Reply With Quote
"George Orwell" <nobody@mixmaster.it> wrote in message
news:e7f3f896749e642d2ecf52a981e914c3@mixmaster.it...
> Stolen from what used to be on:
> http://www.doxdesk.com/parasite/rogues.html
>
> Disreputable anti-parasite software
>
> Prevention > how to stay parasite-free Cures > reputable anti-parasite
> software Worse than disease > not-quite-so-reputable anti-parasite
> software Database > of known parasites Definition of terms > what's
> targetted and why About this site > disclaimers, copyright, contact
> Links > other parasite sites Parasites < introduction and detector
> Non-recommended anti-parasite software
>
> * The backstabbers... * The unwanted... * The hypocrites... * The
> dodgy
> dealers...
>
> The issue of parasites, spyware and adware has received a lot of
> publicity recently. This has resulted in an explosion of anti-parasite
> tools, many of them incompetent or even outright harmful, often
> produced by the same kind of bandwagon-jumping ethics-free affiliate
> marketing firms that brought us the parasite problem in the first
> place.
>
> Such companies do not always have the talent to research malware,
> produce targeting databases and write removal software. So many of the
> programs are copies of other applications-either through licensing
> questionable databases and software sold on the open market from other
> companies, or in some cases simple code theft.
>
> Some companies do not even bother with the targeting database and just
> report completely bogus results. Either way, the result is typically a
> bunch of false positives coupled with a plea to spend money to remove
> them.
>
> And some supposed anti-parasite software actually does nothing of the
> kind.
>
> Note: if you work for one of the companies whose software is listed
> here, and believe any of the information is inaccurate or misleading,
> please do get in touch and I will be happy to correct any mistakes
> and/or advise on how the problems might be 'fixed'. The backstabbers
>
> Anti-parasite programs which themselves install parasites.
> MyNetProtector
>
> All products from mynetprotector.com, including MyNetProtector
> Anti-Spyware, have been seen to install multiple parasites, typically
> BargainBuddy, Delfin, FavoriteMan/ATPartners, IEDriver, PurityScan/M2,
> TopText, webHancer, WildMedia/StatBlaster and the NetShagg parasite,
> which is controlled by SJB Enterprises-the company behind
> MyNetProtector.
>
> MyNetProtector Anti-Spyware also fails to detect any actual spyware;
> it
> actually targets cookies, not parasites. Scumware Remover
>
> Scumware Remover (scumware-remover.org) masquerades as an anti-spyware
> application but is actually just a dropper for its author's
> SmartestSearch parasite. SpySpotter
>
> SpySpotter (spyspotter.com) is an anti-spyware application from Oemtec
> Ltd (oemtec.com). It has been bundled with iMesh so is considered a
> parasite in its own right; when installed stand-alone, it also bundles
> Oemtec's Oemji toolbar (oemji.com) parasite and PopupBlockade.
>
> The Oemji toolbar code is based on the ZipClix parasite, from MWorld
> Holdings, who also produce the Httper, PopupBlockade, and
> InternetWasher parasites and appear to be part of the same
> organisation
> as Oemtec. Malwhere
>
> Malwhere (malwhere.com) is a process lister by Ran Geva/Softbulldog.
> Each running process is displayed, with known process-based threats
> highlighted (Malwhere does not detect other types of program). For
> unknown executable names it does a web search for information.
>
> Malwhere bundles the SaveNow/Save, ClockSync and Search parasites.
> Meanwhile other products from Softbulldog also install
> IEDriver/IEHost,
> FavoriteMan, CommonName/InternetKeywords, BargainBuddy/URLCatcher and
> Delfin. UControl
>
> UControl is a spyware removal application from WhenU (whenu.com),
> built
> into some versions of their SaveNow/Search parasite. It also bundles
> the SaveNow/Save parasite and ClockSync.
>
> UControl is based on the scanner from Aluria's Spyware Eliminator,
> which is generally considered a reasonable anti-parasite program
> (though Aluria's reputation in general has been harmed by the
> partnership with WhenU). SpyBan
>
> SpyBan (spyban.net) is an anti-spyware application from NicTech
> Networks (nictechnetworks.com), who also operate the
> system-destabilising and extremely difficult-to-remove Look2Me
> parasite. SpyBan installs Look2Me when loaded, which can then install
> other parasites.
>
> The SpyBan website has disappeared but the software is still available
> from some download sites. Terminexor
>
> Terminexor is a complete and unauthorised copy of the code of the free
> anti-parasite application Spybot Search&Destroy, with some of the
> strings in the executable file hacked to change the name.
