ShawnF

Is this it?

http://www.winantivirus.com

According to the blurb at http://tired-of-spam.home.comcast.net/other.html it is a spyware host. Not sure if it has other nefarious purposes, or if it is a good quality a-v package at all. I think you did the right thing - as I've never heard of it before 5 minutes ago as well.

John

That could be it.  It's using the same "feel" or look.  The only exception is they are calling it WinAntivirus 2004, whereas the software windows and the Help--> about window called it Windows Antivirus 2004 (instead of WinAntivirus 2004).  Short of installing it and trying it out, I'm not sure.  I might test it on a non-networked PC that I don't care about.

I also noticed how the WinAntivirus 2004 link you provided has some really lame webpage (lacking) contact info, support section, etc....  Kinda like the software was lacking anything but basic features.

and a few spelling/grammatical mistakes. If it was a legitimate commercial product , I think that the authors would have taken more care over it.

John

That appears to be it.  I looked at the manual and they show a screen shot of the main control panel for the software.  That's what it looked like.  However, halfway through looking at the manual, Adobe locked up along with the browser window I had opened at www.winantivirus.com. I hope something isn't happening on my PC now....  Time to check the firewall traffic.

Oh great, I just figured out something else.  The user had downloaded a popup blocker program, but another website is also calling that one spam.  It's called PopupGuard.  The website warning to avoid it is:

http://tired-of-spam.home.comcast.net/popupguard.html

I found this out because the tire-of-spam page also mentions WinAntivirus 2004!  I just happened to notice that the popupguard program was also mentioned on the webpage.  

Amazing reading guys, looks like you have come to the right conclusion.  Hard to believe people would buy spam protection from a spam email, or pop up blockers from a pop up ad, but people will. I'd bet Symantec would like to hear about this even if they haven't already.  Clearly is was designed to fool users of thier products.

I just inadvertantly purchased winantivirus.  I was renewing my Symantec SW and, not paying too much attention, filled out the winantivirus popup rather then the Symantec window in behind it.  Clever marketing as it looks like Symantec.  I did not install the SW and am in the process of getting a refund from billingnow.com.

Lesson - pay attention.  My biggest concern is that they now have my CC #, expiry date, billing address, etc.

I have just reported this product to symantec, referencing this thread and the website above. I will let you know what (if anything) happens.

John

I reported it to Symantec as well.  I asked them to fill me in when they are done on what they found.  

To www.billingnow.com (s) credit, they emailed me within 24 hours informing me of a full refund on my next statement.

If you are begin Phished, check out the government's site at www.ftc.gov/bcp/conline/pubs/alerts/phishingalrt.htm. I don't know if they handle compaints outside of the US but I suspect other countries may have something similar.

James P. Cottingham

^{There's no place like 127.0.0.1.
There's no place like 127.0.0.1.}

I know someone that did this too.. what is that fax number????  Thanks!

The Fax Number for Billingnow.com is:

Fax: 617-687-0302

Unfortunately they never responded to me.  I did receive an answer from customer support at WinAntivirus:

support@winantivirus.com

I think if you write a nasty letter, they will refund your money, no questions asked.

Well, I've still not heard anything from Symantec, so can only assume that they're not interested in this blatant stealing of their image and possible tarnishing of their reputation.
I have posted a note in the Spyware newsgroup at Gibson Research, so hopefully this may get Steve Gibson, internationally recognised IT security expert, to look at it. His profile might make Symantec wake up and take notice.

John

I haven't heard anything from Symantec either.  The person whose laptop I originally worked on and found WinAntivirus on is just cutting their losses monetary-wise.  The computer appears to be ok now after several weeks of use, now that I uninstalled WinAntivirus and PopupGuard, installed Norton Antivirus Corporate Edition, ran Ad-aware and Spybot, manually removed anything referring to WinAntivirus or PopUpGuard n the registry.  

Download and run the FREE stinger application from McAfee:

http://us.mcafee.com/virusInfo/default.asp?id=stinger

Good luck!

