February 20, 2007

Microsoft's IM hijacked by security scam

Another rip-off.

By Jeremy Kirk, IDG News Service

---

Banner advertisements for a security application said to report false or inflated threats have appeared on Microsoft’s IM program, security analysts have warned.

Microsoft appears to have removed the ads, which were displayed in the contacts panel for its IM program, Windows Live Messenger, said Sandi Hardmeier, a Microsoft Most Valued Professional, a designation the company gives to people who have expertise with its products.

The programme, known as Winfixer, falsely warns a computer has been infected with malicious software, according to Symantec. It asks users to buy a program to remove the unwanted software.

"Quite often, it reports files that are perfectly safe," Hardmeier said. "It uses a lot of false positives. Basically, it's a rip off."

Other security companies, such as Sophos and McAfee, classify Winfixer as a "potentially unwanted application", or PUP.

Hardmeier, who notified Microsoft of the problem, said the ads that appeared on Windows Live Messenger tried two ways to get users to install Winfixer on their machine.

The first was via a pop-up window offering to scan the computer for problems, she wrote. Depending on the version of Internet Explorer used, Winfixer would try to download itself through an Active X control, she said.

The second way was through a banner advertisement that a user would have to click before being taken to a Web site offering Free PC-Secure, a program that is detected as Winfixer by most security software, she said. Winfixer goes by several different names, including ErrorSafe and DriveCleaner.

Microsoft had done well preventing spyware programs from being advertised in banner ads on Windows Live Messenger, formerly known as MSN Messenger, Hardmeier wrote on her blog on her blog, Spyware Sucks.

But Winfixer has proved a tricky foe. Advertising networks have had trouble with Winfixer ads suddenly being served up by their networks despite no affiliation with its creators, Hardmeier said.

The suspicion is that organisations have falsely registered with the networks and substituted Winfixer ads - hosted on their own servers - instead of the advertisements they agreed to supply, she said.

Microsoft officials contacted in London on Monday morning could not immediately comment.

Newsletters

Sign up to our Weekly Round-Up for the past week’s not-to-be-missed news analysis and insight delivered straight to your inbox.