MalwareTeks Blog

Normally when I receive Spam mail in my admin account for the site, I simply delete it; but today one particular spam mail caught my attention. Subject: Spyware Alert!, text of the message was simply AbuseReport with 2 attachments: AbuseReport.gif and patch-2135.zip.

OK, now you have my attention.

patch-2135.zip contains patch2135.exe

Using a password protected archive is a fairly common tactic for slipping Malware past email AV scanners.

Complete scanning result of “patch-2135.exe”, received in VirusTotal at 04.12.2007, 20:46:37 (CET).

Yep, Storm Worm and a new variant.

W32.Worm.Nuwar.Gen

The Subject of the email, so far, states:
“Worm Alert!”
“Worm Detected”
“Virus Alert”
“ATTN!”
“Trojan Detected!”
“Worm Activity Detected!”
“Spyware Detected!”
“Dream of You”
“Virus Activity Detected!”

There are two attachments, one being is an image with ‘panic-worded text’, and the other is a password protected zip file, whose password is revealed in the image.

The zip file names, so far:

“patch-<random 4 or 5 digit number>.zip”
“bugfix-<random 4 or 5 digit number>.zip”
“hotfix-<random 4 or 5 digit number>.zip”
“removal-<random 4 or 5 digit number>.zip”

If you have received one of these email messages and have fallen prey to their tactics and are now infected. Please see our Malware Cleaning Guide and post in our Malware Removal Forum. There is a RootKit element of this infection that will require special handling to remove.

You must be a registered member of our site; in order to post in the Forums. This is a Free service to all. Registration is simply required to keep the spam bots from flooding the site.

SpyHunter by Enigma Software Group (ESG) has been receiving quite a bit of attention in the security circles of late.

Spyhunter finds & removes Spyware, Adware, Keyloggers. Prevent credit card theft due to Spyware. Protect your privacy and secure your computer. …

This is what ESG claims SpyHunter can do.

SpyHunter was once listed as a “Rogue” Anti-Spyware Application by Eric Howes on his
Rogue/Suspect Anti-Spyware Products & Web Sites list; here is what was said:

Enigma’s SpyHunter anti-spyware application was listed on this page primarily because of the company’s history of employing aggressive, deceptive advertising. The company was also known for exploiting the name “spybot” in its domain names and online advertising. These objectionable business practices were employed primarily from late-2002 to mid-2004.

Sometime during summer of 2004 the company halted the most obnoxious and objectionable aspects of its online advertising. It also unloaded all the “spybot” domains (which were promptly picked up by Paretologic for its XoftSpy anti-spyware application).

While there are still unresolved allegations that SpyHunter transmits the Windows Product ID from users’ PCs, we can no longer classify this application as “rogue/suspect.” Nonetheless, SpyHunter — at least in its current state — cannot be recommended because of its mediocre performance as an anti-spyware scanner. Testing indicates that it does not recognize some well-known spyware installations and has difficulty removing critical spyware/adware files even from those it does recognize. Given the many excellent competing anti-spyware applications that are available (some for free), users would do better looking elsewhere for trustworthy anti-spyware protection.

Domains: enigmasoftwaregroup.com, spywareremove.com, uninstallxupiter.com

In recent days it has come to light that someone has been posting spam links to SpyHunter. Individuals from 411-spyware.com have posted on several forums, misleading people seeking help in removing SpyLocked and similar rogue applications, with links to this FreeSpywareScanner. When you go to install the FreeSpywareScanner it becomes readily apparent that the tool being installed is the former “Rogue” Anti-Spyware Application SpyHunter.

It is precisely this type of behavior that got SpyHunter listed as a Rogue Application in the first place. Well it seems that the makers of Spybot Search & Destroy think SpyHunter is Malware. As of 11 April 2007 with the release of Spybot S&Ds updates SpyHunter is now listed as Malware and is targeted for removal.

Updates	11. April 2007
2007-04-11 Adware ++ Zango.AntiSpamBar ++ Zango.Seekmo Keylogger + Perfect Keylogger (2) ++ WideStep Malware ++ Free-Key-Logger + InetLoader + Smitfraud-C. (2) + SpyDawn + SpyHunter ++ Win32.Agent.ahd ++ Win32.Optix.b Trojan + 1und1Bill.Fake + Hupigon + NumbSoft + Win32.Lager.aq ++ Zlob.MovieBox + Zlob.PrivateVideo + WarezP2P Total: 373599 fingerprints in 64879 rules for 2804 products

To answer my own question: SpyHunter, should this be listed as a Rogue Anti-Spyware Application?

YES

For further coverage of this story:
411-spyware.com - The new forum spammers?
Spyware Help: Intent Matters Alot:Part 2