SpywareBomb

[WTBanner]

Okay I am not going to post any links regarding this.

I am new to the boards and well I've had this piece of "anti-malware" come up when I use SystemMechanic 6 and it's Spython scanner.

Of course it easily can be false positives and the reason I am not posting any links regarding this jewel of "anti-malware" is that it's one of those wonderful pieces that you go to a site and get infected by it merely by going there, and of course their software will remove it.


Now from what I have been able to gather, SpyHunter, used this tactic as well as others. Honestly I am bothered that I keep getting these "infections found" with Spython and nothing found with Spybot.

Further I downloaded SpyEraser by Uniblue in my quest to verify the SpywareBomb infection (though it's "anti-malware" that "creates false positives or amplifies the existence of infections" it remains that it does make the system unstable, is claimed to be almost impossible to get rid of without downloading the software from the company that installed it, and, it does contact the internet). Technically to me this is an infection since it's using my electricity, putting wear and tear on my system and my nerves. In any event SpyEraser found a number of other "infections" which of course it won't delete until I pay $X however it listed them and with regedit I erased them manually, ran another scan and those are gone, yet it doesn't detect SpywareBomb which my SystemMechanic 6 remains finding (I am sure a few can imagine the frustration or have experienced it themselves.).

I am unable to say if SpywareBomb is gone right now or just dormant. I've used Iolo System Mechanic for years, since windows 98 and well apparently, according to the registry, it appears they used SpyHunter. What appears to have triggered my infection however is SpyBlocker being installed when I upgraded my ZoneAlarm. The operative posibility here is that they both use "SB" in their naming conventions so maybe some residue of SpywareBomb from when SpyHunter was on my system via SystemMechanic 4 has caused this.

I am about to use the Revouninstaller to remove SystemMechanic 6 and likely going to edit the registry to make sure none of the residue is there from SM 4.

My post obviously is to seek out if SpyBot S&D will find this SpywareBomb and the various replicants of it which drive people to download false Spyware scanners which only exacerbate the entire malware situation.

In the event it currently doesn't detect SpywareBomb obviously I am seeking that it would.

Also due to the various credibility and integrity issues with so many of these companies I'd like to get some feedback on ThreatFire and if that is in anyway helpful with Spybot S&D at this time as well as if ThreatFire appears to at least be legitimate. Then if it is legitimate according to this community is there a potential future time when it would be of any assistance to Spybot S&D?

To me you genuine programmers with a sincere interest in helping keep our systems stable should be working together on the spyware/malware, and pseudo look alikes that techincally are malware like this SpywareBomb. Threatfire is from PCTools who, if it's the same company, have been around since DOS 3.0 and ThreatFire is a free download from their site, this is why it seemed like a workable relationship between you guys.

My apologies for length but I felt a need to say all I meant and I do look forward to any input especially from Safer Networking regarding these 2 issues.

Thank you and may we all have trouble free systems one day,

WT

[tashi]

Hello,

Spywarebomb may be a variant of SpywareBomber, the latter Spybot-S&D detects.

I have seen reports of SpywareBomber redirects to spywarebot, another rogue also detected by Spybot-S&D.

There are many rogue programs, it can prove difficult to shut them down and they constantly spring up with new names.

Of interest:
C-NetMedia Deceptive Practices (http://www.benedelman.org/news/021408-1.html)

Rogue/Suspect Anti-Spyware Products & Web Sites (http://www.spywarewarrior.com/rogue_anti-spyware.htm#notes)

When Spybot-S&D does not detect or remove an item, if users find the files they can be zipped and sent to: detections AT spybot.info (replace AT with @)

Vendors often receive the same file submissions. However they range in the many thousands and new variants are frequently released into the wild. A scanner may catch one and not the other.

Re:SpyHunter. http://www.safer-networking.org/en/updatehistory/2007-04-11.html

If you would like someone to check the system, follow the procedure in this link:
"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)

Then start your own thread in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22) where a helper will advise you when available.

Best regards.

[WTBanner]

Okay thus far I uninstalled iolo SystemMechanic6 and ZoneLabs SpywareBlocker. This whole thing began when i installed the latest ZoneAlarm Firewall and it autoinstalled SpywareBlocker, their anti-spyware product. However after learning about Spyhunter and remembering it being part of SystemMechanic4 (circa Windows98) I knew this could be where the dormancy of SpywarBomb lies.

In looking into SpywareBomb I discovered the files start with "SB." "SBguard" is one of the files one is intended to remove to manually remove SpywareBomb (though the site instructing how to do that infects the system with another variant of it). SpywareBlocker (another "SB") obviously uses a similar file naming convention and, irrespective of beliefs to the contrary, it appears this triggered the old SpywareBomb to start acting up to Spython's detection (System Mechanic 6 spyware scanner).

Thus my situation is not urgent. Between SpyBot S&D, a2Squared, SpywareBlaster and AVG 7 there has been nothing found.

