NWA-PCUG Newsletter Article, January 2005
Beware of SCUMWARE Pretending to be Anti-Spyware
by Ira Wilsker,
APCUG BOD and columnist for the Examiner, Beaumont, TX

One of the most frequent topics in this column in the past has been about the spyware which threatens our computers and the safety and security of our personal information. We should all be aware that spyware is rampant, existing on as many as 80% of our computers, according to media reports. While it has been written here in the past that there are several excellent, reliable, and sometimes free, anti-spyware products on the market, there are also some less reputable products pretending to be anti-spyware software. More than coincidently, many of these same disreputable products are marketed using methods that users may consider unethical.

On my office computer, which lacks the popup blocker on my home computer, I recently received a popup which gave the dire statement, “WARNING! This computer is infected with dangerous SPYWARE which is stealing your personal information. CLICK HERE to run a free spyware scan.” I am not so naďve as to believe a popup ad, but I was intrigued, as minutes earlier I had scanned my computer with two just updated major anti-spyware products, and my machine was free of spyware. Checking to make sure that my antivirus software was updated and running properly, and violating my own premise that I would never click on a popup, I decided to see what this popup would do, so I clicked on it. A rapidly advancing progress meter, too fast to be really scanning my computer, appeared. Moments later, another popup window appeared. “WARNING! This computer is infected with SPYWARE! See the attached list of SPYWARE on this computer.” Below, in a small font, was a lengthy list of spyware titles, allegedly on my computer. “CLICK HERE TO REMOVE THIS SPYWARE” appeared in large bold print below the disturbing list of threats. Clicking on the link opened a webpage advertising an anti-spyware product that I knew from experience had a terrible reputation that was also the subject of complaints of legitimate spyware publishers who alleged that this product was a knock-off using pirated code from the legitimate products. The large headline on the page said that I must purchase this product for $39.95, download it, and run it, or I would likely be the victim of identity theft, and my bank accounts would be vanquished by predators. To the uninformed, this frightening scenario may result in enough uncertainty to encourage them to become still another victim of near useless software, and imposing a false sense of security, further opening the victim to attack.

In order to detect and prove that their legitimate software is being pirated or otherwise stolen by purveyors of scumware, most of the legitimate companies include some inert dummy entries in their program code and database of spyware signatures. If these unique but inert dummy entries are found in other programs, then there is good evidence of piracy. Regrettably, this is more common than many users realize, and sometimes these users end up paying top dollar for inferior pirated anti-spyware software, that may provide little or no protection. One of the many documented cases involves the very popular Spybot Search and Destroy (published in Germany), and the New York based “1ClickSpyClean”. Spybot included some inert dummy entries in its database, and these dummy entries showed up in the 1ClickSpyClean database, according to a news article posted on the Spybot website. Some legal demands and threats crossed the Atlantic, and Spybot recently reported that it appears that 1ClickSpyClean has complied, and purged its database of the allegedly purloined content, reducing its detection capacity by about 60%. Spybot is free software, and 1ClickSpyClean sells on its own website for $29.95.

Unfortunately, there are many such questionable anti-spyware products being marketed, often by dubious means such as the popup mentioned above, spam mail, multi-level network marketing, and other such means. A comprehensive list of these questionable products is online at “Rogue/Suspect Anti-Spyware Products & Web Sites”, http://spywarewarrior.com/rogue_anti-spyware.htm. According to this site, there are nearly 150 such rogue products being marketed and promoted, as well as several dozen websites containing allegedly helpful anti-spyware information, but are instead promoting rogue products. Several of the rogue products are in reality the same software, but marketed under different titles. If you are using an anti-spyware program, check this list to see if it is legitimate or not.

The rogue anti-spyware software may be worse than useless, because some titles install their own spyware, or pretend to clean the machine but in reality do a poor job or nothing. This could be dangerous because the user may get a false sense of security, and believe that he is protected, when in reality he is quite vulnerable and likely being victimized.

Anti-spyware programs that were once considered reliable, such as the Aluria Spyware Eliminator previously reviewed here, may possibly lose some reliability as they start to deal with companies considered by many to be purveyors of spyware. According to such media sources as Ziff Davis, the Boston Globe, eWeek, and others, it has been reported that Aluria has recently reached a deal with and ad-ware vendor (ad-ware is generally considered as a type of spyware). Aluria will not to block its ad-ware, but will also be included in the ad-ware vendor’s web page tool bar that is supposed to remove unwanted spyware, but may itself be a type of spyware.

For safety sake, as well as peace of mind, be absolutely sure of the spyware solutions utilized, and never purchase such software from popups, spam mail, or other questionable means.

There is no restriction against any non-profit group using this article as long as it is kept in context with proper credit given the author. The Editorial Committee of the Association of Personal Computer User Groups (APCUG), an international organization of which this group is a member, brings this article to you.

Click here to return to top