Spyware Warrior

[Doug Taylor]

Hello,

(Hoping webhelper will take a look. Others welcome of course.)




I was googling wcmdmgr.exe to find out what it was. Many links came up. When I went to the 2-spyware.com link an interesting thing happened. I did an ALT+PRINT SCRN which only captures the active window. Well, the ALT+PRINT SCRN showed the web page and the popup as if I pressed PRINT SCRN alone. That suggests to me that the popup is actually attached to the 2-spyware.com window. When clicking the back button both vanished. Not quite normal behavior for a popup. I was searching Google for information on entries in my son's hijackthis log (he is getting AOL popups that float across his display.) 2-spyware.com showed up twice in my search and both times displayed with that same popup.

Later I backed up the http address just to www.2-spyware.com it is a SpyHunter page. Thought you might be interested in this.

With our Lord’s blessings,

Doug


The following is the NeoTrace for the Network Administrator Important Notice (the bogus popup.)

Registrant:
PSS & Associates (CHICAGOWEBS-DOM)
PO Box 40
Glen Carbon, IL 62034
US

Domain Name: CHICAGOWEBS.COM

Administrative Contact:
Chicago Webs (PO834-ORG) hostmaster@CHICAGOWEBS.COM
Chicago Webs
105 OAKLAWN DR
GLEN CARBON, IL 62034-4062
US
877-424-4932 fax: 520-222-8051

Technical Contact:
Postmaster (31595883I) hostmaster@CHICAGOWEBS.COM
Postmaster
Chicago Webs
PO Box 40
Glen Carbon, IL 62034
US
999 999 9999 fax: 999 999 9999

Record expires on 23-Jan-2005.
Record created on 23-Jan-1999.
Database last updated on 13-Jun-2004 00:58:30 EDT.

Domain servers in listed order:

NS1.CHICAGOWEBS.COM 64.37.122.3
NS2.CHICAGOWEBS.COM 64.37.122.49

The following is the NeoTrace of the 2-Spyware.com page.

Registrant:
Ugnius Kiguolis
sventupes 16a
Kaunas lt-3000
Lithuania

Registered through: GoDaddy.com
Domain Name: 2-SPYWARE.COM
Created on: 06-Feb-04
Expires on: 06-Feb-05
Last Updated on: 28-May-04

Administrative Contact:
Kiguolis, Ugnius jurgita@jurgita.com
sventupes 16a
Kaunas lt-3000
Lithuania
868715552 Fax --
Technical Contact:
Kiguolis, Ugnius jurgita@jurgita.com
sventupes 16a
Kaunas lt-3000
Lithuania
868715552 Fax --

Domain servers in listed order:
NS1.EV1SERVERS.NET
NS2.EV1SERVERS.NET

The previous information has been obtained either directly from the
registrant or a registrar of the domain name other than Network Solutions.
Network Solutions, therefore, does not guarantee its accuracy or completeness.

[wawadave]

aye thx for the heads up!
_________________
RFID tags! SPYWARE
Tired of proprietary Cor-pirationware?
http://www.openoffice.org/
Installing Vista http://tinyurl.com/2l9qyd

[Nick]

Yeah, 2spyware is our buddies from Enigma. They are using the new type of pop up that is actually part of the web page. Those aren't blocked by pop up stoppers and even having the site in the restricted zone with no scripting and Active X will still yield the pop up. Avoid the 2spyware pages as they are no good.
_________________
Nick's Security Ticker

[webhelper]

That is already a known possible code stealer of spywareguide.com site. They already put out a blast on them and that is when we started into the spyhunter stuff.

