Slashdot Mirror


Spyware Masquerading as Spyware Removal Software

Cocooner writes "News.com is reporting that some of the anti-spyware/adware software out there is doing more harm than good by acting as double agents. One example is a software package named SpyBan (google cache since the original site has been removed), which happened to be hosted by download.com, accused of installing Look2Me, which monitors and reports web surfing habits. SpyBan was downloaded over 44000 times before it was pulled. How 'low' can they go?"

5 of 424 comments (clear)

  1. spybot by grub · · Score: 5, Informative


    If you run a Windows system then I heartily recommend Spybot Seek & Destroy to keep it clean and immunized. Support the author too, donate a few bucks for good work.

    not related in any way, just a satisfied user

    --
    Trolling is a art,
  2. for anyone who doesn't know, use these tools by real_smiff · · Score: 5, Informative
    The spyware removal tools i use regularly & trust are:

    Spybot

    Ad-Aware

    There are others, but these pretty much have it covered i think.

    --

    This is my Sig, this is my Gun. One is for Slashdot and one is for Fun.

  3. More fake programs by Mr_Silver · · Score: 5, Informative
    I found a comment from this page very informative:
    Rogue Anti-spyware Programs Part 3

    I mentioned some of these before, but this is a more inclusive list.

    Spy Wiper
    AdWare Remover Gold
    BPS Spyware Remover
    Online PC-Fix SpyFerret
    SpyBan
    SpyBlast
    SpyGone
    SpyHunter
    SpyKiller
    SpyKiller Pro
    SpywareNuker
    TZ Spyware-Adware Remover
    xp-AntiSpy
    SpyAssault
    InternetAntiSpy
    Virtual Bouncer
    AdProtector
    SpyFerret
    SpyGone
    SpyAssault

    Sources: Doxdesk.com: parasite, Tom Coyote Forums, Spywareinfo.com forums, safernetworking.org, home of Spybot Search & Destroy

    Looks like this program isn't the only one.
    --
    Avantslash - View Slashdot cleanly on your mobile phone.
  4. Credit card scam by savagedome · · Score: 5, Informative

    This is similar to credit card scam that Bruce Schneier pointed out in his latest cryptogram. Fooling people into eating poison wrapped up as a remedy. Bastards.

    New Credit Card Scam

    This one is clever.

    You receive a telephone call from someone purporting to be from your credit card company. They claim to be from something like the security and fraud department, and question you about a fake purchase for some amount close to $500.

    When you say that the purchase wasn't yours, they tell you that they're tracking the fraudsters and that you will receive a credit. They tell you that the fraudsters are making fake purchases on cards for amounts just under $500, and that they're on the case.

    They know your account number. They know your name and address. They continue to spin the story, and eventually get you to reveal the three extra numbers on the back of your card.

    That's all they need. They then start charging your card for amounts just under $500. When you get your bill, you're unlikely to call the credit card company because you already know that they're on the case and that you'll receive a credit.

    It's a really clever social engineering attack. They have to hit a lot of cards fast and then disappear, because otherwise they can be tracked, but I bet they've made a lot of money so far.


  5. Re: SpyBot and additonal help.... by King_TJ · · Score: 5, Informative

    Yep! I've been praising SpyBot and recommending it to practically everyone running a PC on the Inet for months now. (As I said in a previous /. thread, I work doing on-site PC service, and this program, alone, cures more PC issues I run into than anything else we use.)

    I'll tell you another little tip, though. If SpyBot already claims it's cleaned everything up, but your PC is *still* spontaneously generating pop-up ads on the screen, or running abnormally slow (perhaps you still see odd processes listed as running in the process list?), here's the way to fix it.

    Run regedit, and search the entire registry for "run once". There are several "run once" registry keys, with plain old "run" keys directly above each of them. (You're mainly interested in what's in the "run" keys, but searching for "run" will find hundreds of things we're not interested in.) If they're starting up some kind of trojan horse or spyware/adware program on your Windows PC (and assuming it's not simply in the "Startup" program group!), they've got to be doing it in one of these "run" keys. Look for sneaky files in there with names like "windowsupdater.exe" (MS doesn't ever run a file by this name to do the real Windows updates), or just gibberish names like 0br003445l.exe and delete them from the "value" line of the "run" key. I've even seen files in there I wasn't sure about, until I looked in the folder under "Program Files" where it was running from; Then I saw a *documentation* file in the program's folder explaining that the utility was "designed to automatically present advertisements to the computer user at random intervals"!