for that matter a trial version of their PLUS version. This is an excellent time to see just how well the program works and for a one time fee, you can't beat it. Read More Here
Well this past weekend I got my test box in a heap 'o trouble! In a very small amount of time, less than five minutes, about maybe three, my system got decimated and a reformat was the only option.
Keep your systems patched, security defense installed and do your best to keep on safe sites kids, it's a nasty place out there on the Net.
Read More Here
In my previous blog about IE7 I pointed to info indicating that users who had to for whatever reason make a repair to XP would wind up with a broken IE.
It turns out, that this has allegedly been fixed in the IE7 FR version. My source, another MS MVP had been informed of the fix but due to NDA restrictions I can not share any 'official' info about it. But the IE team still recommends users uninstall IE7 before making any repairs.
And that leaves me to think that perhaps it's not quite repaired. At the very least the KB article should be updated.
Well it would seem that if you were one of the 3 million plus users who installed IE7, you better hope you don't have to repair XP. If you do and don't uninstall IE7 first, boy are you in for a surprise! How the hell did they overlook this? Read More Here
There have been several new variants added to some of the more pervasive infections in recent weeks. And a new international player is in the mix as well. SmithFraud, Vundo, HackerDefender and Chinese infections...OH MY!! Read More Here
Final release for IE 7 from Microsoft available.
Read More Here
Fake IE DL site being spread. Installs trojan instead.
Read More Here
Well it seems my hosting company is yet again having problems with forum access.
Apologies to all, guess I'll be looking for a new hosting company come 2007. This is getting ridiculous.
It seems there is some new malware out that is corrupting legit files. Users who scan with Ewido may be presented with findings which appear to be false\positives, but they are not. Read More Here
Microsoft released a record number of patches today, 26 to be exact. But it appears that with so many being released, that Windows Update sites are not delivering everything. So be patient, and go back later in the day or the next. Read More Here
Adware pusher MVP Award revoked after MS confirms connection to LOP. Read More Here
Two new infection files found by Bleeping computer:
C:\WINDOWS\System32\tazth.dll
C:\WINDOWS\system32\dpfwu.dll
C:\WINDOWS\System32\ficqv.dll
Read More Here
Sorry to say my hosting company is still having troubles with my domain. I apologize for these problems and hope they can fix things on their end.
Access is still sporadic to both forum and site.
Well in all their infinite wonder, Microsoft has elected to award a well known adware pusher to join the ranks of their MS MVP Awardees. Yeah, that's right, a guy who makes a program which installs LOP if the user isn't very careful what he's installing. Read More Here
UPDATED w\Screen shot and file info
Latest SmithFraud infection making the rounds. It places a huge alert saying your infected, which cannot be resized or moved and is on top of all open applications.
So far Ewido finds it as SpySheriff, Ad-Aaware SE finds it as SpywareNo & AdwareSheriff. Spybot S&D does not detect it at all. Read More Here
BillP, developer of WinPatrol has a new build he'd like users to try. It is in beta phase and users should exercise caution if they are not used to the pitfalls of beta software. Read More Here
Well nothing to talk about. No word from my hosting company since last nite.
Both site and forum are up, tho I'm not sure how consistent it's going to be. I still cant publish or update the main site tho.
Well it seems my hosting company has been experiencing some glitches in their hardware\software in the last week. Well, actually more like the last 6 weeks give or take, off and on, mostly with the forum access tho.
At first I was unable to publish the main site, but the forums were there, tho sometimes sporadiclly. Now, as a result of trying some things they recommended I try in my C-Panel, both the site and forums are now offline.
Needless to say this is very frustrating and they have told me that they are working with the vendors to try and resolve the issue.
I'll keep posting updates here as things progress.
Sorry for any inconveniences this is causing any of you. With a little luck they will get things fixed quickly.
Tom\TeMerc
New variants of VirusBurst have yet again reared an ugly head. The two latest files:
C:\Windows\System32\httge.dll
C:\Windows\System32\ggagksr.dll
Read More Here
I found the latest from the gang at SurfSideKick while VML trolling. The relationship is noticeable in more than one way. Bleeping Computing have a nice write up here and compares file names and paths.
