Wiz's Computer and Website Security Blog

This is the latest entry in a series about classifications of spam, according to my custom filter rules used by the anti-spam tool, MailWasher Pro.

MailWasher Pro is a spam screening program that goes between your email servers and your desktop email client (application). It uses a variety of techniques to recognize what is and isn't spam, including a learning filter and user created custom filter rules. I personally write and use MailWasher Pro custom filters to detect and delete most incoming spam email. I have created and published a large assortment of spam filters which "plug-in" to MailWasher Pro, to flag or delete known spam. You can read about them, or download and use them in your own registered copy of MailWasher Pro.

MailWasher Pro has a "Statistics" display page that breaks down the types of spam it has deleted, listed by categories. Each program and user-created filter has a name and when a measurable percentage of spam is matched by a particular filter it shows up in the Statistics, with its percentage shown next to it. The percentages for various categories of spam listed below are taken from my MailWasher Pro "Statistics" page.

The category "Other Filters" combines several of my custom filters which did not receive enough spam to rate a measurable percentage, thus were all grouped into the one category; "Other."

MailWasher Pro spam category breakdown for June 23 through 29, 2008.

Other filters: (See my MWP Filters page)	24.48%
Blacklisted Domains/Senders:	23.78%
Male enhancement spam (subject and body):	12.58%
"Opera Mail" Spam (Enlargement herbals):	11.19%
Pharmaceutical spam (inc. Viagra, Cialis, Levitra & misc. pills & herbals):	9.8%
"Apple Mail" Spam (Male Enhancement, etc):	5.59%
Counterfeit Watches:	4.90%
HTML Tricks:	2.80%
Pirated Software:	2.80%
DNS Blacklists:	2.10%

If you are reading this and wondering what you can do to reduce the huge volumes of spam emails that must be overwhelming your POP client inboxes, I recommend MailWasher Pro (with my downloadable custom filters) as an incoming email screener for your POP email program (Microsoft Outlook, Microsoft Outlook Express, Microsoft Live Mail, Eudora, Mozilla and other stand-alone email programs).

Posted by Wiz at 3:25 PM | Permalink

back to top ^

If you arrived here by searching for the name of some malware that may be on your computer and you are not currently using Spybot Search and Destroy, you can download the latest version from the Spybot Search and Destroy Multi-Lingual Landing Page. Choose your language, then use the link in the left sidebar to go to the downloads page. Download the program from your closest mirror server, install it, update it (Updates button), then follow the instructions below to detect and remove any malware that is on your PC.

If you already are using "Spybot Search and Destroy" and haven't updated it this week, be aware that updates to the definition files were released on schedule, on Wednesday this week, as listed below. Spyware and other classes of malicious programs are altered constantly to avoid detection by anti-spyware programs. Since Spybot S&D updates are only released on a weekly schedule (on Wednesdays) it is imperative that you make it a point to check for and download updates every week, preferably on Wednesday evenings. After downloading all available updates (from the best responding download server in the list of server locations), immunize*, then scan for and remove any detected malware. If Spybot is unable to remove an active threat it will ask for permission to run before Windows starts during the next reboot. Spybot will then run a complete scan before your Windows desktop loads, removing malware that has not yet loaded into memory.

If you see a program listed in the detections below, by name, you should assume that is is malware (with the possible exception of the PUP group, which is up to user discretion). All of the programs listed with a single + sign are updated detections, while a double ++ in front of it's name indicates a brand new detection. A number in parenthesis, following a malware name, indicates the number of variants included in that detection. These programs are dangerous to your computer, and/or personal security or privacy.

* After updating your Spybot S&D definitions, if they include new "immunization" definitions you need to click on the "Immunize" button, then, if the status line tells you that additional immunizations are possible, click on the Immunize link, near the top of the program. It has a green + sign in a button. If you don't do this the new immunizations against hostile ActiveX programs will not be applied. After immunizing with any new detections, run a scan for malware by clicking on the "Spybot Search & Destroy" button, on the left panel, then on the button with the magnifying glass icon, labeled: "Check For Problems."

Spybot Updates - published every Wednesday

Additions made on June 25, 2008:

Dialer (Dialers silently try to use your modem to call pay per minute numbers in foreign countries)
++ Win32.Agent.hy
Keyloggers (Keyloggers steal your typed logins and passwords)
+ HellzLittleSpy

Malware (Includes fake anti-virus and anti-spyware programs, like VirusHeat and Vario and fake registry cleaners)
++ AntispySpider
+ FakeAlert.cc
++ VistaAntivirus2008
+ Win32.BHO.je
++ Win32.Delf.avc
++ Win32.Settec.a
++ Win32.VB.eu
+ ZenoSearch

PUPS (Possibly Unpopular Software or Unwanted Programs)
++ WareSoft.Shutdown

Trojans (Includes 4 new or updated Zlob* Trojan detections)
+ Smitfraud-C.MSVPS
++ Virtumonde.cls
+ Virtumonde.dll
++ Virtumonde.prx
++ Virtumonde.sdn
++ Win32.Agent.bm
++ Win32.Bandok
++ Win32.CoiDung.a
++ Win32.Peed.Gen
+ Win32.PrivacySet
+ Zlob.Downloader
+ Zlob.Downloader.lor
+ Zlob.Downloader.pit
+ Zlob.Downloader.vdt

Total: 663265 fingerprints in 171141 rules for 4049 products !

False positive detections fixed this week:

The baidu.com search engine toolbar was removed from Spybot's Hosts redirections to 127.0.0.1, with the latest updates. It is no longer considered a threat.

If you get an alert about that detection for a file you think is legitimate you should submit it to Team Spybot for analysis.

* The "Zlob Trojan" is a common infection that has been in the wild since 2005. It is often downloaded intentionally by people who are tricked into thinking that they are installing some missing ActiveX Video Codec, or other (Java) application, needed to view a presentation, or pornographic movie. Once installed on the target computer the Zlob Trojan allows hackers to deliver all manner of downloaders, adware, fake anti-spyware and backdoor components to it. The Zlob family of Trojans are constantly modified by it's maintainers to try to avoid detection by anti-malware applications. These criminals earn commissions for every computer they infect with the Zlob and its companion products. Spybot Search and Destroy can detect and remove most known variants of the Zlob Trojans, with new definitions being released every Wednesday to detect the latest incarnations of Zlob.

Spybot Search & Destroy version 1.5.2, the latest release, is compatible with Windows Vista and features a nicer interface and sports a separate updater window and application. If you are still using version 1.4, I recommend that you update to 1.5.x, using the company links below.

There is a new version of Spybot S&D in public beta testing, version 1.6. I understand that it scans for threats much faster than 1.5.2 does. You are welcome to download it and try it out if you wish (please report bugs to the developers). It is a prelude to the upcoming version 2.0 incarnation of Spybot Search and Destroy.

Some users are having problems with Spybot S&D updates when running as less privileged users (Limited or Power Users). First off, less privileged users can no longer apply most immunization rules from within their accounts, unless they use the "Run as" command to run the program as an administrator. Your solution is to first run the Spybot Updater, from your Start menu > Programs > "Spybot - Search & Destroy" > "Update Spybot-S&D." The updater is now a separate application. To avoid possible account corruption from the rootkit detections, run the Spybot Updater before you open the actual Spybot S&D program. Download all available updates from the best server location (I prefer the Safer Networking servers). Exit the updater after all definitions have been installed and green checkmarks are displayed for all updates.

