Slightly OT:Email Address Collection via Chain Mails

Seems some spammers are finally doing what I thought was a regular thing, collecting email addresses via chain letters or jokes. One of my pet peeves is the ridiculous amount of email sent with 150 email addresses in the header. And it usually seems to be that AOL dipshits are the worst offenders. Read More Here

StopBadware.org & FunWeb Products

The people behind StopBadware.org seem to have a connection to FunWeb Products. I happened across this while reading the latest from BillP, Bits From Bill whom for those not in the know, is the developer behind WinPatrol.

While investigating the description of an application in the WinPatrol PLUS database he found that one of the board members of the company behind FunWeb, IAC Interactive is also behind the Berkeley
Center For Internet & Society at Harvard Law School. And they just happen to be the primary backers of StopBadware.org.

Interesting to say the least. FunWeb's rep is less than stellar, tho not nearly as bad as other adware bundled types of apps.
Read More Here

Zango Dismissal: Requested by Plaintiffs

The other day I mentioned that a lawsuit against Zango had been dismissed. Sad news all around, except for the asshats at Zango. They proclaimed:

"We have maintained from its inception that this case had no merit. The dismissal vindicates that position," said Ken McGraw, Zango's general counsel in the statement. "[This] serves to confirm that Zango's desktop advertising software is not spyware in any shape or form and that our business model is entirely legitimate," he added.

But the truth of the matter was, the lawyers for the plaintiffs requested the suit be dropped!! Yeah thats right. The merits of the case itself were not in question, but rather the case could not stand up to the qualifications to become a class-action lawsuit. The lawyers at The Collins Law Firm are anxious to talk to any other litigants to move forward and begin action again.

Read More Here

PCBUTTS: Internet Software Thief?

This person has for the last year or so has been laying claim to several pieces of software which are used to fight malware. To just name a few:
SmithRem-Used against many of the SmithFraud\Zlob infections.

NailFix- Used against Aurora\Nail infections.

RogueFix- Used against some variants of SmithFraud

There are others as well. Some of these people he has allegedly ripped off are Microsoft MVPs.

When confronted he slanders his accusers, calls them vile names and is overall not someone who you would trust. He changes his Whois info and tries to hide his identity. He even began to offer help to users via email to avoid any detection by the security community.

Some of the originators of these scripts are contemplating legal action. But we all know how well that works on the Net.

The only other recourse is to try and shame him into doing the right thing. But based on comments found via a Google search for pcbutts it's an unlikely thing he will because it appears the right thing just isn't in his genetic make up.

But you can do the right thing, by spreading the word about this person. You can also do your part by complaining to the ISP hosting his site at:

Mr. Scott Knowles
Interland Shared Abuse Department Interland, Inc.
303 Peachtree Center Avenue, Suite 500
Atlanta, GA 30303
voice: 404-260-2477, opt 9 (ext 5260)
abuse@interland.com

Sites to seek assistance with your malware problems can be located in a collection of links located on the ASAP directory.

WinPatrol PLUS Info Free For September

BillP lets all users of WinPatrol access PLUS Info for September.

Read More Here

Gromozon Rootkit Removal Tool

The group over at Prevx have made a stand alone removal tool for this nasty bit of work. You can find it at here at Prevx

SmithFraud Rogue: VirusBurst

The latest rogue makes no obvious effort to appear to be much different than many of the other rogues. We need to be thankful these guys have a limited resource in their imaginations. Read More Here

SiteAdvisor Glitches

It would seem that McAfee SiteAdvisor has developed a bit of a hiccup with it's ratings system, or, perhaps their crawler has a bug in it.

Many of the well known anti-malware forums have been red-flagged in the last few days. Sites like Tom Coyote, CEXX and Ad-Aware Support forum.

These are obvious mistakes in the system somewhere. The SiteAdvisor group has been made aware of these mistakes and are taking action to correct them. It just won't be as fast as we would like.

I am rated as an 'Experienced Reviewer' and as such, my comments carry a little bit of weight in the ratings of sites. If you're aware of a site which needs some corrective commentary, be they good sites flagged as bad or visa versa, let me know and I'll work my mojo magic on them.

UPDATE: SiteAdvisor is attempting to whitelist these types of security forums and correct the problem.

Gromozon Rootkit: Mutha Of Rootkits

Malware writers have out done themselves with this one. Variable DLs, dependant on browser. Hourly changes of said files from DL sites.

