Spy Sweeper Update 651

SpySweeper latest update.

Spyware definition: version 651

Updated April 6th, 2006
Protection against 134,399 spyware traces.


Spy Sweeper available from http://www.webroot.com/consumer/products/spysweeper/

New York State Sues Spyware Maker

New York State Attorney General Eliot Spitzer has filed suit against Direct Revenue. In the suit, the Attorney General is asking the Court to stop Direct Revenue from installing any more software and to stop software that is already installed from showing ads. In addition, the State is asking Direct Revenue to provide accounting of the money it has made. Official notice on the New York Attorney General's website is here.

Aurora is the most common name of the program that was installed on people's computers. The Aurora program was installed without notice or consent by 3rd party vendors. Once installed, many pop up ads appear selling anything from online gambling to adult oriented sites. Since having more installations means more money, many affiliates used any means they could to get Direct Revenue's program onto as many computers as possible. No notice was given when the program was bundled with other software. If notice was given, it was buried in a long license agreement that most people wouldn't notice. Direct Revenue was aware of these shady practices. Not only did they allow it, they attempted to silence critics. According to Eric Howes, Director of Malware Research at Sunbelt Software, there was even a case of Direct Revenue hiring a private investigator to intimidate one critic.

Also of interest is the fact that DR execs obsessively monitored anti-spyware web sites, organizations, and companies for any sign of criticism and were not shy about issuing legal threats and, in one case, hiring a private investigator to bully critics into silence.

This is not the first lawsuit against Direct Revenue. Last year, a class action lawsuit was filed in Chicago against them as well. A settlement was reached last month with Direct Revenue. Some of the settlement conditions include providing a 1-800 number where people can get uninstall instructions, clearly marking any promotions as advertisements, destroying any personal information collected, and refraining from collecting any personal information such as Social Security numbers in the future. Most importantly, the company will ensure that people are clearly agreeing to any software installs from them.

Between these two legal actions, at least one spyware vendor appears to be on the way out. If Direct Revenue wants to continue their online business, then they will have to change their methods of installing their software.

SpywareQuake Removal

SpywareQuake is the new version of SpyAxe, SpywareStrike, and SpyFalcon. You may see the following line from Hijackthis:

O4 - HKLM\..\Run: [SpywareQuake] C:\Program Files\SpywareQuake\SpywareQuake.exe /h

You may also find one of these file as a new dll controlling the fake warning near the clock:

C:\WINDOWS\system32\stickrep.dll
C:\WINDOWS\system32\dxmpp.dll
C:\WINDOWS\system32\ginuerep.dll
C:\WINDOWS\system32\dfrgsrv.exe

You can follow the SpyFalcon removal instructions and add the above to the fix as needed.

Spy Sweeper Update 650

SpySweeper latest update.

Spyware definition: version 650

Updated April 5th, 2006
Protection against 134,245 spyware traces.


Spy Sweeper available from http://www.webroot.com/consumer/products/spysweeper/

NOD 32 Antivirus v.1.1474 (20060405)

NOD 32 latest update is v.1.1474 (20060405)


Threats updated include the following:

Win32/Adware.AdHelper, Win32/Adware.DigitalNames, Win32/Adware.IGetNet (2), Win32/Adware.Pugi (2), Win32/Adware.Suggestor, Win32/Adware.Virtumonde.AK, Win32/Adware.WinAd (2), Win32/Agent.TV (4), Win32/Bagle.FX (2), Win32/Bobax.AT (2), Win32/Lowzones.DM, Win32/PSW.Agent.EG (5), Win32/PSW.LdPinch (3), Win32/PSW.LdPinch.AJV (2), Win32/PSW.Lineage.DN (6), Win32/PSW.Lineage.NAQ, Win32/PSW.Lineage.ON, Win32/PSW.Lineage.VA, Win32/PSW.Lineage.XX, Win32/PSW.Lineage.YS (2), Win32/Rbot, Win32/TrojanClicker.BHO.B, Win32/TrojanDownloader.Agent.AHT (2), Win32/TrojanDownloader.Small.AWA, Win32/TrojanDownloader.Zlob.KE (5), Win32/TrojanDownloader.Zlob.KF (5), Win32/TrojanDropper.Small.NDY (2), Win32/TrojanProxy.Daemonize.AW (2)

http://www.eset.com

SpywareBlaster For April

New SpywareBlaster updates available.

Database 5643 items
Updated April 3rd, 2006

SpywareBlaster is free and available from here.