After the updater has exited you can right-click on the shortcut to Spybot S&D and "Run As" an administrator, with your administrator account password (only if you login as a Limited or Power User). When the program opens you should immediately use the Immunize button to apply the level of protection you desire to the selectable applications. These typically include major browsers, domains, cookies, and the Windows HOSTS file. If you are an advertiser or publisher in an affiliate network be sure you exclude cookies for your affiliate programs that are in the detections list, or you'll have problems logging into your affiliate accounts. I have to exclude Commission Junction and Linkshare detections in both cookies, domains and HOSTS immunizations. Apparently, the authors of Spybot are down on advertising cookies and domains. Oh well (sigh).

Another problem being reported is when you run some versions of Spybot S&D it stops with a warning about problems including the file C:\Program Files\Spybot-Search_Destroy\Includes\TrojansC.sbi. The current errors with the Trojans.sbi and TrojansC.sbi files are caused by new detection rules that are incompatible with versions of Spybot prior to 1.5.2. These new detection rules use the new Anti-Rootkit plugins #1, #2 and #3 that only have been offered as updates to Spybot 1.5.2. If you upgrade to Spybot 1.5.2 you will not only eliminate the error messages but in also will be performing rootkit searches while doing a Spybot "Check for problems".

English Language Company Links:
Spybot Search and Destroy English Home Page
Spybot Search and Destroy (Multi-Lingual Landing Page. Choose your language).
Spybot Search and Destroy Download page - Program and definition updates. You can download the latest version of Spybot S&D plus definition and tool updates here for inclusion later on.
Full tutorial about using and setting up Spybot Search and Destroy
Spybot Search and Destroy Update History

See all security program update notices in this catagory

A consequence of acquiring many of the parasites, keyloggers, hijackers and downloaders is that their files and startup settings are usually saved to your System Restore hidden folder, from whence they are automatically restored upon rebooting the computer. To completely remove these threats, and others, you should disable System Restore, then reboot, then clean all threats, then re-start System Restore, setting a new Restore Point, with a clean machine. Many people overlook this and are constantly reinfected after removing threats. There are few, if any security programs that can clean or remove infected files that are backed up in your protected System Restore directory.

To disable System Restore, go to My Computer and right-click on it's icon. From the flyout options select Properties. From the "System Properties" select the "System Restore" tab. There you will find a checkbox labeled "Turn off System Restore." Check it, then click Apply and wait while the System Restore files are deleted (takes some time). After the deletions are finished, click OK to close the Properties box, then reboot.

When you have thoroughly removed all infections follow the same procedure as above, unchecking the box that turned off System Restore.

In the event that Spybot mistakenly removes a file(s) due to a faulty detection update (a.k.a False Positive), you can restore it from the program itself. Just click on the "Recovery" button, that looks like a first aid kit, with a red cross in it, then locate the item(s) you wish to restore. Click on the select box(es) on the left of the detection name(s), to place a check mark in it/them, then click on "Recover selected items." The files, and/or registry entries will be replaced, from where they were deleted. The Spybot forums have discussions about false positives here.

For those of you who have not yet used Spybot Search and Destroy, if you were wondering if it "plays nice" with other anti spyware programs, it most certainly does! I have used Spybot S&D since it's inception, along with various other free and commercial security programs, and it has never caused any problems on my, or my customers' computers.

Spybot Search and Destroy has a Malware Removal Forum where trained volunteers can help you with spyware removal problems.

Finally, as an individuals who benefits from the free software that is produced and updated by the good folks who run Spybot Search and Destroy, at their own expense, it won't hurt us to send occasional donations to them, to help them financially in their efforts. There is a donate button on most pages of the Spybot S & D website. Think seriously about using it. Send what you can.

Posted by Wiz at 7:07 PM | Permalink

back to top ^

This is the latest entry in a series about classifications of spam, according to my custom filter rules used by the anti-spam tool, MailWasher Pro.

In the beginning of this series I was using MailWasher Pro filters exclusively, to detect and delete incoming spam email. Since then I have instituted email spam filters on my website's mail server, which has greatly reduced the amount of spam I see at all. The balance that does get through is identified and either flagged as spam, or instantly deleted, by my POP3 mail anti-spam tool; MailWasher Pro. MailWasher Pro identifies what is spam by a combination of methods, including the use of custom written personal spam filter rules. I have created a large assortment of spam filters which "plug-in" to MailWasher Pro, to flag or delete known spam. You can read about them, or download and use them in your own registered copy of MailWasher Pro.

The percentages for various categories of spam listed below are taken from my MailWasher Pro "Statistics" page. I am no longer stating the overall percentage of spam to good email, due to the huge effect my cPanel mail server filters on reducing the overall volume of junk mail. What does get through my server filters is still representative of what types of spam others are seeing and the same categories occupy the top positions for me as they do for you.

The category "Other Filters" combines several of my custom filters which did not receive enough spam to rate a measurable percentage, thus were all grouped into the one category.

MailWasher Pro spam category breakdown for June 16 through 22, 2008.

Male enhancement spam (subject and body):	26.88%
Other filters: (See my MWP Filters page)	23.66%
"Apple Mail" Spam (Male Enhancement, etc):	13.98%
Hidden ISO Subject:	7.53%
Pharmaceutical spam (inc. Viagra, Cialis, Levitra & misc. pills):	5.38%
Digits or Consonants forged sender:	5.38%
Counterfeit Watches:	4.30%
Blacklisted Domains/Senders:	4.23%
"Opera Mail" Spam (Enlargement herbals):	3.23%
HTML Tricks:	3.23%
DNS Blacklists:	2.15%
Bayesian learning filter:	1.08%

If you are reading this and wondering what you can do to reduce the huge volumes of spam emails that must be overwhelming your POP client inboxes, I recommend MailWasher Pro (with my downloadable custom filters) as an incoming email screener for your POP email program (Microsoft Outlook, Microsoft Outlook Express, Microsoft Live Mail, Eudora, Mozilla and other stand-alone email programs).

Posted by Wiz at 3:08 PM | Permalink

back to top ^

Apple updates Safari browser for Windows with four security patches
June 19, 2008

Today, June 19, 2008, Apple Inc. released four security patches to fix critical vulnerabilities in its Safari browser. One of those fixes was for what has become known as the "Safari carpet-bombing exploit," which Apple had previously discounted as a feature, not a security vulnerability. This is a condition allowed by the unpatched Safari browser that allowed unacknowledged downloading of multiple executable files to a user's desktop. These files could in turn interact with Windows in a special way that would actually launch the setup routines for malware applications - downloaded to your desktop, without your knowledge or explicit permission.

The danger lies in the fact that a user typically has a browser opened to a large size on their desktop, along with other application windows, obscuring the desktop from view. If that browser is an unpatched version of Apple's Safari browser and the user is either enticed, or invisibly redirected to a hostile download site, the malware setup files will be silently downloaded to that user's desktop, where they may be executed by Windows, before the user is even aware they were downloaded. This could lead to instant system takeover, where the malware would run with the same privileges as the logged in user.