You can read about what my experience with was here in our forums
UPDATE 2: Forums will have sporadic access until posted here as of 1030AM MST
UPDATED: Forum is now up as of 9:45AM MST
The forums are down due to some hosting maintenance. In the mean time, why don't you check out whats on the the main site. Seems like a perfect opportunity, doesn't it?
From there you can check out a bunch of my favorite blogs or some of the newsletters I link to.
MS releases out of cycle patch for most recent VML IE exploit. Read More Here
IE exploit begins to stretch its legs as more reports come in about entire servers being hacked and more users getting infected. MS responds that they may just even patch out of cycle and then there is a third party patch out too. Read More Here
Another variant was found this week to be added into the removal tools for those infected with SmithFraud\Zlob infections. These guys try hard, but the anti-malware gang stays pretty much on top of these, not likely users will get so heavily infected with this one. Read More Here
Seems some spammers are finally doing what I thought was a regular thing, collecting email addresses via chain letters or jokes. One of my pet peeves is the ridiculous amount of email sent with 150 email addresses in the header. And it usually seems to be that AOL dipshits are the worst offenders. Read More Here
The people behind StopBadware.org seem to have a connection to FunWeb Products. I happened across this while reading the latest from BillP, Bits From Bill whom for those not in the know, is the developer behind WinPatrol.
While investigating the description of an application in the WinPatrol PLUS database he found that one of the board members of the company behind FunWeb, IAC Interactive is also behind the Berkeley
Center For Internet & Society at Harvard Law School. And they just happen to be the primary backers of StopBadware.org.
Interesting to say the least. FunWeb's rep is less than stellar, tho not nearly as bad as other adware bundled types of apps.
Read More Here
The other day I mentioned that a lawsuit against Zango had been dismissed. Sad news all around, except for the asshats at Zango. They proclaimed:
"We have maintained from its inception that this case had no merit. The dismissal vindicates that position," said Ken McGraw, Zango's general counsel in the statement. "[This] serves to confirm that Zango's desktop advertising software is not spyware in any shape or form and that our business model is entirely legitimate," he added.
But the truth of the matter was, the lawyers for the plaintiffs requested the suit be dropped!! Yeah thats right. The merits of the case itself were not in question, but rather the case could not stand up to the qualifications to become a class-action lawsuit. The lawyers at The Collins Law Firm are anxious to talk to any other litigants to move forward and begin action again.
This person has for the last year or so has been laying claim to several pieces of software which are used to fight malware. To just name a few:
SmithRem-Used against many of the SmithFraud\Zlob infections.
NailFix- Used against Aurora\Nail infections.
RogueFix- Used against some variants of SmithFraud
There are others as well. Some of these people he has allegedly ripped off are Microsoft MVPs.
When confronted he slanders his accusers, calls them vile names and is overall not someone who you would trust. He changes his Whois info and tries to hide his identity. He even began to offer help to users via email to avoid any detection by the security community.
Some of the originators of these scripts are contemplating legal action. But we all know how well that works on the Net.
The only other recourse is to try and shame him into doing the right thing. But based on comments found via a Google search for pcbutts it's an unlikely thing he will because it appears the right thing just isn't in his genetic make up.
But you can do the right thing, by spreading the word about this person. You can also do your part by complaining to the ISP hosting his site at:
BillP lets all users of WinPatrol access PLUS Info for September.
The group over at Prevx have made a stand alone removal tool for this nasty bit of work. You can find it at here at Prevx
The latest rogue makes no obvious effort to appear to be much different than many of the other rogues. We need to be thankful these guys have a limited resource in their imaginations. Read More Here
It would seem that McAfee SiteAdvisor has developed a bit of a hiccup with it's ratings system, or, perhaps their crawler has a bug in it.
Many of the well known anti-malware forums have been red-flagged in the last few days. Sites like Tom Coyote, CEXX and Ad-Aware Support forum.
These are obvious mistakes in the system somewhere. The SiteAdvisor group has been made aware of these mistakes and are taking action to correct them. It just won't be as fast as we would like.
I am rated as an 'Experienced Reviewer' and as such, my comments carry a little bit of weight in the ratings of sites. If you're aware of a site which needs some corrective commentary, be they good sites flagged as bad or visa versa, let me know and I'll work my mojo magic on them.