Rootkit detection tools don't detect in many cases. Fried test machines when researchers attempt analysis.

Oh and did I say there isn't really any fix for it yet? Well there is one, but it's not for the faint of heart or the technically challenged either.
Read More Here

Dircect Revenue Scumbags Get Off Light

The scumbags at Direct Revenue get off lightly as a suit brought by the state of California gives very little if any real punishment.
That's truly a major disappointment. These lowlifes needed to be crushed. Read More Here

New SmithFraud\Zlob Variant: VirusRescue

Yet another SmithFraud\Zlob variant has hit the streets.

They call this one VirusRescue. But rest assured the only thing that will be needing rescuing will be your sanity as you come to find, after being duped into purchasing this POS that your system is running ragged and you have al sorts of pop ups.

And the scumbags who created this thing then tried to post into a fellow security advisor's forum and defend the app.

Mistake. BIG mistake. HUGE even.

Then people like PG and Moore from Bluetack get their engines revved up and carnage ensues. Not to mention the kick ass reply from Security Cadets. But it's the good kind of carnage, the kind where the bad guys get their asses whooped.

Read More Here

QuickLinks Updates

Well it's been a few weeks and I have neglected this blog, sorry about that, here are some quick links to get you caught up.

New Zlob\SmithFraud Variant: VirusRescue

August Patch Causing IE Crashes

Webroot State Of Spyware Report

Another Zango-Porn Connection?

CDT Report On Affiliate Adware Game

Zango Busted Advising MySpace Affiliates

Rogue\Suspect Anti-Spyware Updates

The Skinny On Warner Bros, Zango & Porn

Well it seems an article posted on digg incorrectly stated some facts in the relationship with Zango and porn. As it turns out (if you followed this, you're aware), Zango was not distributing porn but their association with YapBrowser certainly didn't help matters. Paperghost gives the lowdown on the facts.

Read More Here

Warner Bros. Drop Zango Over Porn

Well hot on the heels of Zango being exposed for advising affiliates on how to insert their software onto MySpace, comes great news!!

Warner Bros. is dumping Zango as an adware vendor!!

Read More Here

Zango:Busted Advising Affiliates On MySpace

Another chapter, this the latest in a series of amazing articles chronicling just how Zango pushes their software on MySpace.

But this time we have a confirmed, (by Zango)legit email to one of thier affiliates on how to proceed and suggestions on how much to pay and how to link to other Zango sites. Things like moving gifs because according to the email, 'people love that sh*t". And also mentioning adding in a karate guy doing flips, because it turns out that it's 'wayyyy more profitable'

Here is a snippet from the email:
"Zango is fairly new with MySpace sites and it took me some time to see what works and what doesn't." "Put one of our videos on to your MySpace profiles and all of your friends will see it" ...more profitably, *go to a bunch of your friends* who have popular profiles and pay them (it's up to you so much. One of my partners said 5$..maybe offer to split the money with them?) to put a Zango video into their profile through your site. This will give you hundreds of extra installs a day (this probably works even better than having them on your actual site).

So for all the posturing Zango has been doing you can only imagine how much this is going to twist the Zango PR guys shorts. And I bet he thought he was going to have the weekend off too.

Guess again scum, because if there is one thing we all know is that Paperghost never takes time off. And is always honing his killer moves against adware bad guys.

Full read w\links @ VitalSecurity

QuickLink Updates

Got a few things happening last day or so:
Bots Invade MySpace
F-Secure Finds Exploits At Social Engineering Sites

Recent Testbox Infestation & Clean Up

Zango Bait & Switch

Zango once again gets capped in another drive-by 'zealot' attack. At least they would lead you to believe it's some sort of vendetta.

Anyone with half a brain could see right through all their excuses and double speak. Read More Here

New Version WinPatrol v10.0.3 [July 21]

BillP continues to improve upon Scotty's abilities to ensure users are safe, offering another version with some bug fixes and a requested feature. Read More Here

Zango + Teen Site = Pr0n

Well it seems that once again, Zango, our favorite provider of adware found in some amazingly perverse content, has been exposed by Paperghost.

They really should just add him to the payroll, he does more to regulate their affiliates that the guy who is supposed to be doing it for them. Read More Here

New Rogue? ProtectionBar

Looks like this app is one in the same as the others in the SmithFraud family. Panda claims to have found it. Read More Here