The Safari update is only for Windows users, not Mac OSX versions. Version 3.1.2 of Safari for Windows can be downloaded and installed from Apple Downloads.

Carpet bombing attack
This patch only affects users of Windows XP or Vista. The update addresses CVE-2008-2540, a vulnerability in how Windows desktop handles executable files. Apple explains: "Saving an untrusted file to the Windows desktop may trigger the issue, and lead to the execution of arbitrary code. Web browsers are a means by which files may be saved to the desktop. To help mitigate this issue, the Safari browser has been updated to prompt the user prior to saving a download file. Also, the default download location is changed to the user's Downloads folder on Windows Vista, and to the user's Documents folder on Windows XP."

Internet Explorer 7
This patch only affects users of Windows XP or Vista. The update addresses CVE-2008-2306 which is an Internet Explorer 7 vulnerability. Apple explains: "If a Web site is in an Internet Explorer 7 zone with the 'Launching applications and unsafe files' setting set to 'Enable,' or if a Web site is in the Internet Explorer 6 'Local intranet' or 'Trusted sites' zone, Safari will automatically launch executable files that are downloaded from the site. This update addresses the issue by not automatically launching downloaded executable files, and by prompting the user before downloading a file if the 'always prompt' setting is enabled."

BMP or GIF image memory error
This patch only affects users of Windows XP or Vista. The update addresses CVE-2008-1573, an out-of-bounds memory read vulnerability. The error may occur in the handling of BMP and GIF images, which may lead to the disclosure of memory contents.

WebKit Javascript array
This patch only affects users of Windows XP or Vista. The update addresses CVE-2008-2307, which is a memory corruption vulnerability. An error exists in WebKit's handling of JavaScript arrays, so visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.

If you currently have Safari browser installed on your computer you should update it immediately, whether you use it regularly or not.

The reason Windows would launch these executables downloaded to your desktop is because the "Windows Desktop" is actually the system file named "Explorer.exe" and it is on the "path" for launching setup files as they are downloaded, or opened from a CD, DVD, or thumbdrive. This has now been corrected by both Microsoft and Apple, with this month's updates.

Posted by Wiz at 11:54 PM | Permalink

back to top ^

If you arrived here by searching for the name of some malware that may be on your computer and you are not currently using Spybot Search and Destroy, you can download the latest version from the Spybot Search and Destroy Multi-Lingual Landing Page. Choose your language, then use the link in the left sidebar to go to the downloads page. Download the program from your closest mirror server, install it, update it (Updates button), then follow the instructions below to detect and remove any malware that is on your PC.

If you already are using "Spybot Search and Destroy" and haven't updated it this week, be aware that updates to the definition files were released on schedule, on Wednesday this week, as listed below. Spyware and other classes of malicious programs are altered constantly to avoid detection by anti-spyware programs. Since Spybot S&D updates are only released on a weekly schedule (on Wednesdays) it is imperative that you make it a point to check for and download updates every week, preferably on Wednesday evenings. After downloading all available updates (from the best responding download server in the list of server locations), immunize*, then scan for and remove any detected malware. If Spybot is unable to remove an active threat it will ask for permission to run before Windows starts during the next reboot. Spybot will then run a complete scan before your Windows desktop loads, removing malware that has not yet loaded into memory.

If you see a program listed in the detections below, by name, you should assume that is is malware (with the possible exception of the PUP group, which is up to user discretion). All of the programs listed with a single + sign are updated detections, while a double ++ in front of it's name indicates a brand new detection. A number in parenthesis, following a malware name, indicates the number of variants included in that detection. These programs are dangerous to your computer, and/or personal security or privacy.

* After updating your Spybot S&D definitions, if they include new "immunization" definitions you need to click on the "Immunize" button, then, if the status line tells you that additional immunizations are possible, click on the Immunize link, near the top of the program. It has a green + sign in a button. If you don't do this the new immunizations against hostile ActiveX programs will not be applied. After immunizing with any new detections, run a scan for malware by clicking on the "Spybot Search & Destroy" button, on the left panel, then on the button with the magnifying glass icon, labeled: "Check For Problems."

Spybot Updates - published every Wednesday

Additions made on June 18, 2008:

Adware
++ My811.Toolbar
++ Pointfree
+ Zango.ShoppingReport Hijacker

Keyloggers (Keyloggers steal your typed logins and passwords)
+ Ardamax

Malware (Includes fake anti-virus and anti-spyware programs, like VirusHeat and Vario and fake registry cleaners)
+ AntiSpyStorm
+ Fraud.Antivirus2008
+ SpyHunter
+ VirusHeat
+ Win32.Agent.ys
+ Win32.BHO.je
++ Win32.Lmir.asy
+ Win32.Renos
++ Win32.Small.buy
++ Win32.Virut.be
++ WinSpywareProtect
+ Zlob.Command Service

PUPS (Possibly Unpopular Software or Unwanted Programs)
+ Network Monitor

Trojans (Includes 3 new or updated Zlob* Trojan detections)
++ BHO.CenterLock
++ FakeIkeaPlugin
++ FlashExploit
+ Smitfraud-C.MSVPS
+ Virtumonde.dll
+ Win32.Agent.aou
++ Win32.Agent.awz
++ Win32.Bifrose.fmr
++ Win32.Delf.bd
++ Win32.Exchanger.ch
++ Win32.IRCBot.are
++ Win32.KillAVGenerator
++ Win32.KillFW
++ Win32.PCClient
++ Win32.PrivacySet
++ Win32.VB.cez
++ Win32.VB.h
++ Win32.Winlagons.co
+ Win32.Zhelatin.ah
++ Zlob.Downloader.lor
+ Zlob.Downloader.pit
+ Zlob.Downloader.vdt

Total: 638393 fingerprints in 164156 rules for 4033 products !

False positive detections fixed this week:
A detection of "Zlob.Downloader.jau" in the SYSTEMAX.bmp desktop wallpaper is a false positive that has been fixed in this week's updates.

If you get an alert about that detection for a file you think is legitimate you should submit it to Team Spybot for analysis.

* The "Zlob Trojan" is a common infection that has been in the wild since 2005. It is often downloaded intentionally by people who are tricked into thinking that they are installing some missing ActiveX Video Codec, or other (Java) application, needed to view a presentation, or pornographic movie. Once installed on the target computer the Zlob Trojan allows hackers to deliver all manner of downloaders, adware, fake anti-spyware and backdoor components to it. The Zlob family of Trojans are constantly modified by it's maintainers to try to avoid detection by anti-malware applications. These criminals earn commissions for every computer they infect with the Zlob and its companion products. Spybot Search and Destroy can detect and remove most known variants of the Zlob Trojans, with new definitions being released every Wednesday to detect the latest incarnations of Zlob.

Spybot Search & Destroy version 1.5.2, the latest release, is compatible with Windows Vista and features a nicer interface and sports a separate updater window and application. If you are still using version 1.4, I recommend that you update to 1.5.x, using the company links below.

There is a new version of Spybot S&D in public beta testing, version 1.6. I understand that it scans for threats much faster than 1.5.2 does. You are welcome to download it and try it out if you wish (please report bugs to the developers). It is a prelude to the upcoming version 2.0 incarnation of Spybot Search and Destroy.

Some users are having problems with Spybot S&D updates when running as less privileged users (Limited or Power Users). First off, less privileged users can no longer apply most immunization rules from within their accounts, unless they use the "Run as" command to run the program as an administrator. Your solution is to first run the Spybot Updater, from your Start menu > Programs > "Spybot - Search & Destroy" > "Update Spybot-S&D." The updater is now a separate application. To avoid possible account corruption from the rootkit detections, run the Spybot Updater before you open the actual Spybot S&D program. Download all available updates from the best server location (I prefer the Safer Networking servers). Exit the updater after all definitions have been installed and green checkmarks are displayed for all updates.

After the updater has exited you can right-click on the shortcut to Spybot S&D and "Run As" an administrator, with your administrator account password (only if you login as a Limited or Power User). When the program opens you should immediately use the Immunize button to apply the level of protection you desire to the selectable applications. These typically include major browsers, domains, cookies, and the Windows HOSTS file. If you are an advertiser or publisher in an affiliate network be sure you exclude cookies for your affiliate programs that are in the detections list, or you'll have problems logging into your affiliate accounts. I have to exclude Commission Junction and Linkshare detections in both cookies, domains and HOSTS immunizations. Apparently, the authors of Spybot are down on advertising cookies and domains. Oh well (sigh).

Another problem being reported is when you run some versions of Spybot S&D it stops with a warning about problems including the file C:\Program Files\Spybot-Search_Destroy\Includes\TrojansC.sbi. The current errors with the Trojans.sbi and TrojansC.sbi files are caused by new detection rules that are incompatible with versions of Spybot prior to 1.5.2. These new detection rules use the new Anti-Rootkit plugins #1, #2 and #3 that only have been offered as updates to Spybot 1.5.2. If you upgrade to Spybot 1.5.2 you will not only eliminate the error messages but in also will be performing rootkit searches while doing a Spybot "Check for problems".

English Language Company Links:
Spybot Search and Destroy English Home Page
Spybot Search and Destroy (Multi-Lingual Landing Page. Choose your language).
Spybot Search and Destroy Download page - Program and definition updates. You can download the latest version of Spybot S&D plus definition and tool updates here for inclusion later on.
Full tutorial about using and setting up Spybot Search and Destroy
Spybot Search and Destroy Update History

See all security program update notices in this catagory

A consequence of acquiring many of the parasites, keyloggers, hijackers and downloaders is that their files and startup settings are usually saved to your System Restore hidden folder, from whence they are automatically restored upon rebooting the computer. To completely remove these threats, and others, you should disable System Restore, then reboot, then clean all threats, then re-start System Restore, setting a new Restore Point, with a clean machine. Many people overlook this and are constantly reinfected after removing threats. There are few, if any security programs that can clean or remove infected files that are backed up in your protected System Restore directory.

To disable System Restore, go to My Computer and right-click on it's icon. From the flyout options select Properties. From the "System Properties" select the "System Restore" tab. There you will find a checkbox labeled "Turn off System Restore." Check it, then click Apply and wait while the System Restore files are deleted (takes some time). After the deletions are finished, click OK to close the Properties box, then reboot.

When you have thoroughly removed all infections follow the same procedure as above, unchecking the box that turned off System Restore.

In the event that Spybot mistakenly removes a file(s) due to a faulty detection update (a.k.a False Positive), you can restore it from the program itself. Just click on the "Recovery" button, that looks like a first aid kit, with a red cross in it, then locate the item(s) you wish to restore. Click on the select box(es) on the left of the detection name(s), to place a check mark in it/them, then click on "Recover selected items." The files, and/or registry entries will be replaced, from where they were deleted. The Spybot forums have discussions about false positives here.

For those of you who have not yet used Spybot Search and Destroy, if you were wondering if it "plays nice" with other anti spyware programs, it most certainly does! I have used Spybot S&D since it's inception, along with various other free and commercial security programs, and it has never caused any problems on my, or my customers' computers.

Spybot Search and Destroy has a Malware Removal Forum where trained volunteers can help you with spyware removal problems.

Finally, as an individuals who benefits from the free software that is produced and updated by the good folks who run Spybot Search and Destroy, at their own expense, it won't hurt us to send occasional donations to them, to help them financially in their efforts. There is a donate button on most pages of the Spybot S & D website. Think seriously about using it. Send what you can.

Posted by Wiz at 1:06 PM | Permalink

back to top ^

This is the latest entry in a series about classifications of spam, according to my custom filter rules used by the anti-spam tool, MailWasher Pro.

In the beginning of this series I was using MailWasher Pro filters exclusively, to detect and delete incoming spam email. Since then I have instituted email spam filters on my website's mail server, which has greatly reduced the amount of spam I see at all. The balance that does get through is identified and either flagged as spam, or instantly deleted, by my POP3 mail anti-spam tool; MailWasher Pro. MailWasher Pro identifies what is spam by a combination of methods, including the use of custom written personal spam filter rules. I have created a large assortment of spam filters which "plug-in" to MailWasher Pro, to flag or delete known spam. You can read about them, or download and use them in your own registered copy of MailWasher Pro.

The percentages for various categories of spam listed below are taken from my MailWasher Pro "Statistics" page. I am no longer stating the overall percentage of spam to good email, due to the huge effect my cPanel mail server filters on reducing the overall volume of junk mail. What does get through my server filters is still representative of what types of spam others are seeing and the same categories occupy the top positions for me as they do for you.

The category "Other Filters" combines several of my custom filters which did not receive enough spam to rate a measurable percentage, thus were all grouped into the one category.

MailWasher Pro spam category breakdown for June 9 through 15, 2008.

Other filters: (See my MWP Filters page)	23.53%
Pharmaceutical spam (inc. Viagra, Cialis, Levitra & misc. pills):	23.53%
Male enhancement spam (subject and body):	17.65%
"Apple Mail" Spam Botnet:	12.94%
Loans/Bankruptcy/Insurance Scams:	7.07%
Known Spam (From: or Body):	5.88%
Digits or Consonants forged sender:	4.71%
Counterfeit Watches:	4.71%
Counterfeit clothing and shoes:	3.53%
Blacklisted Domains/Senders:	2.35%
Bayesian learning filter:	1.18%

If you are reading this and wondering what you can do to reduce the huge volumes of spam emails that must be overwhelming your POP client inboxes, I recommend MailWasher Pro (with my downloadable custom filters) as an incoming email screener for your POP email program (Microsoft Outlook, Microsoft Outlook Express, Microsoft Live Mail, Eudora, Mozilla and other stand-alone email programs).

Posted by Wiz at 11:49 AM | Permalink

back to top ^

If you arrived here by searching for the name of some malware that may be on your computer and you are not currently using Spybot Search and Destroy, you can download the latest version from the Spybot Search and Destroy Multi-Lingual Landing Page. Choose your language, then use the link in the left sidebar to go to the downloads page. Download the program from your closest mirror server, install it, update it (Updates button), then follow the instructions below to detect and remove any malware that is on your PC.

If you already are using "Spybot Search and Destroy" and haven't updated it this week, be aware that updates to the definition files were released on schedule, on Wednesday this week, as listed below. Spyware and other classes of malicious programs are altered constantly to avoid detection by anti-spyware programs. Since Spybot S&D updates are only released on a weekly schedule (on Wednesdays) it is imperative that you make it a point to check for and download updates every week, preferably on Wednesday evenings. After downloading all available updates (from the best responding download server in the list of server locations), immunize*, then scan for and remove any detected malware. If Spybot is unable to remove an active threat it will ask for permission to run before Windows starts during the next reboot. Spybot will then run a complete scan before your Windows desktop loads, removing malware that has not yet loaded into memory.

If you see a program listed in the detections below, by name, you should assume that is is malware (with the possible exception of the PUP group, which is up to user discretion). All of the programs listed with a single + sign are updated detections, while a double ++ in front of it's name indicates a brand new detection. A number in parenthesis, following a malware name, indicates the number of variants included in that detection. These programs are dangerous to your computer, and/or personal security or privacy.

* After updating your Spybot S&D definitions, if they include new "immunization" definitions you need to click on the "Immunize" button, then, if the status line tells you that additional immunizations are possible, click on the Immunize link, near the top of the program. It has a green + sign in a button. If you don't do this the new immunizations against hostile ActiveX programs will not be applied. After immunizing with any new detections, run a scan for malware by clicking on the "Spybot Search & Destroy" button, on the left panel, then on the button with the magnifying glass icon, labeled: "Check For Problems."

Spybot Updates - published every Wednesday

Additions made on June 11, 2008:

Adware
++ HackNuke
++ Win32.Hacktool
+ Zango
+ Zango.ShoppingReport
+ Zango.WeatherDPA

Dialer (Dialers silently try to use your modem to call pay per minute numbers in foreign countries)
+ Coulomb Ltd.Content Access Plugin

Keyloggers (Keyloggers steal your typed logins and passwords)
++ PerfectKeylogger

Malware (Includes fake anti-virus and anti-spyware programs, like VirusHeat and Vario and fake registry cleaners)
+ AdvancedCleaner
++ Munga_Bunga.HDDFormat
++ Netcom3Cleaner
++ RegistryPatrol
+ Win32.BHO.je
++ Windows.Antivirus2008

PUPS (Possibly Unpopular Software or Unwanted Programs)
++ BitAccelerator

Security
+ Microsoft.Windows.RedirectedHosts

Trojans (Includes 3 updated Zlob* Trojan detections)
+ 180Solutions.SearchAssistant
++ CoolWWWSearch.hjg
+ Smitfraud-C.MSVPS
+ Virtumonde.dll
++ Win32.Agent.ghs
++ Win32.Agent.LKF
++ Win32.Agent.SB
++ Win32.Serv-U.gen
+ Win32.Small.azl
+ Win32.Small.r
+ Zlob.Downloader
+ Zlob.Downloader.pit
+ Zlob.Downloader.vdt

Total: 628606 fingerprints in 163231 rules for 3998 products !

False positive detections fixed this week:
A detection of "Zlob.Downloader.jau" in the SYSTEMAX.bmp desktop wallpaper is a false positive that has been fixed in next week's updates.

Also fixed this week is the detection of "RegistryHelper" in the Disk Cleaner program. If you have Disk Cleaner and Spybot broke it by removing necessary files, you should restore them from backups made by Spybot.

If you get an alert about that detection for a file you think is legitimate you should submit it to Team Spybot for analysis.

* The "Zlob Trojan" is a common infection that has been in the wild since 2005. It is often downloaded intentionally by people who are tricked into thinking that they are installing some missing ActiveX Video Codec, or other (Java) application, needed to view a presentation, or pornographic movie. Once installed on the target computer the Zlob Trojan allows hackers to deliver all manner of downloaders, adware, fake anti-spyware and backdoor components to it. The Zlob family of Trojans are constantly modified by it's maintainers to try to avoid detection by anti-malware applications. These criminals earn commissions for every computer they infect with the Zlob and its companion products. Spybot Search and Destroy can detect and remove most known variants of the Zlob Trojans, with new definitions being released every Wednesday to detect the latest incarnations of Zlob.

Spybot Search & Destroy version 1.5.2, the latest release, is compatible with Windows Vista and features a nicer interface and sports a separate updater window and application. If you are still using version 1.4, I recommend that you update to 1.5.x, using the company links below.

There is a new version of Spybot S&D in public beta testing, version 1.6. I understand that it scans for threats much faster than 1.5.2 does. You are welcome to download it and try it out if you wish (please report bugs to the developers). It is a prelude to the upcoming version 2.0 incarnation of Spybot Search and Destroy.

Some users are having problems with Spybot S&D updates when running as less privileged users (Limited or Power Users). First off, less privileged users can no longer apply most immunization rules from within their accounts, unless they use the "Run as" command to run the program as an administrator. Your solution is to first run the Spybot Updater, from your Start menu > Programs > "Spybot - Search & Destroy" > "Update Spybot-S&D." The updater is now a separate application. To avoid possible account corruption from the rootkit detections, run the Spybot Updater before you open the actual Spybot S&D program. Download all available updates from the best server location (I prefer the Safer Networking servers). Exit the updater after all definitions have been installed and green checkmarks are displayed for all updates.

After the updater has exited you can right-click on the shortcut to Spybot S&D and "Run As" an administrator, with your administrator account password (only if you login as a Limited or Power User). When the program opens you should immediately use the Immunize button to apply the level of protection you desire to the selectable applications. These typically include major browsers, domains, cookies, and the Windows HOSTS file. If you are an advertiser or publisher in an affiliate network be sure you exclude cookies for your affiliate programs that are in the detections list, or you'll have problems logging into your affiliate accounts. I have to exclude Commission Junction and Linkshare detections in both cookies, domains and HOSTS immunizations. Apparently, the authors of Spybot are down on advertising cookies and domains. Oh well (sigh).

Another problem being reported is when you run some versions of Spybot S&D it stops with a warning about problems including the file C:\Program Files\Spybot-Search_Destroy\Includes\TrojansC.sbi. The current errors with the Trojans.sbi and TrojansC.sbi files are caused by new detection rules that are incompatible with versions of Spybot prior to 1.5.2. These new detection rules use the new Anti-Rootkit plugins #1, #2 and #3 that only have been offered as updates to Spybot 1.5.2. If you upgrade to Spybot 1.5.2 you will not only eliminate the error messages but in also will be performing rootkit searches while doing a Spybot "Check for problems".

English Language Company Links:
Spybot Search and Destroy English Home Page
Spybot Search and Destroy (Multi-Lingual Landing Page. Choose your language).
Spybot Search and Destroy Download page - Program and definition updates. You can download the latest version of Spybot S&D plus definition and tool updates here for inclusion later on.
Full tutorial about using and setting up Spybot Search and Destroy
Spybot Search and Destroy Update History

See all security program update notices in this catagory

A consequence of acquiring many of the parasites, keyloggers, hijackers and downloaders is that their files and startup settings are usually saved to your System Restore hidden folder, from whence they are automatically restored upon rebooting the computer. To completely remove these threats, and others, you should disable System Restore, then reboot, then clean all threats, then re-start System Restore, setting a new Restore Point, with a clean machine. Many people overlook this and are constantly reinfected after removing threats. There are few, if any security programs that can clean or remove infected files that are backed up in your protected System Restore directory.

To disable System Restore, go to My Computer and right-click on it's icon. From the flyout options select Properties. From the "System Properties" select the "System Restore" tab. There you will find a checkbox labeled "Turn off System Restore." Check it, then click Apply and wait while the System Restore files are deleted (takes some time). After the deletions are finished, click OK to close the Properties box, then reboot.

When you have thoroughly removed all infections follow the same procedure as above, unchecking the box that turned off System Restore.

In the event that Spybot mistakenly removes a file(s) due to a faulty detection update (a.k.a False Positive), you can restore it from the program itself. Just click on the "Recovery" button, that looks like a first aid kit, with a red cross in it, then locate the item(s) you wish to restore. Click on the select box(es) on the left of the detection name(s), to place a check mark in it/them, then click on "Recover selected items." The files, and/or registry entries will be replaced, from where they were deleted. The Spybot forums have discussions about false positives here.

For those of you who have not yet used Spybot Search and Destroy, if you were wondering if it "plays nice" with other anti spyware programs, it most certainly does! I have used Spybot S&D since it's inception, along with various other free and commercial security programs, and it has never caused any problems on my, or my customers' computers.

Spybot Search and Destroy has a Malware Removal Forum where trained volunteers can help you with spyware removal problems.

Finally, as an individuals who benefits from the free software that is produced and updated by the good folks who run Spybot Search and Destroy, at their own expense, it won't hurt us to send occasional donations to them, to help them financially in their efforts. There is a donate button on most pages of the Spybot S & D website. Think seriously about using it. Send what you can.

Posted by Wiz at 1:51 PM | Permalink

back to top ^

I began experiencing problems Monday night (June 9), after using Acronis True Image 11 to restore my Windows XP Professional SP3 computer, after an experiment trying to convert my setup from single SATA to SATA RAID failed miserably. Lesson #1: If the OS is already installed and you were thinking about converting the boot system to RAID, FORGET IT!

After I finally forced my boot drive out of being labeled as a dynamic RAID disk I was able to load a saved image onto it and boot back into Windows XP (SP3), after 13+ hours of downtime. More on how I did this in my extended comments section.

Anyway, once I finally got back into Windows I left the computer alone for a while and did other things. When I came back to check for new email and see if my scheduled Windows and Acronis backup tasks were running all I saw was a hideous BSOD, with a Stop Error labeled: "BAD_POOL_HEADER," followed by these machine debug codes: STOP: 0x00000019, 0xE106F3F8, 0xE106F418, 0x0C040401. At first I thought this was a simple glitch, but I found out it wasn't, later on. My solution is further down this article.

While I was trying over and over to restore my saved image, using the Acronis Recovery CD, to one of the 250 Gb hard drives that I mucked by by initializing RAID, I noticed that my external USB drive was not listed as an accessible location for restoring a backup image, even though it was connected and turned on. I had images on both an internal and external hard drive, with the most recent being on the USB drive. So, I got out of Acronis and tried booting from my Ubuntu Hardy Heron (8.04) live CD. My intention was to copy the newer image from the USB disk to the internal backup disk. When I got into the Linux desktop and opened "Computer" I saw both the internal and external disks, with their correct disk labels, but was unable to "mount" (open) either of them! The error message pop-up contained the following information (my interpretation, not verbatim):

This disk cannot be mounted because it is marked as being in use by Windows. This is sometimes caused by improperly removing a connected device without first ejecting it using the "Safely Remove Hardware Wizard."

This started me thinking about how the last time I used the external USB drive, when I was done saving an image to it I reached behind it and flipped the power switch off, instead of "safely stopping and removing" it. Lesson number two: always use the Safely Remove Hardware utility to stop/eject your USB devices!

So, here I was, back in Windows again, with the USB drive turned on and fully visible through My Computer. I dutifully went to the System Tray and right-clicked on the Safely Remove Hardware icon, to do it the right way, and was greeted by another cryptic pop-up error message, saying:

"An exception occurred while trying to run "Shell32.dll, Control_RunDLL hotplug.dll."

A Google search for that exception brought me to this page on the Acronis True Image Forum (reply #69), at Wilderssecurity.com. The cause of the hotplug.dll failure was an invisibly corrupted registry entry for each of the volumes labeled as a "Generic Volume." Apparently, when these disks were restored by Acronis True Image their registry entries were not "NULL Terminated," and one had the letter H appended to it's description, in Device Manager > (View Hidden Devices option selected) > Storage Volumes >> Generic Volume. To fix the problem all I had to do was right click on each generic volume and select Update Driver. After all of these disks were "updated" I rebooted and the exception in hotplug.dll was gone.

How I fixed the BSOD Stop Error BAD_POOL_HEADER
In the beginning of this article I told you about getting a BSOD whenever a scheduled Windows Backup requiring "shadow copy" was initiated (save System State). I narrowed this down to only a System State backup causing the Stop Error. The solution was similar to the hotplug issue, but, instead of "Updating" the driver for each Generic Volume, I "Uninstalled" each of them, then rebooted twice. After the second reboot they were fully re-detected and ready to use and the hotplug problem was also gone. This is probably the best way to fix these problems.

How I got my failed marked-as-RAID hard drives back to basic disks

At the top of this article I mentioned my 13 hour fight to restore a saved Acronis True Image 11 backup file to my SATA boot drive. In the beginning of this battle I learned that even though I never fully created a RAID array, nor attempted to load the OS onto it, the very fact that I attempted to create the Array "marked" the two disks as "dynamic RAID volumes." As such I was unable to restore the saved image, MBR and Bootsector to them. Furthermore, the BIOS did not see either of these disks anymore, on the SATA Controller. This was after I re-entered the BIOS and Disabled the built-in RAID Controller.

What I finally had to do was dig up my two disk, long-unused, Partition Magic 8.0 bootable floppy diskette set and boot into it's GUI. Inside the Partition Magic DOS interface I was finally able to delete the entire partitions on those two hard drives, leaving them unformatted, as unallocated disks, in the maximum amount available (no space before or after the deleted partition). This effectively removed the "dynamic" and "RAID" bootsector marking that was preventing them from being used as destination drives for the saved image file. You can also use the Secure Shredder utility in the Acronis Recovery CD, but this takes several hours. If you have any bootable DOS disks available and one has Fdisk on it, run Fdisk and delete all of the partitions on the disks that were mis-labeled as RAID disks, leaving them unformatted. Also remove the active partition, just leaving it/them as unallocated disks, with the full space available for use and no drive letters assigned. Acronis Recovery CD will see them once the BIOS sees them and will allow you to restore your image to the unallocated disk of your choice. Just be sure you select the option to restore the entire disk containing both the partitions and MBR/Bootsector.

After changing the SATA disks into unallocated space the Acronis Recovery CD had no trouble restoring my saved image to the one that became the "C" boot disk once again. It took a couple of reboots for the BIOS to recognize the restored C drive before I was able to boot into Windows from it, but all was back to normal, with the exception of the hotplug and Bad_Pool_Headers shutdown problems, solved earlier in this article. I am now using the second SATA disk (Drive letter D) for daily backups, instead of the slower IDE drive I was using before.