I had the same experience as Shawn. My customer got hooked into buying the WinAntivirus 2004 software by the spyware redirecting his renewal traffic to the WinAV site. The spyware actually hijacked the traffic from Symantec's renewal center page and redirected it to the WinAV site. I have reported it to not only Symantec but also the Federal Trade Commission and since they are using Microsoft Windows in their ads I reported it to Microsoft as well.  What really needs to happen is for these pernicous vermin to be hunted down and chained face first to wall in Iraq for Al Qaeda to use for their carnal enjoyment.

Also, just to ad insult to injury, there is an ad for this EXACT same software at the top of this Tek-Tips page. Right next to a Norton AV ad. Maybe Tek-Tips should be a little more careful who they are accepting ads from.

The problem I am having is with 3 full screen popups: WinAntivirus, WinPopupGuard and WinFirewall2004. They are all registered out of the country. The completely fill my screen so I have to alt-ctrl-del to get rid of them. I've run Ad-Aware and SpyBot - they find it, I delete them but they come right back. Shawn posted that he/she removed all references in the registry but I don't know how to do that (I'm only semi-techy). These popup are driving me crazy. Can anyone here please HELP!!!!

Thanks

To the remove the reg entrees go to the run command in the start menu and type Regedit or regedit32, either one works.  Then from the edit menu select find and start searching for WinAntivirus, WinPopupGuard and WinFirewall2004 deleting* the entrees as you go.

*Note: deleting the wrong thing in the registry can damage a system so I urge caution, and refuse to take any blame if it screws something up.

What I've been learning about spyware/adware in general is that there is no simple 1-2-3 step process to removal.  Every case has been unique.  I've seen everything from simple annoying popup ads, to full blown computer crashes and computers not even booting because of numerous spyware programs all trying to load during boot up and crashing and causing an endless loop.  Programs like Ad-aware and Spybot work great, but they only work about 80% of the time for me.  The rest of the time, I have to go through the computer and basically just snoop around and look for things that don't seem right.  This can be anything from looking at folder names in the C:\Program Files directory or other directories, to going through the registry and searching for key terms I know of, plus looking at the RUN folders and looking for suspicious things.  Sometimes doing all that isn't enough, and it can get to the point where restoring a machine, reloading software, and reloading data is faster then spending hours upon hours of searching for spyware.  

Spyware wasn't designed to be easily detected, much less easily removable.  And it seems that when you get one of them on the machine, it invites all it's friends.  What worked for me in the case of WinAntivirus and PopupGuard was to "uninstall" them from Add/Remove Programs, look for and delete what looked like their folders in C:\Program Files, run Ad-aware and Spybot, search the registry for key terms (e.g. search for "Winantivirus"), and finally to snoop around for folders elsewhere such as C:\Documents and Settings\Users Name\Application Data.  I don't remember where I found some folders to delete or what they were called, and it really wouldn't matter anyway because their names and locations could easily change from one computer to another.

As for going through the registry, I don't recommend doing anything with it unless you are comfortable modifying the registry and know how to undo things if you made a mistake.  Editing the registry can be very dangerous and can prevent the computer from booting.  And of course, make sure to back up the registry before doing anything.

     Here is a link to another forum discussing winantivirus redirection and scamming techniques; good reading...
http://www.dslreports.com/forum/remark,9410021~root=scambusters

If you're going through Hell...keep going...  (Winston Churchill)
      RocKeRFelLerZ

I looked in the registry but found none of them - prob cuz I just cleaned my system with SpyBot and Ad-Adware. BUT I did find that I didn't have the box checked to ask me if I wanted to allow any of them. Now that I have done that I get a popup telling me it wants access, at which I say no. I can change it to not ask me but am interested in how often it's happening - for now anyhow. If nothing else I don't get the full screen in my face and have to stop to alt-ctrl-del. I'm waiting to see if XP SP2 really has better security b4 installing it - hopefully it will help. In the meantime, you all are a great resource and I sure appreciate the time you take to post and research this stuff.

Thanks!!!!