This site is only bad because they are affiliates with ads for the wrong kind of security software..scamware
_________________
Wächter der Geschichten:
http://www.webhelper4u.com/thewatcher.html
Member of ASAP Since 2004

[Doug Taylor]

Hi Webhelper,

Thank you for taking the time to look it is appreciated. I think the site is a bit more heinous then simply posting advertisements for spyhunter. I believe its intentions are far more malicious then that. When you do a Google search for avgcc32.exe you will see it listed near the top in a link to 2-spyware.com if you are fast or your connection is slow you will be able to capture 2-spyware’s comment on avgcc32.exe. A gif of 720x300 pixels containing 13844 byte labeled “Network Administrator Important Notice” will quickly cover the displayed information. The following is what it covers:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Description:
Part of AVG Anti-Virus. avgcc32.exe is located in "C:\PROGRA~1\Grisoft\AVG6\".

Edit description

File avgcc32.exe removal:
This file might be related to spyware. We advice you to scan your computer and eliminate possible threats.
download scanner and remover
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The gif that covers the above comments about avgcc32.exe has a minimize, maximize and close button in the upper right it also has a “Start” and “Cancel” button. As a gif it has no controls itself so the displayed buttons are no more then props to fool the unknowing. Clicking anywhere on it will launch one of the flavors of SpyHunter.

Avgcc32.exe is a part of Grisoft’s AVG antivirus application, a valid non malicious file yet 2-spyware.com implies it is something else.

2-spyware.com is more the just a site that displays ads for bad software, it is a trap.

With our Lord’s blessings,

Doug

[jurgita]

Hi Doug,

[suzi]

Here is a review of SpyHunter written by Eric L Howes, a well known expert on spyware, relating the results of his testing.

http://www.netrn.net/archives2/000563.html

There are many people who claim that SpyHunter's free scanner installs spyware then demand that you pay for the program to remove the spyware. Eric's testing did not find that. However, he states many other reasons why SpyHunter is not recommended.

Eric's site: http://www.staff.uiuc.edu/~ehowes/main-nf.htm
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn.

[jurgita]

I've read his opinion..
So in your and Eric opinions its bad because its not free and because the strategy of the affiliates, who wants to sell more copies.
And nothing bad with the Program itself...
So Suzi, why you are publishing it as a scam? where do you see scam?
Give me the spyware remover which claims to remove 100% everything I'll buy you a box of champagne.

BTW. I see enigma removed affiliates at all, doesnt accept new ones. So this problem is solved. Where is a scam now?

BTW2. the topic about 2-spyware.com and I see in your opinion its bad page just because of enigma, even if its not the only program afiliated with them. Motivate why its bad.

thank you.

[Nick]

The 2spyware site is no good because it is in IE Spyad's list. Go talk to Eric and have him remove it. That will be a more productive use of your time than posting here.

There are many other reasons it is no good, but that should be enough to keep you occupied while I am away.
_________________
Nick's Security Ticker

[suzi]

jurgita - who are you anyway and why do you care?

Why don't you tell us why you think SpyHunter is a good program and not a scam?
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn.

[jurgita]

) that is definately the good reason why it is not good. )
Really the discussion can be more productive if I'd see some arguments in the discussion, not only silly and arogant talks.

It seems that you just jelous other success.

waiting for your arguments.
trying to keep you busy too.

[suzi]

More discussion at http://boards.cexx.org/viewtopic.php?t=6762

I banned jurgita here. I don't normally ban someone just because they irritate me, but this time I did.
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn.

[Doug Taylor]

Hi Suzi,

His last post definitely felt like bait. He was looking to engage in an argument. Why have, why entice an argument about it? His motives are his and I can only speculate I don’t think he had the best interests for the group. I support you Suzi in your discussion. (Hope I never irritate you.)

With our Lord’s blessings,

Doug

[Doug Taylor]

Make that “decision”

[Cruzin]

To bad he had turn the thread into a troll.

Contraversy is a good thing when participants are actually looking for the truth in a matter

This could have been a good debate if he had rephrased most of his sentences, not resorted to name calling and did not seek to humilate others.

Wonder how old he is? His argumentitive style was a bit like a child. Must have had some financial interest 2-spyware.

All in all, he deserved to be banned from the board
_________________
It's all star dust

[jurgita]

I would like to ask which arguments are childish arguments mister.
where do you see humiliation? I see that you want to insult me, not otherwise.
Everything shows that this forum shows just biassed opinion. thats the fact.

And yes you are right. I'm aliased a bit with 2-spyware. Which is very BAD site because Features such product as Spyhunter along with Pest patrol, X-cleaner and the others.

Anyway we will publish this case word to word. Our readers, our sites are more popular, more people will be able to read and to decide, who is right and who is wrong.

I dont defend spyhunter. Their affiliates tactics are Bad. Thats why they banned them.
But I dont support that scam opinion also. There is no Scam with the program only the some scam with marketing.

I see our sites are also BAD sites and included to the rogue list.
Where are the arguments for that?
There are no any arguments and proves. In that case i will need to write about Slander, biassed information which misleads visitors.
With that strategy (banning other opinion, insulting)spywarewarrior does the same BAD thing as Enigma - misleads users.

Everybody here were talking about freedom of speech after the C. Stark letter. So there is other speech which differs from what you can read here.

P.S. I'm a female and not 13. And you?

[Cruzin]

Well....maybe I shouldn't respond....but what the hey.

Jurgita ya had me interested on your first post. I thought maybe there could be an extrated bad rap going on with 2-spyware.com and spyhunter , but in your last posts you clearly wanted a fight rather than a debate. I like to hear both sides of a story as long as both sides are civil.

[suzi]

jurgita - I see you managed to get around my banning you, but that's ok. I have another question for you -

Are you in any way affiliated with SpyHunter or EnigmaSoftwareGroup?

I cannot understand why you are so defensive about it unless you have some interest in the company yourself.

The reason I have not posted my reasons here for my opinion about SpyHunter is that I have already written it up in several places, on the forum here and on my blog with many links as references. If you don't care to check the information that is already posted, that is your problem. I have already stated my case and do not need to restate it for your benefit.

You said my opinion is biased and I agree with that. Any opinon is always a bias. Your opinion is just as biased as mine, but since yours is different, you accuse me of being biased but you are just as biased yourself.
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn.

[jurgita]

Suzi,
My affiliation to Spyhunter is the same as my affiliation to pest patrol, x-cleaner, spy sweeper and the others.

I told already, that I 'm not defending spyhunter regarding some of its affiliates actions, but I dont agree with Scam opinion also.
I'm not biased, because I would like to hear both sides, I agree that Spyhunter is not perfect, and you - just fighting against them.

Even Eric told that there is no scam with the program itself.
You like to talk about freedom of speech, so answer the following questions:

1. Why 2-spyware.com is in rogue list? For publishing pestpatrol, spyhunter, x-cleaner and other removers?
2. You are the one who started the discusion about freedom of speech, is it normal to BAN different opinions from your site, publish only BAD and mislead internet users?

[jurgita]

Didn't try to insult anyone. Sorry if somebody thinks like that.
BTW the insult was to me with the statement that 2-spyware.com is a rogue.

Me: I'm the owner of some Companies (not only IT) and various internet projects (not only in spyware theme).
Nice to meet you.

hope that helps.

[suzi]

[jurgita]

I'm simple affiliate for their product. The same as I'm affiliate for pestpatrol, spy sweeper, x-cleaner and other removers.
Some of them you find bad, some of them - good. For me it doesnt matter as long as they are not spyware itself and does the job they should do.

Can you tell me again - What do you find wrong with Spyhunter??
thank you.
(Lets leave the affiliates advert methods and talk about the program itself)

I sell about 100 copies of various removers per 1 Day. People purchase Spyhunter too, so I get lots of feedback from the customers about the removers.
So from the user side about 90% of people who purchased Remover from me were satisfied with the program, I get "thank you" letters almost everyday.
I get complaints also. But people complain about pestpatrol the same and sometimes even more than about spyhunter.

As a seller I tested lots of different removers, we (as a company) asked opinion about removers lots of credible sources (for example: Cnet, PCmagazine) they were testing various removers too.
its a long story, just to make it short:
nobody has found any bad activity with spyhunter, And the program finds some parasites which doesnt find other programs.
the same I can tell about the others: removers are different and we didnt find the remover which removes everything.