The only other problem that I had was a corrupted Index in the C drive's MFT, which was fixed by running Chkdsk /P on both the boot and backup disks, during startup (I used Recovery Console commands). If you have this problem with Acronis True Image 11 refusing to make a backup because of a corrupted MFT Bitmap, open My Computer, then right click on each hard disk listed, choose "Properties" > "the Tools" tab, then under Error Checking, click the button labeled "Check Now." When the options box appears check the option to "Automatically fix file system errors," then click Apply to begin. When you try this on your boot drive it will not allow you to proceed within Windows. You will be asked if you want to schedule a disk check to run on the next boot-up. Click Yes. Let Chkdsk run on the backup drive, then close all open programs, then reboot. Do not touch any keys when the Disk check screen appears, or you will cancel the check. When it has completed the computer will reboot automatically.

Posted by Wiz at 2:16 AM | Permalink

back to top ^

This is the latest entry in a series about classifications of spam, according to my custom filter rules used by the anti-spam tool, MailWasher Pro.

In the beginning of this series I was using MailWasher Pro filters exclusively, to detect and delete incoming spam email. Since then I have instituted email spam filters on my website's mail server, which has greatly reduced the amount of spam I see at all. The balance that does get through is identified and either flagged as spam, or instantly deleted, by my POP3 mail anti-spam tool; MailWasher Pro. MailWasher Pro identifies what is spam by a combination of methods, including the use of custom written personal spam filter rules. I have created a large assortment of spam filters which "plug-in" to MailWasher Pro, to flag or delete known spam. You can read about them, or download and use them in your own registered copy of MailWasher Pro.

The percentages for various categories of spam listed below are taken from my MailWasher Pro "Statistics" page. I am no longer stating the overall percentage of spam to good email, due to the huge effect my cPanel mail server filters on reducing the overall volume of junk mail. What does get through my server filters is still representative of what types of spam others are seeing and the same categories occupy the top positions for me as they do for you.

The category "Other Filters" combines several of my custom filters which did not receive enough spam to rate a measurable percentage, thus were all grouped into the one category.

MailWasher Pro spam category breakdown for June 2 through 8, 2008.

Other filters: (See my MWP Filters page)	23.23%
Pharmaceutical spam (inc. Viagra, Cialis, Levitra & misc. pills):	16.16%
Male enhancement spam (subject and body):	18.18%
Apple Mail Spam:	12.12%
Loans/Bankruptcy/Insurance Scams:	7.07%
Nigerian 419 Scams:	5.05%
Blacklisted (Mostly Nigerian 419 scams):	6.06%
Digits or Consonants forged sender:	6.06%
HTML Tricks:	4.04%
DNS Blacklists:	1.01%
Bayesian learning filter:	1.01%

If you are reading this and wondering what you can do to reduce the huge volumes of spam emails that must be overwhelming your POP client inboxes, I recommend MailWasher Pro (with my downloadable custom filters) as an incoming email screener for your POP email program (Microsoft Outlook, Microsoft Outlook Express, Microsoft Live Mail, Eudora, Mozilla and other stand-alone email programs).

Posted by Wiz at 1:27 PM | Permalink

back to top ^

If you arrived here by searching for the name of some malware that may be on your computer and you are not currently using Spybot Search and Destroy, you can download the latest version from the Spybot Search and Destroy Multi-Lingual Landing Page. Choose your language, then use the link in the left sidebar to go to the downloads page. Download the program from your closest mirror server, install it, update it (Updates button), then follow the instructions below to detect and remove any malware that is on your PC.

If you already are using "Spybot Search and Destroy" and haven't updated it this week, be aware that updates to the definition files were released on schedule, on Wednesday this week, as listed below. Spyware and other classes of malicious programs are altered constantly to avoid detection by anti-spyware programs. Since Spybot S&D updates are only released on a weekly schedule (on Wednesdays) it is imperative that you make it a point to check for and download updates every week, preferably on Wednesday evenings. After downloading all available updates (from the best responding download server in the list of server locations), immunize*, then scan for and remove any detected malware. If Spybot is unable to remove an active threat it will ask for permission to run before Windows starts during the next reboot. Spybot will then run a complete scan before your Windows desktop loads, removing malware that has not yet loaded into memory.

If you see a program listed in the detections below, by name, you should assume that is is malware (with the possible exception of the PUP group, which is up to user discretion). All of the programs listed with a single + sign are updated detections, while a double ++ in front of it's name indicates a brand new detection. A number in parenthesis, following a malware name, indicates the number of variants included in that detection. These programs are dangerous to your computer, and/or personal security or privacy.

* After updating your Spybot S&D definitions, if they include new "immunization" definitions you need to click on the "Immunize" button, then, if the status line tells you that additional immunizations are possible, click on the Immunize link, near the top of the program. It has a green + sign in a button. If you don't do this the new immunizations against hostile ActiveX programs will not be applied. After immunizing with any new detections, run a scan for malware by clicking on the "Spybot Search & Destroy" button, on the left panel, then on the button with the magnifying glass icon, labeled: "Check For Problems."

Spybot Updates - published every Wednesday

Additions made on June 4, 2008:

Adware
++ Zango.ShoppingReport

Keyloggers (Keyloggers steal your typed logins and passwords)
+ Ardamax
++ Iopus.STARRMonitoring
+ Perfect Keylogger (2)

Malware Includes fake anti-virus and anti-spyware programs, like VirusHeat and Vario
+ Clickspring.Outerinfo (2)
+ FakeAlert.cc (2)
++ Moatsoft.AntiMalware
+ NousTech.SystemDefender
++ SpywareThis
+ WebSpyShield
+ Win32.BHO.je
++ X-ConSpywareDestroyer
+ Zlob.Downloader.jau
++ ZoneProtectAntispyware

PUPS Possibly Unpopular Software or Unwanted Programs
+ AP.SystemStable

Trojans Includes 1 new and 3 updated Zlob* Trojan detections
+ NNC.MGRS
+ ShudderLtd.AntiVirusPro
+ Smitfraud-C.MSVPS
++ Win32.AutoRun.akc
++ Win32.Delf.uz
+ Win32.Delf.zq
++ Win32.Horst.aae
+ Win32.Poison.pg (2)
++ Win32.Sohanad.am
++ Win32.VB.btu
+ Zlob.Downloader
+ Zlob.Downloader.iit
++ Zlob.Downloader.pit
+ Zlob.Downloader.vdt

Total: 617677 fingerprints in 161700 rules for 3976 products !

False positive detections fixed this week:
A detection of "RegistryHelper" in the Disk Cleaner program is a false positive that will be fixed in next week's updates. If you have Disk Cleaner and Spybot broke it by removing necessary files, you should restore them from backups made by Spybot. If you get an alert about that detection for a file you think is legitimate you should submit it to Team Spybot for analysis.

Team Spybot has fixed some errors when the program is scanning and cannot create the file named "ntdoss04.sys."

Also fixed this week is a false positive for aamd532.dll and SpyPry.

A fourth false positive fixed this week was for "SpyBossPro" in the file C:\WINDOWS\system32\Memman.vxd. This is an old program that is not a keylogger at all and had a differnt false positive fixed in last week's detections. There is something about this old file that throws Spybot off.

