SOURCE: Sunbelt Software

May 02, 2007 10:00 ET

Sunbelt Software Announces Top Ten Spyware Threats for April

Stats From Leading Windows Security Provider Show Threats Malware-Stopper and SpyLocked for the First Time in Top Ten

CLEARWATER, FL -- (MARKET WIRE) -- May 2, 2007 -- Sunbelt Software, a leading provider of Windows security software, today announced the top ten most prevalent spyware threats for the month of April. The results are based on monthly scans performed by Sunbelt's award-winning antispyware product, CounterSpy™.

The top ten most prevalent spyware threats for the month of April are:

1.      Trojan-Downloader.Zlob.Media-Codec      1.68%

2.      Virtumonde                              1.59%

3.      Trojan.FakeAlert                        1.16%

4.      ClickSpring.PuritySCAN                  0.61%

5.      Malware-Stopper                         0.52%

6.      Trojan.Unclassified.gen                 0.38%

7.      Trojan-Downloader.Win32.ConHook         0.30%

8.      180solutions.SearchAssistant            0.30%

9.      Trojan.Smitfraud                        0.28%

10.     SpyLocked                               0.26%

Trojan-Downloader.Zlob.Media-Codec is a trojan that installs rogue security software on the infected machine without notice and consent. It purports to be a needed codec or upgrade to Windows Media Player when users attempt to watch certain adult/porn videos to trick the user into downloading it. Once downloaded, it contacts remote servers and initiates the download of rogue security software such as SpywareQuake.


Virtumonde is an adware program that displays pop-up advertisements on the desktop and also downloads other software from various remote servers. There are many variants of Virtumonde, some with trojan-like behaviors including downloading other software without notice and consent, transmitting information to remote servers without notice and consent, and lowering system security on the infected machine.


This program is used to trick the affected user into purchasing certain security applications. Trojan.FakeAlert will display false warnings that the computer is infected and uses a fake Windows update globe to trick the user into thinking that Microsoft Windows is reporting a spyware infection. Clicking on this notification directs the user to a pre-defined website to order malware removal software.


ClickSpring.PuritySCAN is an adware program that scans a user's Internet Explorer files, including browser cache, cookies and history for pornographic/adult related words and allows the user to delete them.


A purported antispyware application to scan for and remove spyware from users' computers. It hijacks the user's desktop and typically displays exaggerated or false claims of spyware found to frighten the user into paying for the program.


Unclassified Trojan programs that are installed under false or deceptive pretenses or is installed without the user's full knowledge.


Trojan-Downloader.Win32.ConHook is a program that contacts remote websites, then downloads and executes additional malware in the infected machine. It sets itself to run at Windows start up, and some variants load very early in the boot process with Winlogon.


An adware application that monitors users' search queries and web surfing in order to display targeted advertising. 180solutions.Search Assistant opens new browser windows on the user's desktop based on search keywords and browser activity. The user's browsing history and search queries monitored and transmitted to 180solutions' server in order to show ads, usually pop-ups.


Trojan.Smitfraud downloads and installs programs that purport to scan for adware and spyware and typically display false reports of spyware in order to frighten the user into paying for the program.


SpyLocked is a purported antispyware application that scans for and removes spyware from users' computers. It may be downloaded and installed through exploits or under dubious circumstances without user consent.

About Sunbelt Software's Threat Research Center

The Sunbelt Software Threat Research Center specializes in the discovery and analysis of dangerous vulnerabilities (i.e., security holes, bugs, maligned features or combination of operations) that could be exploited for Internet and email attacks. The research team actively researches new spyware outbreaks, creating and testing new spyware definitions on a constant basis. For detailed spyware research information and to view the top ten spyware in real-time please visit

About CounterSpy

CounterSpy offers the industry's first "hybrid" antispyware scanning engine that provides unparalleled malware detection, remediation, and real-time protection for today's evolving blended threat landscape. CounterSpy delivers several new features, including VIPRE™ antimalware technology, FirstScan™ boot-level scanning, kernel-level Active Protection, and support for Windows Vista.

Designed to be a one-stop solution to the spyware problem, with an extensive database of current malware threats, CounterSpy aggressively scans, detects, and removes a broad range of adware, spyware and other malware, while providing real-time prevention to reduce the chance of future spyware infections. With the best spyware database in the industry, CounterSpy delivers one of the highest threat detection rates in the industry and has received the Best Buy and World Class Awards from PC World, Editor's Choice Award from Laptop Magazine, a 5-cow rating from Tucows, and a 5-star rating from CNET's A 15-day trial of CounterSpy V2 is available at

About Sunbelt Software

Headquartered in Tampa Bay (Clearwater), Fla., Sunbelt Software was founded in 1994 and is a leading provider of Windows security software with product solutions in the areas of antispam and antivirus, antispyware, and vulnerability assessment. Leading products include the CounterSpy product line, Sunbelt Messaging Ninja and endpoint firewall technologies. The company is part of Sunbelt International Group, based in Paris, France.

For more information about Sunbelt Software, please visit the company's website at:

Copyright © 2007 Sunbelt Software. All rights reserved. All trademarks used are owned by their respective companies.

Contact Information