>
> Terminexor is distributed by Flashpoint Media (flashpoint.bm) and
> silently bundles the FlashTrack/Xmod and BroadcastPC parasites, both
> of
> which are operated by Flashpoint.
>
> Terminexor is believed no longer to be promoted. SpyAssault
>
> SpyAssault (spyassault.com) claims to be a spyware remover, but
> provides no such software. Instead, it installs the FavoriteMan/Ss32
> parasite. SpyAssault is controlled by Razor Media, the same company
> that operate this and some other variants of FavoriteMan, as well as
> the ClickTheButton, DailyWinner, SvcMM and WhileYouSurf parasites.
>
> SpyAssault is believed no longer to be operating. The unwanted
>
> Anti-parasite software that is unsolicited commercial software in its
> own right. VirtualBouncer
>
> VirtualBouncer (virtualbouncer.com) and its sister program
> AdDestroyer,
> by Spyware Labs (spywarelabs.com) have long been installed through
> drive-by-downloads and undisclosed bundling from other parasites,
> including some that are loaded by exploitation of Internet Explorer
> security holes.
>
> When loaded, VirtualBouncer opens repeated spyware warning dialogue
> boxes, demanding payment to remove what it says it has detected (which
> it refuses to divulge; probably nothing at all). WareOut
>
> WareOut (wareout.com) is a spyware removal application from 'Coteco
> LLC' which is installed silently by CoolWebSearch/msbho and other
> CWS-related IE security holes. Its scanner generates false positives
> and even installs fake spyware 'threats' of its own to ensure it can
> find something to ask for payment to remove.
>
> The server for WareOut-and its sister application PopClose
> (popclose.com) by 'Rove Digital'-is hosted in a netblock at at EstHost
> (esthost.com, in the atrivo.net netblock), which also serves myriad
> hijacker sites, security hole exploits and blog-spammers connected to
> CoolWebSearch. It is in fact only one IP address away from the
> fastsearchweb.com group of hijackers that installs WareOut by security
> holes. For this reason it is believed that Coteco/Rove (who seem to
> have no other presence; Rove are not related to rovedigital.com) are
> simply another name for this CWS affiliate. SpyBlast
>
> SpyBlast (spyblast.com) is a supposed anti-spyware application from
> advertising.com, that opens pop-up ads.
>
> Installed by unrequested ActiveX drive-by-downloads and considered a
> parasite in its own right.
>
> SpyBlast is believed no longer to be operating. AdProtector
>
> AdProtector was a spyware remover from RedV (redv.net, formerly
> web3000.com) which useed RedV's EasyInstall adware as the installer.
> RedV are now believed to be defunct. The hypocrites
>
> Anti-parasite software that is marketed by companies involved in
> writing, distributing or controlling parasites themselves.
> SpywareNuker
>
> SpywareNuker (spywarenuker.com, nuker.com) and its variant pcOrion
> (pcorion.com) is a spyware remover application from TrekBlue
> (trekblue.com). TrekBlue, aka TrekData or Trek8 LLC, is a company
> formed by employees of Lions Pride Enterprises who didn't leave to
> form
> SJB Enterprises (operators of MyNetProtector and the Netshagg
> parasite).
>
> Lions Pride Enterprises themselves operated the wnad parasite. Trek8
> controlled and may still operate the InContext parasite (aka AdGoblin,
> adsincontext.com). Trek8 also owned BlueHavenMedia, who promote and
> distribute heavily parasite-infected downloadable applications such as
> Kazoom and ICQBoom. BHM is now operated by Software Delivery Systems,
> Inc (softwareds.com), whose current relationship with Trek8 is
> unclear.
>
> The original SpywareNuker application was a licensed clone of BPS
> Spyware Remover (bulletproofsoft.com), and had all the same problems
> (including using an unauthorized copy of the free anti-parasite
> application Spybot Search&Destroy's targets database. The
> currently-available version SpywareNuker/pcOrion 2004/2005 is a
> complete rewrite and fixes these problems at least, however Trek8's
> reputation remains deservedly tainted.
>
> SpywareNuker has also been widely promoted through spam.
> SpywareAvenger
>
> SpywareAvenger (spywareavenger.com) is a commercial-only spyware
> removal application from iDownload.com. iDownload control the
> Pugi/iSearch parasite, which they have installed through aggressive
> ActiveX drive-by downloader scripts and exploitation of Internet
> Explorer security holes. iDownload's isearch.com is also the target of
> the ILookup/Hot parasite. MyPCTuneUp
>
> MyPCTuneUp (mypctuneup.com) is a site operated by DirectRevenue
> (direct-revenue.com) that offers to remove software by its
> 'partner'-ie. the parasites written and controlled by DirectRevenue
> itself.