SpywareBlaster can:

• Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software
• Block spyware/tracking cookies in Internet Explorer and Mozilla/Firefox
• Restrict the actions of potentially unwanted sites in Internet Explorer

Sunbelt CounterSpy Definition 315

CounterSpy 1.5 latest update definition is 315

New Threats Added to Database

WeirdOnTheWeb
Downloader.AN
Downloader.AP
Rivarts.A
Clagger.C
ApiGrabber
Trojan-PSW.Win32.Agent.fv
CoolWebSearch.NetCross
Spyshield
WinBot
BHO.NameShifter.LG
Java/Byteverify
BTEngine
VBS.Zerolin
SmartDove
Downloader.AQ
Trojan-Downloader.NSIS.Agent.p


Current Threats With Updated Information

180Solutions.Zango.ZangoToolbar
3721.com Chinese Keywords
ABetterInternet.Aurora
Actmon PC & Internet Monitoring
Actual Spy
AdHelper
Adware-Webnexus
Auto.Keylogger Key Logger
Axexx CHM
BaiduBar
BearShare
Begin2Search
BestOffersNetwork
BossWatcher
Bullguard
CnsMin
CoolWebSearch.MWSearch
Desktop Links
Dimpy.win32VBsy
DollarRevenue
Downloader.activate_crack
DropSpam
DropSpam
eXact.Downloader
eXact.NaviSearch
Haxdoor.Fam
Jupites.dr
Krepper
NewAds.IRASSync
PartyPoker
PWS-Banker
QuickLinks
SurfSideKick
TargetSaver
Trojan-Proxy.Win32.Xorpix.o
Trojan.Delf
Trojan.Downloader.Qoologic
Trojan.PayTime
Trojan.vxgame
Virtumonde
webHancer
WebSearch Toolbar
WhenU.SaveNow
WinFixer
Yazzle Sudoku
Zenotecnico
AlltheInternet
Weird on the Web



http://research.sunbelt-software.com/download.cfm

Sunbelt CounterSpy

CounterSpy 1.5 latest update definition is 313

New Threats Added to Database

Trojan.Downloader.8062
Falling Dollar


Current Threats With Updated Information

AceSpy 3.5.45
Actual Spy
Adware-Webnexus
Ardamax Keylogger
BestOffersNetwork
CoolWebSearch.MWSearch
DesktopScam
Dialer.maxd
DollarRevenue
Exploit.CreateTextRange
FiveSec.Spam.agent.vx
Fullcontext.EQAdvice
InternetOffers
Jupites.B
Kiwi Alpha
Locksky.M
Marketscore.RelevantKnowledge
Nextern
QuickLinks
ShopAtHome
SpyFalcon
SpywareQuake
SurfSideKick
TIBS Premium Rate Dialer
Trojan.Delf.MM
Trojan.Downloader.abc
Trojan.vxgame
TrojanDownloader.loadadv
Virtumonde
webHancer
WhenU.SaveNow
WindUpdates.MediaGateway
Yazzle Sudoku
YourSiteBar
Zenotecnico
Ads.Tucows


http://research.sunbelt-software.com/download.cfm

Spyware Doctor For Monday

Latest Database Version: 3.0442 0

Intelli-Signatures: 52195

New Intelli-Signatures:

3.0442 0- Backdoor.IRCBot.FP, C-One v.1.0.0, Dialer.FV, LittleHelper, Trojan.Dialer.NE, Trojan.Downloader.Banload.AL, Trojan.Downloader.Banload.B, Trojan.Downloader.Fuetel, Trojan.Downloader.Tiny.Y, Trojan.Dropper.Agent.AAY, Trojan.Proxy.Small.DV, Trojan.Runner.F


3.0441 1 - Backdoor.Rbot.WI, Dialer.LI, Digiwex, StoragePass Viewer, Suggestor.O, Trojan.Downloader.BRE, Trojan.Downloader.BSC, Trojan.Downloader.BTC, Trojan.Downloader.Delf.ABR, Trojan.Downloader.Hanlo.I, Trojan.Downloader.Leodon, Trojan.Downloader.Msole32, Trojan.Downloader.Small.API, Trojan.Downloader.Small.BFE, Trojan.Emspy, Trojan.Proxy.Ranky.EK, Trojan.Spy.Agent.BY


Extended Intelli-Signatures:

3.0442 0 - AceSpy, Backdoor.Robobot, DealHelper, EasyWebSearch, eZula, ISTbar, MediaTickets, TopConverting Crazywinnings, Trojan.Downloader.Agent.AEA, Trojan.Downloader.CashDeluxe.A, Trojan.Downloader.ConHook, Trojan.Downloader.Small.AVT, Trojan.Downloader.Zlob.GEN, Trojan.Dropper.Small.AEK, Trojan.Proxy.GN, Trojan.Proxy.Lager.f, Trojan.SpamBot, Weird On The Web