Hope that helps and I really would like to get your clear answer regarding spyhunter.
You are on accussers side, some customers are asking me regarding your opinion, because there are rumors about spyware inside spyhunter and they are scared.
I told them I'll ask you directly for the proves for that rumor.
Right know I can answer only that you are Baning different opinions and spreading rumors, I think its very unprofessional and unethical.
Thats why I need clear answers.

[suzi]

[Doug Taylor]

Hello Jurgita,

You ask:

“1. Why 2-spyware.com is in rogue list? For publishing pestpatrol, spyhunter, x-cleaner and other removers?”

I will answer this since I started this thread. I had not heard of 2-spyware.com until a few days ago when I was searching on some file names that I didn’t recognize. They (the file names) happened to be part of Grisoft’s AVG antivirus program. I didn’t know it at that time. The searches I preformed brought me to the conclusion that they were not malware. To confirm this I downloaded Grisoft’s free version of AVG and installed it. I scanned my PC after the install nothing showed any problems. (For the record I scanned with Ad-Aware, Spybot S&D, Spy Sweeper, Network Associates McAfee Enterprise version 7.0 and HijackThis.) Also, I checked the Windows registry using what I know about it. Nothing questionable showed up. After the install of AVG I was able to verify that the files I searched on were part of Grisoft’s AVG.

This left me with wondering why 2-spyware.com would “imply” the files I searched on were spyware? Their phrase “This file might be related to spyware.” Does imply that it is spyware. Legally, it also implies that it might not be. This keeps them from defamation suits. (In my opinion.)

Whether the statement “This file might be related to spyware” is presented in deception or ignorance the results is the same. The public is misled. Their advice can not be trusted because they can only state “This file might be related to spyware.” A reliable source can state “it is” or “it is not” or it is not known.” How is the average user to know that the phrase “This file might be related to spyware.” simply implies question. It will be read as “This is spyware.”

Your posts were clandestine. Why did you not ask out right?

With our Lord’s blessings,

Doug

[TeMerc]

I agree completely with Dougs assesments regarding that phrase.
It is indeed misleading to most of the folks who read the ads.

Especially if they have zero famillarity with security products.

Before I even began doing HJT logs, and got interested in malware, I read about the apps the security professsionals recommended. Thats the place to get your info, especially, since these people don't get paid, or benefit by it. Unlike Jurgita, she does get paid to peddle this stuff. So, she has a vested interest to say its good. So, therefore, her opinions are not only biased, but they are financially motivated. Thats worse by my book.
_________________

Ultimate Countermeasures Page
Calendar Of Updates
Malware Advisor Blog

[jurgita]

Thanks Doug for your comment:

here is a small explanation:
2-spyware.com is made by internet users like you, any record there can be edited or modified. There are some files which added to the database and we ask more information about them.

if you found out that one or another file is not related to any threat just press the link "edit information" there and input information you know. You will be able to uncheck the box regarding file relationship to spyware or any other security threat.

Administrators reviews the information you input, and approve all dissaprove your edit.

Hope you understand the way the site works and instead of arguing will help us to build the site with less mistakes.

And for the Future I would like to ask you to contact us before posting some opinions to other sites.

thank you.

[jurgita]

temerc,

for me doesnt matter spyhunter or pestpatrol or for example temerc spyware removal as long as customers satisfied and program does its job.

I'm financially motivated to display content, not to promote especially one program.

Suzi just obssesed with Spyhunter ir its just a competitor, I dont have any other explanation for that.

[suzi]

[jurgita]

I think there is nothing left to comment. I told everything in conclusion in my sites.
there is no ad. you see - you comment.

BTW - that site is not under my direct management. So again you did the same, just post a slander.

I think you will be happy with consequences.

[suzi]

You said

[webhelper]

jurgita

I am busy helping users with the infestations of the various CWS variants that they have issues with at this time. I will however have a lot to discuss here about your site and what you do or the lack of what you do for the Internet community..

