'Winfixer' mystery slowly unravels
299952
(InfoWorld) - A California attorney claims he has unraveled part of the mystery behind a questionable software program and is prepared to go to court. Attorney Joseph M. Bochner filed a class-action civil suit last September in California Superior Court in Santa Clara County against two men the suit alleges are behind Winfixer, a purported security software. The lawsuit names Marc J. Cohen of Florida, and was amended last week to add James Reno of Ohio as an additional defendant, Bochner said. It seeks compensation and a halt to the distribution of Winfixer, among other remedies. The suit was filed on behalf of Beatrice Ochoa, a mother of two who paid US$39.95 for Winfixer after it badgered her with repeated pop-up warnings that her computer had security threats. The program eventually rendered her computer's hard drive unusable, Bochner said. The suit counts another 100 anonymous victims. "All of these people are being defrauded and they're just ordinary folks," Bochner said. "They buy a computer, they surf the Internet, they're not doing anything unreasonable and suddenly they're defrauded." Indecision over whether Winfixer is a legitimate product may be the reason it still pervades the Internet. Winfixer has been a moving target for security experts, at times going by the names ErrorSafe, WinAntiSpyware, WinAntiVirus, SystemDoctor and DriveCleaner. Security software from vendors such as Sophos PLC and Symantec Corp. will detect it, but give users the option of whether they want to remove it. Sophos calls it "adware" that hypes security threats and then implores users to buy the software. Microsoft Corp., however, pulled no punches last month whenÂ Winfixer ads began show up on its instant-messaging program, calling it "malware," a shorter term for "malicious software." Experts have also seen it install itself on computers via security vulnerabilities in browsers or OSes. However, the lawsuit could face hurdles in court. Web sites are frequently registered under false names or under stolen identifies and the real owners can be difficult to trace, said Sandi Hardmeier, a computer security authority who writes about Winfixer on her blog "Spyware Sucks." Proving the link to the alleged perpetrators, their connections to Winfixer all the way through to the effects on Ochoa's computer will be very difficult, she said. "Forensics is everything," she said. Bochner acknowledges it's hard work to track down fraudsters who use the Internet's anonymity to commit crimes, but the criminals are real people who can be located. Bochner said he has compelling documentation to link the defendants named in the suit to Winfixer. By researching IP (Internet Protocol) addresses that hosted the versions of Winfixer and their owners, Bochner alleges he has uncovered a fraud based in the U.S. that has escaped law enforcement scrutiny. Reno ran a Web hosting company called ByteHosting Internet Service LLC with a postal address in Amelia, Ohio. Bochner said at one time, a support number for Winfixer support also rang through to ByteHosting, which led in part to Reno being added to the suit. Reno, along with other co-defendants and ByteHosting, was sued by Symantec Corp. in 2004 for allegedly creating pop-up ads that told consumers their Symantec software was about to expire. The ads then directed users to fake software that looked similar to Symantec products. Court records show Reno and Symantec reached a confidential settlement in December 2004. Cohen was named for his connections with vipfares.com, a now-defunct travel Web site, Bochner said. At one time, the Winfixer software would hijack the user's browser and suddenly show vipfares.com, he said. Efforts to reach Cohen and Reno for comment were unsuccessful on Wednesday and Thursday. However, Cohen's attorney, Judy Silverstein, appeared on a San Francisco TV news program on Feb. 26 regarding Winfixer and her client. Silverstein said, "His [Cohen's] position is he's done nothing wrong. He's done nothing improper or illegal, and he's had no ownership interested in those Web sites." Bochner said he has turned over some of his research to law enforcement agencies such as the U.S. Federal Bureau of Investigation and Secret Service along with California authorities. While researching IP addresses that linked to Winfixer, Bochner said he suddenly came upon a database detailing sales of Winfixer and the other versions of the programs. The multi-gigabyte database -- apparently left unsecured and open to the Internet -- contained names, addresses, credit-card numbers, transaction amounts and the version of Winfixer that was sold, he said. For example, on Jan. 20, 2006, the data showed 2,351 sales to users worldwide, with an average transaction amount of $40, Bochner said. The database covers transactions made from January 2005 through January 2006. One of the records shows a transaction made by someone who lives across the street from his law office, Bochner said. The data, while incomplete, allows a view of the fraud ring's broad reach and scope, he said. "I think this is far larger than anyone has ever expected," Bochner said. "It's not inconceivable that these people have made $150 million or more over the last few years." Â
420673
PivX Solutions, Inc. of Newport Beach, California, on Monday announced the availability of Qwik-Fix Pro, an intrusion prevention software product for Windows machines that disables or modifies features of Microsoft Corp. Windows and the Internet Explorer (IE) Web browser that are frequent targets of malicious computer hackers and virus writers.
749286
Want to hack Windows? Better get familiar with the Registry first.
132488
Some prompts and websites that download browser plug-ins are turning out to be fronts for malicious programing.
744672
Windows security holes patched; tool to rid PCs of malicious software now available.
416138
In latest book, author chronicles the things in newest version of Windows that irk him--and some workarounds.
620094
roundup Free-roaming source code breeds new Netsky pest. Also: From IE to Opera, browsers are a likely prey.
68810
Rare, out-of-cycle Windows patch fixes one flaw, but attacks through other known, yet-to-be-plugged holes continue.
72462
Security researchers are warning of a serious - and unfixed - security hole with the popular Winamp media player.
519444
Timing of viruses that exploit a flaw in IE could be sign that creators are trying to unsettle Microsoft.
688722
Sample code that exploits a yet-to-be-fixed Windows flaw is circulating. Microsoft plans to deal with it on the next Patch Tuesday.
769541
Some widely used applications haven't been certified for use with Windows Vista, they may, nonetheless, work.
184446
Tycho:  I don't know whose fault it is exactly, mine or theirs, but I won't be installing Vista anytime soon.  I would like some crazy shit to happen when I minimize something don't get me wrong.  I want my windows to go Waja-wajow(!) is possible.  But if there's a great reason to "trade horses midstream" or whatever the going metaphor is I haven't discovered it.
166352
Over the past month, a new type of malicious software has emerged, using a decades-old technique to hide itself from antivirus software.
62609
With viruses, worms, spyware, spam and phishing, running a computer this year -- especially one with Windows -- has often been a colossal headache. -Rob Pegoraro
693586
New utility from PivX keeps intruders out of Windows systems.
63097
Also: Windows worm travels with Tetris [News.com Extra]