However seeing you've suggested what SpywareBomb is as a variant of SpywareBomber I am adding the following links for your perusal. I'd like to know if they are actually describing this accurately, if their description matches what you are suggesting is the relation, or, if not, if SpyBot S&D can and will detect such an infection as SpywareBomb so we all know we are protected:

http://www.symantec.com/security_response/writeup.jsp?docid=2007-050122-2434-99&tabid=1

http://www.spython.com/spywaredetails.aspx?id=E5D2D905-20AA-4D1D-A401-32EA130F30D4

http://www.emsisoft.com/en/malware/?Adware.Win32.SpywareBomb

http://forum.sysinternals.com/forum_posts.asp?TID=11414&PN=2

http://research.sunbelt-software.com/threatdisplay.aspx?name=SpywareBomb&threatid=139550

http://msmvps.com/blogs/donna/archive/2007/06/14/spyware-sweeper-com-is-spywarebomb-com.aspx

WARNING DO NOT GO TO THE FOLLOWING SITES unless you are ready to run a cleaning of your system for SpywareBomb (at least if Spython was accurate they infected me with it on top of initial infection):

NOTE: I use dogpile search engine so they are the referer url (I believe that's the right terminology).

http://www.dogpile.com/clickserver/_iceUrlFlag=1?rawURL=http%3A%2F%2Fspywarebomb.com&0=&1=0&4=204.9.89.53&5=24.117.206.70&9=e59f0069e9184c67a2a02a4f34a8c801&10=1&11=info.dogpl&13=search&14=867530&15=main-title&17=10&18=2&19=0&20=4&21=6&22=UBGQRvRoeqY%3D&23=0&40=ivhK1nmOQ1uM7mFeCfyogg%3D%3D&_IceUrl=true

http://www.dogpile.com/clickserver/_iceUrlFlag=1?rawURL=http%3A%2F%2Fwww.411-spyware.com%2Fremove-spyware-bomb&0=&1=0&4=204.9.89.53&5=24.117.206.70&9=e59f0069e9184c67a2a02a4f34a8c801&10=1&11=info.dogpl&13=search&14=239138&15=main-title&17=11&18=9&19=0&20=4&21=7&22=MyVDGKeef7g%3D&23=0&40=Wx8rIqKJUsdpklY%2FWOxXGg%3D%3D&_IceUrl=true


Altogether this is just about all the sites I visited looking for answers as they were results of a simple dogpile search for "Spywarebomb."

The last two infected me, pursuant to Spython (Sytem Mechanic 6), with....you guessed it Spywarebomb!

This whole thing is a sort of round robin in that Spywarebomb isn't considered actual malware, however I am of the opinion that the legitimate Spyware/Malware/Anti-virus scanner industry is making a mistake in this classification of SpywareBomb.

The reason is that Spywarebomb does slow the system down, does make unwanted and unsolicited changes to files without the computer owners knowledge, and has been known to access the internet.

Thus for all intents and purposes: If it walks like a duck, quacks like a duck and looks like a duck it's a duck, and in the case of Spywarebomb it walks, quacks, and looks like malware so obviously I take this seriously because Spybot S&D has been the highest integrity software product I have purchased to date. I'd like to make certain Spybot S&D is classifying this as malware, will detect it and remove it.

Sure variants arise, thus my mention of Threatfire from Pctools in my original post, I am sure there are a host of other similar offerings. Of course I hope Threatfire is legitimate and I am not dowloading it until I have some indication from users of these forums that Threatfire at least has been used and not caused them any problems.

Please know I found Threatfire while looking for answers to this SpywareBomb situation I had on my system and after reading the description of Threatfire thought maybe it may be useful and helpful when combined with a scanner such as Spybot S&D but due to what I was going through when I found it I am "gun shy" to download and try it out. This is irrespective of my personal knowledge of the manufacturer, a well known software utilities producer for over 20 years (from when I used to code in 6502 assembly on an Apple II).

My prime consideration is Sony settling out of court (though without admission of guilt) for their of attempt to spy on users who installed their music player some years ago, the install technically proven to modify the windows kernel of all things. So I am reluctant without some reassurance from others of the integrity of this Threatfire program, that it does what it says and nothing else just as Spybot S&D does, and of course if it does it could possibly assist Spybot S&D.

I do apologize for the long post however it seemed maybe you needed to know where I was coming from when I initially posted and how I am hoping you will help "separate the wheat from the chaf" regarding the links and the information they provide as it did scare the you know what out of me, especially after the other links infected me again, or so I thought due to Spython's scan results.

Thank you for reading and I honestly hope all of the companies whose product is acting in integrity would come to terms somehow with Microsoft on some sort of certification system so that we end users stop downloading a "spyware cleaner" on the basis of the criteria SpywareBomb or some variant creates only to find ourselves opening the door to myriad infections to our computer systems which were clean in the first place.

Thank you for the links too, the rogue/suspect anti-spyware products & websites link is a great help.

With great appreciation for your time,

WT


P.S. If I seem confused, maybe so, however I've had what appears numerous dis and mis informations regarding SpywareBomb and the various scanners or manual removal processes and though on one hand it seems to rest with the initial Spyhunter install there remains the fact that companies should not so easily be welcomed into our systems to scan for spyware or other issues, that there should be some means by Microsoft who makes the operating system to assure at least reputable companies are directing such activities that effect the performance of their Microsoft products. I submit that in my view if yours and the many other companies who make a product that works would work together creating a standard, and thus a method for certification, that you could easily lobby Microsoft for such a certification system (using keyed electronic security certificates from microsoft) which would protect us all while locking out these fly by night operations willing to subject us, the end user, to the emotional turmoil of appearing infected merely to sell their product that many times only leaves us open to infection, and, if nothing else, is interfering with our system's productive capacity that we purchased it for.