CounterSpy 2.5 Update 637

CounterSpy 2.5 latest update definition is 637

CounterSpy is able to catch more spyware than almost every other utility on the market because the CounterSpy threat database (with the signatures of every spyware and malware utility we can identify) is constantly updated. Our researchers constantly look for ways to improve our spyware searching database so that it catches all spyware that could potentially be on your system. Keyloggers, spyware cookies, remote access trojans (backdoors), and more are all identified.

http://research.sunbelt-software.com/download.cfm

CounterSpy offers a 15 day fully functional trial. So that means you can not only test how it detects spyware, but how well it removes spyware, malware, and other threats.

Here is a partial list of selected threats in this update. For a full list of the updates, see Spyware Definitions on the Sunbelt site.

This uppdate has many updates, but mostly with names like trojan dropper and password stealer. I did find this one's name interesting: Zenotecnico. Also know as Adware.ZenoSearch, Adware.Zenosearch.B.

Winfixer, SpySheriff, AdwareSpy and the ubiquitous Storm Worm get updated definitions as well.

AOL Sweeps Aside Winfixer Ads

Looks like The higher ups at AOL finally got the news that some of the banner ads were dealing out spyware and removed them. Sandi reports at Spyware Sucks that the affiliate who was infecting the banner ads on Aol.com web pages, has been tracked down and removed. There's also some thoughts and comparisons to how Microsoft handled a similar situation on their site.

AOL Ignoring Winfixer Problem

I reported recently how Winfixer had infiltrated MSN's advertising network. Microsoft acted swiftly to these reports and stomped on the problem quick smart.

AOL are having the same problem, but unlike Microsoft, don't seem to be doing anything about it. I really can't understand this, I would have thought that a big company like AOL would have been on this before the ink had time to dry on the notification email.

See SpywareSucks for all the info

http://msmvps.com/blogs/spywaresucks/archive/2007/03/21/697330.aspx
http://msmvps.com/blogs/spywaresucks/archive/2007/03/22/701346.aspx
http://msmvps.com/blogs/spywaresucks/archive/2007/03/24/704666.aspx

and this is the latest from Sandi... check it out

http://msmvps.com/blogs/spywaresucks/archive/2007/03/26/711000.aspx

Update

It looks like Sandi has managed to get AOL to sit up and take notice after all......... go girl!! Latest from SpywareSucks

AOL Has Winfixer Trojan On It's Website

A few days ago, fellow MVP Sandi Hardmeier reported that Winfixer was being installed from some of the advertising on Aol.com web pages. You can see on her Gotcha! Winfixer and Aol post all of the details. In short, Aol has advertising banners that show many ads. One of them will load from errorsafe.com and then attempt to trick you into installing System Doctor. A few screen shots can be seen here. The whole thing is a scam to trick people into buying the program. AOL needs to remove these ads immediately. By allowing them to stay, AOL is allowing people's computers to get infected with spyware and letting the spyware creators make money.

Winfixer is one of many names the rogue program goes by. There are different versions that use different names. Some of them are: System Doctor, WinAntiVirus, ErrorSafe and DriveCleaner. They aren't fake antispyware programs, but they claim to find problems with Windows, kind of like registry cleaners. The problems reported by one of these programs aren't real. They are used to trick you into buying the program. You will also get pop ups and other unwanted reminders to buy the program. Sunbelt CounterSpy targets these programs under ErrorSafe. Antivirus programs detect Winfixer as well. Symantic and McAfee have detailed web pages that describe this threat as well.

AOL needs to take action to protect their users immediately. While the Winfixer ads are infrequent, the large number of people who visit aol.com means that many people are being put at risk. Also, by hosting the ads for Winfixer, this means Aol is directly responsible for letting these spyware creators make money. Any delay in removing the Winfixer trojan from Aol is not acceptable.

Woman Gets Ripped Off By Winfixer, Sues Them To Get Money Back

Last September, Beatrice Ochoa paid for Winfixer to get rid of the spyware and pop ups. When Winfixer didn't help, she contacted their support. It was never available. When she started getting more advertisements from VipFares.com, enough was enough. Beatrice hired a lawyer and started a class action lawsuit.

Copy of a news story from KTVU Channel 2 posted at Youtube. I couldn't find a copy on the KTVU website. It's worth watching to see how the Winfixer crooks are making tens of thousands of dollars by putting malware on your computer.

Here's a link to the blog from the lawyer about the case. Here is a great write up of information at Spyware Sucks from a few days ago. It has links and instructions on how to find the case on the Santa Clara Superior Court website. You need to search for case 106CV072057 to check the status. There's also some info about Vipfares.com and Mark Cohen, who is one of the people sued by Beatrice's lawyer.

Windows Live Messenger Serves Up Winfixer and ErrorSafe

As reported by fellow MVP Sandi Hardmeier at Spyware Sucks (bookmark it), malware known as Winfixer or Errorsafe has been distributed via banner ads on MSN or Windows Live Messenger as it is now known. This has been reported to Microsoft who released the following statement.

"Microsoft was notified of malware that was being served through ads placed in Windows Live Messenger banners. As a result of this notification we immediately investigated the reports and removed the offending ads, as this is a violation of our ad serving policy. We can confirm that the ads are no longer being served by any Microsoft system. We apologize for the inconvenience and are reviewing our ad approval process to reduce the chance of an occurrence such as this happening again. To help customers protect their PCs from malware threats, Microsoft recommends customers follow our Protect your PC guidance at www.microsoft.com/protect." - Whitney Burk, Microsoft.

With internet advertising being the main source of revenue for a lot of sites these days, this sort of thing is becoming all to common. One of the best ways to protect yourself is to install a good hosts file which will block known bad sites.

Please make sure you read all of Sandi's report, as usual she has done a very thorough investigation and gives some sound advice about avoiding infection from rogue sites.