Name Game
Premium
join:2002-07-07
North Myrtle Beach, SC
| reply to CalamityJane
Re: Beware these "fake" antispyware programs
See also..
Rouge Antispyware Spotting
»www.f-secure.com/weblog/archives···380.html
>>
Video - Rogue Spotting Posted by Sean @ 10:47 GMT |
Better Living thru Search Engines
In July of 2006 we did some searching for potentially unwanted applications; recycled or repackaged applications that were of dubious value. Affiliate marketing is used to promote sales and unfortunately such systems often provide economic incentives to cheat.
Those earlier search results contain some links to known rogue antispyware sites, but in general it's mostly harmless optimization software. (The real value of which is unknown to us.) Interestingly, since 2006 there are now many French, Spanish, Italian, and German localizations in the results. Everything is localized except the Privacy Policy text we searched for.
Now to the present — being less interested in PUAs and more interested in known bad Rogues, we tried a few different searches last week.
Starting with a new Rogue (VirusHeat, circa Feb. 8th) we used this text from the affiliate page:
Being associated with one of the most known innovative software solutions developer
whose mission is to protect the privacy and security of Windows computer users.
The Google search results produced a number of known bad guys. Many of the search links are blocked by StopBadware.org.
Click the image below for an example of the recycling (animated GIF). Attack of the Clones:
»www.f-secure.com/weblog/archives···hots.gif
This Rogue list included applications that we've seen elsewhere. Where?
On a list of applications hosted by the Russian Business Network.
RBN is an infamous underground ISP that provides bulletproof hosting. The site www.antispyzone.com isn't among the results and the URL doesn't currently resolve (server not found). However, using the site's last known IP address from a list of RBN associated IP Addresses, we located the page.
It uses the very same text on its affiliate page. They're all bad Rogues…
You don't want to buy what they're selling.
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/ |