>
> MyPCTuneUp removes variants of the Transponder parasite from Host and
> BI onwards, IPInsight and GrandStreet, but not before installing using
> the Transponder/Thinstaller, which leaks significant amounts of system
> information to its controlling server. JimmySurf
>
> JimmySurf (jimmysurf.com) is a commercial-only internet cleaner
> program
> that now also claims to remove spyware. It is sold by Surf Protect
> LLC,
> aka ClickSpring LLC, who operate the MediaTickets and PurityScan
> parasites. Warnet
>
> Warnet is a commercial-only spyware remover from C2 Media, who operate
> the lop parasite. Believed no longer to be operating. Kill All
> Spyware!
>
> Kill All Spyware (killallspyware.com) is a commercial-only spyware
> remover from Mainstream Dollars (mainstreamdollars.com), part of the
> iClicks Internet Inc group that signed the initial Ineb variant of
> ILookup and hosts many of its other variants.
>
> Kill All Spyware was promoted in adware links from ILookup. #1 Spyware
> Killer
>
> #1 Spyware Killer (1spywarekiller.com) is a spyware remover
> application
> from 'Kitten Holding Corp' (evilbucks.com). The whois information is
> again the same as that for many variants of ILookup, including
> ILookup/Waeb which has been seen to advertise it. SpywareHelp
>
> The SpywareHelp service promoted at spywarehelp.net is operated by
> Odysseus Marketing Inc (odysseusmarketing.com) who also control the
> ClientMan parasite. The dodgy dealers
>
> Anti-parasite software that is marketed abusively. SpyWiper
>
> SpyWiper and its variant SpyDeleter are commercial-only spyware
> removers operated by MailWiper (mailwiper.com). They are promoted
> through homepage-hijacking parasite installers loaded through IE
> security hole exploits by SmartBotPro (smartbot.net) sites.
> SpyWiper/SpyDeleter is believed no longer to be in operation.
>
> Rob Martinson (MailWiper), Sanford Wallace (SmartBotPro) and Walt
> Rines
> (Odysseus Marketing) are closely connected, a trifecta of infamous
> old-school spammers. Ad-Eliminator
>
> Ad-Eliminator (ad-eliminator) and its successors Spy-Control
> (spy-control.com), SpyOut (spyout.net) and Ad-Protect (ad-protect.com;
> all variants have many, many alternative promotional site URLs) are
> spyware scanners from Global Entertainment Solutions (gesworld.com),
> an
> Israeli marketing firm that normally sends spam promoting dodgy Green
> Card sites.
>
> Ad-Eliminator was promoted by an enormous and lengthy campaign of
> e-mail and Windows Messenger service spam advertising
> constantly-changing site addresses with misleading scare-tactics
> claims
> that spyware had been 'detected' on the receiver's machine. A similar
> misleading spam campaign has also now started for Spy-Control.
>
> Additionally, the Spy-Control variant installs a search toolbar
> targeted at www.searchmeup.com, a site normally associated with
> CoolWebSearch hijackers.
>
> XoftSpy by Paretologic (paretologic.com): downloads promoted by the
> RichFind parasite.
>
> SpywareStormer (spywarestormer.com) by Error Guard (errorguard.com),
> Security IGuard (securityiguard.com) by Rex Services and PAL Spyware
> Remover from PAL Soloutions (palsol.com): widely promoted by some
> CoolWebSearch variants.
>
> BPS Spyware&Adware Remover (bulletproofsoft.com) uses an unauthorised
> copy of the database from the free anti-parasite application Spybot
> Search&Destroy. Adware Remover Gold (adwareremovergold.com) by
> Cyberheat Inc, as a licensed clone of BPS, is in the same situation.
> Adware Remover Gold is also advertised by e-mail spam.
>
> InterESoft NoSpyX (nospyx.com): commercial-only spyware remover also
> widely promoted by e-mail spam. Others
>
> There are dozens of other anti-parasite applications that either are
> marketed abusively or simply aren't much good (usually both). Eric
> Howes maintains a comprehensive list of rogues at Spyware Warrior.
>
> Parasite home... CC
>
>
> Il mittente di questo messaggio|The sender address of this
> non corrisponde ad un utente |message is not related to a real
> reale ma all'indirizzo fittizio|person but to a fake address of an
> di un sistema anonimizzatore |anonymous system
> Per maggiori informazioni |For more info
> https://www.mixmaster.it
>
Bookmarks