* The "Zlob Trojan" is a common infection that has been in the wild since 2005. It is often downloaded intentionally by people who are tricked into thinking that they are installing some missing ActiveX Video Codec, or other (Java) application, needed to view a presentation, or pornographic movie. Once installed on the target computer the Zlob Trojan allows hackers to deliver all manner of downloaders, adware, fake anti-spyware and backdoor components to it. The Zlob family of Trojans are constantly modified by it's maintainers to try to avoid detection by anti-malware applications. These criminals earn commissions for every computer they infect with the Zlob and its companion products. Spybot Search and Destroy can detect and remove most known variants of the Zlob Trojans, with new definitions being released every Wednesday to detect the latest incarnations of Zlob.

Spybot Search & Destroy version 1.5.2, the latest release, is compatible with Windows Vista and features a nicer interface and sports a separate updater window and application. If you are still using version 1.4 I recommend that you update to 1.5.x, using the company links below.

Some users are having problems with Spybot S&D updates when running as less privileged users (Limited or Power Users). First off, less privileged users can no longer apply most immunization rules from within their accounts, unless they use the "Run as" command to run the program as an administrator. Your solution is to first run the Spybot Updater, from your Start menu > Programs > "Spybot - Search & Destroy" > "Update Spybot-S&D." The updater is now a separate application. To avoid possible account corruption from the rootkit detections, run the Spybot Updater before you open the actual Spybot S&D program. Download all available updates from the best server location (I prefer the Safer Networking servers). Exit the updater after all definitions have been installed and green checkmarks are displayed for all updates.

After the updater has exited you can right-click on the shortcut to Spybot S&D and "Run As" an administrator, with your administrator account password (only if you login as a Limited or Power User). When the program opens you should immediately use the Immunize button to apply the level of protection you desire to the selectable applications. These typically include major browsers, domains, cookies, and the Windows HOSTS file. If you are an advertiser or publisher in an affiliate network be sure you exclude cookies for your affiliate programs that are in the detections list, or you'll have problems logging into your affiliate accounts. I have to exclude Commission Junction and Linkshare detections in both cookies, domains and HOSTS immunizations. Apparently, the authors of Spybot are down on advertising cookies and domains. Oh well (sigh).

Another problem being reported is when you run some versions of Spybot S&D it stops with a warning about problems including the file C:\Program Files\Spybot-Search_Destroy\Includes\TrojansC.sbi. The current errors with the Trojans.sbi and TrojansC.sbi files are caused by new detection rules that are incompatible with versions of Spybot prior to 1.5.2. These new detection rules use the new Anti-Rootkit plugins #1, #2 and #3 that only have been offered as updates to Spybot 1.5.2. If you upgrade to Spybot 1.5.2 you will not only eliminate the error messages but in also will be performing rootkit searches while doing a Spybot "Check for problems".

English Language Company Links:
Spybot Search and Destroy English Home Page
Spybot Search and Destroy (Multi-Lingual Landing Page. Choose your language).
Spybot Search and Destroy Download page - Program and definition updates. You can download the latest version of Spybot S&D plus definition and tool updates here for inclusion later on.
Full tutorial about using and setting up Spybot Search and Destroy
Spybot Search and Destroy Update History

See all security program update notices in this catagory

A consequence of acquiring many of the parasites, keyloggers, hijackers and downloaders is that their files and startup settings are usually saved to your System Restore hidden folder, from whence they are automatically restored upon rebooting the computer. To completely remove these threats, and others, you should disable System Restore, then reboot, then clean all threats, then re-start System Restore, setting a new Restore Point, with a clean machine. Many people overlook this and are constantly reinfected after removing threats. There are few, if any security programs that can clean or remove infected files that are backed up in your protected System Restore directory.

To disable System Restore, go to My Computer and right-click on it's icon. From the flyout options select Properties. From the "System Properties" select the "System Restore" tab. There you will find a checkbox labeled "Turn off System Restore." Check it, then click Apply and wait while the System Restore files are deleted (takes some time). After the deletions are finished, click OK to close the Properties box, then reboot.

When you have thoroughly removed all infections follow the same procedure as above, unchecking the box that turned off System Restore.

In the event that Spybot mistakenly removes a file(s) due to a faulty detection update (a.k.a False Positive), you can restore it from the program itself. Just click on the "Recovery" button, that looks like a first aid kit, with a red cross in it, then locate the item(s) you wish to restore. Click on the select box(es) on the left of the detection name(s), to place a check mark in it/them, then click on "Recover selected items." The files, and/or registry entries will be replaced, from where they were deleted. The Spybot forums have discussions about false positives here.

For those of you who have not yet used Spybot Search and Destroy, if you were wondering if it "plays nice" with other anti spyware programs, it most certainly does! I have used Spybot S&D since it's inception, along with various other free and commercial security programs, and it has never caused any problems on my, or my customers' computers.

Spybot Search and Destroy has a Malware Removal Forum where trained volunteers can help you with spyware removal problems.

Finally, as an individuals who benefits from the free software that is produced and updated by the good folks who run Spybot Search and Destroy, at their own expense, it won't hurt us to send occasional donations to them, to help them financially in their efforts. There is a donate button on most pages of the Spybot S & D website. Think seriously about using it. Send what you can.

Posted by Wiz at 2:27 AM | Permalink

back to top ^

This is the latest entry in a series about classifications of spam, according to my custom filter rules used by the anti-spam tool, MailWasher Pro.

In the beginning of this series I was using MailWasher Pro filters exclusively, to detect and delete incoming spam email. Since then I have instituted email spam filters on my website's mail server, which has greatly reduced the amount of spam I see at all. The balance that does get through is identified and either flagged as spam, or instantly deleted, by my POP3 mail anti-spam tool; MailWasher Pro. MailWasher Pro identifies what is spam by a combination of methods, including the use of custom written personal spam filter rules. I have created a large assortment of spam filters which "plug-in" to MailWasher Pro, to flag or delete known spam. You can read about them, or download and use them in your own registered copy of MailWasher Pro.

The percentages for various categories of spam listed below are taken from my MailWasher Pro "Statistics" page. I am no longer stating the overall percentage of spam to good email, due to the huge effect my cPanel mail server filters on reducing the overall volume of junk mail. What does get through my server filters is still representative of what types of spam others are seeing and the same categories occupy the top positions for me as they do for you.

The category "Other Filters" combines several of my custom filters which did not receive enough spam to rate a measurable percentage, thus were all grouped into the one category.

MailWasher Pro spam category breakdown for May 26 through June 1, 2008.

Other filters: (See my MWP Filters page)	21.43%
Pharmaceutical spam (inc. Viagra, Cialis, Levitra & misc. pills):	19.04%
Male enhancement spam (subject and body):	16.66%
Nigerian 419 Scams:	9.52%
Blacklisted (Mostly Nigerian 419 scams):	9.52%
Counterfeit Watches:	8.33%
Digits or Consonants forged sender:	5.95%
Counterfeit clothing and shoes:	3.57%
DNS Blacklists:	2.38%

If you are reading this and wondering what you can do to reduce the huge volumes of spam emails that must be overwhelming your POP client inboxes, I recommend MailWasher Pro (with my downloadable custom filters) as an incoming email screener for your POP email program (Microsoft Outlook, Microsoft Outlook Express, Microsoft Live Mail, Eudora, Mozilla and other stand-alone email programs).

Posted by Wiz at 3:06 PM | Permalink

back to top ^