SpyStopper = Fake spyware scanner?

Discussion in 'Malware Help (A Specialist Will Reply)' started by Nexworks, Jan 20, 2006.

  1. Nexworks

    Nexworks Private E-2

    SpyStopper, a program which majorgeeks lists, was magically out of the blue installed on one of my clients computers when she got infected with the netsky and bagle worms yesterday. Only other spyware on the system was Hotbar. Now I have seen hotbar be installed many times through viruses/worms, but this is the first time ive seen SpyStopper tagged along. Is this a fake spyware scanner like SpyAxe or WinFixer? And if its legit, should it even be listed by majorgeeks if its being distributed by viruses/worms?
     
  2. Nexworks

    Nexworks Private E-2

    Upon further digging I found that the manufacturer of the software has an Affiliate program. I guess atleast one of them is trying to cash in by infecting peoples machines and then peddling this junk as a solution.
     
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Are you sure that you did not mean: Spyware-Stop

    It is from the SpyAxe, SpywareStrike, SpyDemolisher, SpySheriff, SpyTrooper, & SpywareNo family
     
  4. Nexworks

    Nexworks Private E-2

    Oh im 100% sure it was SpyStopper.
     
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please check again because info I have says Spyware-Stop is the one related to the others and it is fairly new. SpyStopper (and also SpywareStopper) have been around for awhile and have been clean. Notice that the names are very similar.
     
  6. Nexworks

    Nexworks Private E-2

    The desktop shortcut said SpyStopper. The start menu said SpyStopper. The folder said SpyStopper. It said c:\program files\SpyStopper . It along with Hotbar appeared together when the bagle/netsky infection got in. Poor gal was puzzled why all of a sudden she was getting popups and there was a program on her desktop, for a fee, offering to make them go away.

    And I find it amazing that the company has an affiliate program which encourages others to peddle their wares while they wash their hands clean of any wrongdoing. "oh no it wasnt us! it was our bad affiliates!" . Heard that somewhere else before? You bet.
     
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    The real SpyStopper (as downloadable here) will put an icon on the desktop named SpyStopper Pro not SpyStopper

    The folder will be: C:\Program Files\SpyStopper Pro

    And via a startup it will also be:
    O4 - HKLM\..\Run: [SpyStopperPro] C:\Program Files\SpyStopper Pro\ssp.exe
     
  8. Nexworks

    Nexworks Private E-2

    Current version is Pro, you are correct. Older versions did not have the Pro designation. In my case there was no Pro designation.
     
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Then perhaps it is not even the same company. It would be good to know what company is associated with the program on the infected system.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds