Can Sponsored Results be trusted?

winhelp2002 — Wed, 27 Aug 2008 04:09:00 GMT

I've commented about this subject before ... and I have still not changed my mind ... NO No No ...

Recently the SunBelt blog touched on this, and I thought I'd provide a good example ...

"Tested by g0Ogle" ... I think not! ... if a user happens to click that "Sponsored Link" ... they end up here ...

So not only do these culprits want to whack you with a infectious ActiveX (virusremover.dll) they also want you to click the "Remove All" button to install their fake antispyware program and all the other nasties that come with it ... my AV NOD32 v3 however doesn't think that would be a good idea ...

Submitting "virusremover.dll" to VirusTotal gives the following Result: 23/36 (63.89%)

Notice that Ask routes their Sponsored Result thru Google then redirects to the (un)desired site ...
"avxp-2008(dot)net" is yet another site maintained by the "Pandora Software Group"

I could provide many more examples ... but you get the idea ... even these "Parking Services" use these type of practices in their fake Sponsored Results on "Parked" sites ... and that why I include many of their sites as entries in the HOSTS file ... everyone is glad to take the $$$ provided by these clients, but very few services are willing to investigate these clients prior to hosting their content ...

Another Rogue Antispyware product from the Pandora Software group

winhelp2002 — Thu, 17 Apr 2008 01:02:00 GMT

Following up on a article from our friends at BleepingComputer "How to remove Malware Bell" we find:

"Malware Bell is a rogue anti-spyware from the same developers as IE Defender and Files Secure. Malware Bell is installed and advertised through the use of Trojans that are installed as Internet Explorer Browser Helper Objects."

These people are so lame they can't even write their own detections ... (highlighted in red) it's actually from McAfee ...

As you can see there are several redirects when you [choke] attempt to purchase their bogus product ... the sad part is here is another example of "ipsCA" issuing certificates to known bogus products ...

I found the exact same thing with "VirusIsolator" which Symantec detects and describes as:
"The program reports false or exaggerated system security threats on the computer."

So I have to ask ... ipsCA what are you thinking!

"installed and advertised through the use of Trojans" ... "reports false or exaggerated system security threats"

Yes I did contact ipsCA previously and all I got back was an automated reply with a "Support:276800" ...

Hosts News : Pandora Software

Can Sponsored Results be trusted?

Another Rogue Antispyware product from the Pandora Software group