3.04411 - AB System Spy Keylogger, Absolute Key Logger, Backdoor.Agent.BA, Backdoor.Sdbot.AAD, ClkOptimizer, Common Components for Trojans, DropSpam ToolBar, IE Driver, IEAccess.SurfYa, ISTbar, Known Bad Sites, Perfect Keylogger, Pop Marketing, SpyAxe, SpyFalcon, Trojan.Adclicker, Trojan.Bankem, Trojan.Banker.DX, Trojan.Banker, Trojan.Clicker.BHO, Trojan.Clicker.Delf.DY, Trojan.Delf.IT, Trojan.Downloader.Agent.AEA, Trojan.Downloader.Agent.AFL, Trojan.Downloader.Baltia, Trojan.Downloader.Druser, Trojan.Downloader.NVD, Trojan.Downloader.Qoologic.B, Trojan.Dropper.Agent.D, Trojan.StartPage.GEN, Trojan.Win32.Small.BJY, Trojan.Zlob.AP, Virtumonde, Weird On The Web, Zango Search Assistant


General Information:

Updates are posted 5 times per week on average.

Updates are installed by running Spyware Doctors' Smart Update feature.


PCTools Homepage:

http://www.pctools.com/

Ad Aware SE1R102 03.04.2006

SE1R102 03.04.2006

New Definitions:
========================
SpyFighter
SpywareQuake +4
SpywareStormer

Updated Definitions:
========================
Adintelligence.AproposToolbar +6
Adultlinks Quickbar
Adware.CasinoClient +3
AdwareSheriff
BargainBuddy +4
BlazeFind
BlazingTools Perfect Keylogger
DyFuCA +2
Elitum.ElitebarBHO
Lop
MediaMotor +3
PurityScan +3
SahAgent +2
SpyAxe
SpyFalcon
SpyFerret
SpywareNo +30
Win32.Adverts.TrojanDownloader +5
Win32.Backdoor.CiaDoor +3
Win32.Trojan.Delf +3
Win32.Trojan.Downloader +6
Win32.Trojan.Keylogger +3
Win32.Trojan.Kolweb +8
Win32.Trojan.LowZones
Win32.Trojan.SDBot +6
Win32.Trojan.StartPage +2
Win32.TrojanClicker +5
Win32.TrojanDownloader.Swizzor.br
Win32.Trojandownloader.Zlob
Win32.TrojanDropper +3
Win32.TrojanSpy.Banker
Win32.Winshow
Virtumonde +3
Zango +2
ZipclixToolbar

The MD5 checksum for the defs.ref file is cf0ed41d39089e503d8825e91900834f

Additional Information
============================================
You can use Webupdate to install the new reference file, or download it manually from:
http://download.lavasoft.de.edgesuite.net/public/defs.zip

If you think something needs to be sent to us for review, visit our submission site at:
http://www.lavasofthelp.net/submit/

If you have any questions, please contact us at:
http://www.lavasoftsupport.com

NOD32 - v.1.1467 (20060402)

NOD32 - v.1.1467 (20060402)

Virus signature database updates:

JS/TrojanDownloader.Tivso.S, Win32/Delf.API (2), Win32/Delf.NCC (2), Win32/Locksky, Win32/Locksky.BE (4), Win32/Spy.Banbra.DF (3), Win32/Spy.Banker.AHY (4), Win32/Spy.Banker.ANV (2), Win32/Spy.Banker.NIB, Win32/Spy.Banker.WN (2), Win32/Spy.PerfKey, Win32/Spy.PerfKey.J, Win32/TrojanDownloader.Small.AWA, Win32/TrojanDownloader.Small.CGT (2), Win32/TrojanDropper.Small.ABM (2)

http://www.eset.com

Spybot Search & Destroy Updated

03-31-2006
Dialer
+ Cbit-Solutions.PlayGames
Hijacker
+ CoolWWWSearch.Feat2Installer + CoolWWWSearch.Service + CoolWWWSearch.Feat2DLL
Malware
+ ISearchTech.ISTactiveX + SpywareStrike + SpyFalcon + Vcodec.eMedia + HitVirus + RemedyAntiSpy + SpyAxe + SpyFalcon + Command Service + Anti-Virus-Pro + AdwareSpy
PUPS
+ MalwareWipe + SystemStable
Spyware
+ webHancer + Exact Advertising.BargainsBuddy + KillSec
Trojan
+ Euniverse + TrojanDownloader.Small.fo + DLUCA-M + PestWiper + SpyCut + WorldAntiSpy + Jupilites + Hupigon

http://www.safer-networking.org/en/home/index.html