UPDATE: SiteAdvisor is attempting to whitelist these types of security forums and correct the problem.
Malware writers have out done themselves with this one. Variable DLs, dependant on browser. Hourly changes of said files from DL sites.
Rootkit detection tools don't detect in many cases. Fried test machines when researchers attempt analysis.
Oh and did I say there isn't really any fix for it yet? Well there is one, but it's not for the faint of heart or the technically challenged either.
Read More Here
The scumbags at Direct Revenue get off lightly as a suit brought by the state of California gives very little if any real punishment.
That's truly a major disappointment. These lowlifes needed to be crushed. Read More Here
Yet another SmithFraud\Zlob variant has hit the streets.
They call this one VirusRescue. But rest assured the only thing that will be needing rescuing will be your sanity as you come to find, after being duped into purchasing this POS that your system is running ragged and you have al sorts of pop ups.
And the scumbags who created this thing then tried to post into a fellow security advisor's forum and defend the app.
Mistake. BIG mistake. HUGE even.
Then people like PG and Moore from Bluetack get their engines revved up and carnage ensues. Not to mention the kick ass reply from Security Cadets. But it's the good kind of carnage, the kind where the bad guys get their asses whooped.
Well it's been a few weeks and I have neglected this blog, sorry about that, here are some quick links to get you caught up.
New Zlob\SmithFraud Variant: VirusRescue
August Patch Causing IE Crashes
Webroot State Of Spyware Report
Another Zango-Porn Connection?
CDT Report On Affiliate Adware Game
Well it seems an article posted on digg incorrectly stated some facts in the relationship with Zango and porn. As it turns out (if you followed this, you're aware), Zango was not distributing porn but their association with YapBrowser certainly didn't help matters. Paperghost gives the lowdown on the facts.
Well hot on the heels of Zango being exposed for advising affiliates on how to insert their software onto MySpace, comes great news!!
Warner Bros. is dumping Zango as an adware vendor!!
Got a few things happening last day or so:
Bots Invade MySpace
F-Secure Finds Exploits At Social Engineering Sites
Zango once again gets capped in another drive-by 'zealot' attack. At least they would lead you to believe it's some sort of vendetta.
Anyone with half a brain could see right through all their excuses and double speak. Read More Here
BillP continues to improve upon Scotty's abilities to ensure users are safe, offering another version with some bug fixes and a requested feature. Read More Here
Well it seems that once again, Zango, our favorite provider of adware found in some amazingly perverse content, has been exposed by Paperghost.
They really should just add him to the payroll, he does more to regulate their affiliates that the guy who is supposed to be doing it for them. Read More Here
Looks like this app is one in the same as the others in the SmithFraud family. Panda claims to have found it. Read More Here
Still yet another case of an adware company using MySpace to spread its bundles of 'joy'. This is the second company in two weeks caught doing this. Lets hope MySpace gets on the ball and tries to do something about it. Until then, MySpace users beware.
Well after getting some negative press back in May, the newly formed but still-doing-business-as-usual 180Solutions-cum Zango is once again duping users on MySpace.
See, you really can't change the spots on a leopard. Or is that the stripes on a zebra? Regardless, read more here
This rogue is very new and so far no users have claimed to be infected by it, but give it time, they will begin to popup by weekends end I'm sure. I even took the time to add a comment as a reviewer of the app for SiteAdvisor. Read More Here
Several specialty tools were updated today with new
variants and better scanning and fixing:
I am returning to a forum where I originally began my interest in helping others remove malware. They had been over run with spammers and all but abandoned. CEXX forums is now undergoing a revival. Read More Here
Malware writers craft fake files imitating MS WGA to trick users and load a bundle of junk wares. MS MVPs are franticly gathering info to spread the word and submitting files to malware vendors to be added to databases. Read More Here
WinPatrol keeps on improving and delivering one of the best system monitoring applications on the Net. PLUS users get even greater control over any system changes and can find out when files were created, monitor hidden files and more!! Read More Here
Latest rogue shows not much in way of creativity, just claims that it destroys spyware but with it's affiliation with known bundlers of malware, it's highly unlike to do much of anything useful.