First I have no love of commecialization when it comes to the security and freedom of privacy and enjoyment of the users of the Internet and will make my feelings known in no uncertain ways.

Yes I have been watching you since the time you tried to duplicate spywareguide.com's web site. Later we go over all my findings and talk about your short comings in the security area
_________________
Wächter der Geschichten:
http://www.webhelper4u.com/thewatcher.html
Member of ASAP Since 2004

[suzi]

About 2-spyware.com - here is the domain registration whois lookup:

Registrant:
Ugnius Kiguolis
sventupes 16a
Kaunas lt-3000
Lithuania

Registered through: GoDaddy.com
Domain Name: 2-SPYWARE.COM
Created on: 06-Feb-04
Expires on: 06-Feb-05
Last Updated on: 28-May-04

Administrative Contact:
Kiguolis, Ugnius jurgita@jurgita.com
sventupes 16a
Kaunas lt-3000
Lithuania
868715552 Fax --
Technical Contact:
Kiguolis, Ugnius jurgita@jurgita.com
sventupes 16a
Kaunas lt-3000
Lithuania
868715552 Fax --

Domain servers in listed order:
NS1.EV1SERVERS.NET
NS2.EV1SERVERS.NET

I guess this explains why jurgita was offended by the fact that her site is on the rogue list.

And who is Kiguolis, Ugnius? Is that jurgita's real name? A google search for Kiguolis, Ungnius did not turn up much but I came across something with the domain name KIGUOLIS.COM

Registrant:
Ugnius Kiguolis
sventupes 16A
Kaunas LT-3000
Lithuania

Registered through: GoDaddy.com
Domain Name: KIGUOLIS.COM
Created on: 19-Apr-03
Expires on: 19-Apr-05
Last Updated on: 04-Jun-04

Administrative Contact:
Kiguolis, Ugnius jurgita@jurgita.com
sventupes 16A
Kaunas LT-3000
Lithuania
868715552 Fax --
Technical Contact:
Kiguolis, Ugnius jurgita@jurgita.com
sventupes 16A
Kaunas LT-3000
Lithuania
868715552 Fax --

Domain servers in listed order:
OFFICE.ESPERONUS.COM
NS.JURGITA.COM
However - a google search for Ugnius Kiguolis shows some very interesting stuff.

http://www.google.com/search?sourceid=navclient&ie=UTF-8&oe=UTF-8&q=%22ugnius+kiguolis%22

http://forums.maddoktor2.com/index.php?s=1c91e7c89480fb7b97824ca7dbaaa726&showtopic=268&st=0&#entry5028

[Moore]

good info Suzi

Is it just me or does it feel like things are going around in circles.

[suzi]

[DeleterFX]

It sure is hard to draw conclusions, when the person who is asked questions dodges them, by repeating the same things she has said time and time again. Thanks for doing the digging for me Suzi, saved me the trouble of getting the "straight" answers.
_________________
You've Been Deleted
CCSP Website

Member of The ASAP Since 2004

[radio]

some new info:

[truthseeker]

Off topic:
Personal Information Removed

Lots of people would like to make someone a visit. Soon... very soon.


***************
I have edited out the personal address and information as positng private information is not to be done on this or for that matter many other forums..

The information presented in the other threads are all accessable to the general public thru whois database searches.


Webhelper
Edited 6/23/2004

[TMOV]

i'm going to contact suzanne beck at the fbi internet crimes section, this jurgita is an illegal alien that has found out how to steal from people on the internet.
i'll open a complaint.
do you have an ip#?

[suzi]

The IP address of the poster "truthseeker" is 66.98.130.120 which does not resolve to any host. Apparently the person was posting from a proxy.

The email address is asilogalva@yahoo.com
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn.

[DeleterFX]

Are you sure you guys (TMOV and Suzi) are talking about the same person. Suzi said truthseeker and TMOV said jurgita...or was that tidbit of information that truthseeker posted that webhelper edited about them being linked in some way?
_________________
You've Been Deleted
CCSP Website

Member of The ASAP Since 2004