Read More Here
The latest variant sometimes carries a rootkit in it, but the tool seems to catch the ones that do not. This new variant also hides when using HijackThis, so users need to rename the tool to trick the malware. Read More Here
Lots of talk about the latest from MS, their Windows Genuine Advantage and its notification tool. Most of the talk is about how to disable the notification tool.
We have a couple of threads in the forum, one here that talks about the many ways to do just that. And another one here which has links relating to the implementation of the tool over all. Don't forget to take the poll in the second link.
Related links:
How Windows Product Activation Works
I have a new thread in the forums dedicated to specific infections and fixes for those infections. Users should use caution when applying these fixes and take note that machines may still have other infections after the specific fix is used. Read More Here
Webhelper's site has been under attack since the 16 of June by DollarRevenue. It seems that after being blogged about here and here they got a little pissed off and decided to attack him!! Read More Here
Three new variants of SpywareQuake were found the last 24-36 hours. And both SmithFraudFix and SmithRem have been updated and deal with all three, including BHOs and CLSIDs. Way to go guys!!
New files:
oybgrql.dll
yvvdj.dll
xuefh.dll
SmithFraud Updates in forum.
Two SmithFraud variants found recently, fix tools updated and working so well that this infection has come down to running two steps to remove it.
Kudos to the experts who craft these tools to fight off the scumbags who create them. New variants have been found almost on a weekly basis and the tools are updated within 24 hours in most cases. Read more about SmithFraud Infection Family Here
A new rogue has been uncovered in the last 24 hours or so: Titan Shield. It is part of the SmithFraud rogue family and many of it's files have already been added for removal by the SmithFraudFix tool by Siri
New version sneak peek of WinPatrol for PLUS users only, some neat new features, a must have for all. Read More Here
Noahadfear, noted MS MVP has returned to the malware fight and updated his SmithRem tool. Read More Here
Well it seems my hosting company is having some troubles with our IP blocks 'not being announced to our upstream providers'. Read More Here
Sorry for any inconveniences, hopefully we will be back
up soon.
Still yet another new SmithFraud variant found: C:\WINDOWS\system32\higjxe.dll"<<<<---new
file
C:\WINDOWS\system32\hvnwm.dll"<<<<---new
file
Another variant found, Siri SmithFraudFix updated:
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{f5947202-e9cb-4a72-88e7-22f2cbd2b124}"="chenopodiaceae"
[HKEY_CLASSES_ROOT\CLSID\{f5947202-e9cb-4a72-88e7-22f2cbd2b124}\InProcServer32]
@="C:\WINDOWS\System32\bolnyz.dll" <<<<---new file
[HKEY_CURRENT_USER\Software\Classes\CLSID\{f5947202-e9cb-4a72-88e7-22f2cbd2b124}\InProcServer32]
@="C:\WINDOWS\System32\bolnyz.dll"
PG finds yet another instance of a rogue 180Delusions affiliates. But this time they are distributing the software via a botnet!! When will the madness end? Read More Here
IM malware installs its own browser without consent. Crazy style of infection plays music too! Read More Here
Well it seems that the scum over at 180Solutions have figured a way to nestle their crapware into MySpace.
It's amazing that the most notoriously infamous adware pushing company can get their stuff added to so many huge sites.
How is it that the people who approve these deals don't know about them? Maybe there is a stronger element behind it? Maybe the VC groups that back these scumbags at 180 have connections far beyond the basic hallways and inner circles of affiliate worlds.
How else could you explain it? Read More Here
Browser dependant malware payloads give users tailored infections. Read More Here
Warner Bros today announced a partnership with 180Solutions. Yes, that's right, the people who have brought you all sorts of wonderful entertainment have joined forces with the people who have brought you all sorts of......adware, popups, unethical installs, excuses and in another case, even child porn, via the wonderful world of their affiliates. Read some about it here in the forums.
Before you send Mom that e-card, you better read about what else she may get along with the pleasant sentiments....some not to pleasant malware. Read More Here
FTC has fined one anti-spyware rogue $4Million dollars and barred another from collecting users info. Read More Here
My good friend Wayne Porter of SpywareGuide, FaceTime and ReveNews has a new product he is touting, an EULA Analyzer. While this is not necessarily a new idea, I'm certain it will be tic above any other analyzers currently available. Read more about it here in our forum.
.jpg)
