BleepingComputer.com: Is "Spyware Cease" a rogue anti-spyware app?

I was reading an article on cleaning malware at:

http://www.maximumpc.com/article/howtos/ul...r_pc_junk_files

In the article they refer people over to www.combofix.org which has a link that appears to download combofix from bleepingcomputer.com...

On the same page it recommends a program called "Spyware Cease" which my AntiVirus detected as a virus.

Quote

In looking on the net for info on this software I have found mixed reviews.

I installed it on an isolated PC that I use for software testing and then ran combofix - and combofix removed "Spyware Cease"

I believe it is a "rogue" program.

1. Is Spyware Cease a rogue program?
2. Is combofix.org a rogue site?


Your thoughts?

Spyware Cease is available at several of the major download sites so it appears legit or they would not be hosting the program.

http://www.softpedia.com/get/Internet/Popu...are-Cease.shtml
http://downloads.zdnet.com/abstract.aspx?k...mp;docid=914643
http://www.download.com/1770-20_4-0.html?q...htype=downloads

However, how effective it's detection/removal scanner is...that's another question. I don't know any experts who use this program. As such, i recommend that you use one with a proven track record like those mentioned in BC's Freeware Replacements For Common Commercial Apps or Trustworthy Anti-Spyware Products.

Please note the message text in blue at the top of this forum.

You should not be using Combofix unless instructed to do so by a Malware Removal Expert who can interpret the logs. It is a powerful tool intended by its creator to be "used under the guidance and supervision of an expert", NOT for private use. Combofix was never meant to be used as a general purpose malware scanner like SuperAntispyware or Malwarebytes' Anti-Malware. Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again. Please read Combofix's Disclaimer.

Although this program may be posted on numerous sites this does not mean that it is legitimate. XP Antivirus 2009, AV 360, etc.. These also were posted on several sites for download and they are rogue applications. I have come to find that if a piece of protection software that you are running finds something and removes it, then it's best to believe what it says. The people that make protection software programs specialize in finding programs, viruses, and rogue applications that are harmful to your computer. So, I would believe my protection software before I would believe what someone posted on the internet. The downside of the internet is that not everything is true.

Quote

If a program is hosted on one of the major download sites, that means it has been reviewed/tested and is not a rogue.

XP Antivirus 2009 which is a rogue is not available for download at these sites. For more detail on how these types of infections install themselves, read Anatomy of a malware scam.

Quietman7, Thank you for pointing out that the sites you posted did not have the rogue application AV 2009 available for download, this is not what I meant in my post. I was merely stating that there is a possibility of rogue applications being posted on well-known download sites. Also, I am familiar with rogue applications and what to look for, I do this on a daily basis. I sense a little agitation in your reply above to my previous posting. I did not intend to make you angry, nor was I attempting to say what you posted was wrong. My apologies for any unintended frustration.

You know of course that there's a difference between a rogue program and an attempt at a legit program that is ineffective and therefore a failure. There are are plenty of the latter but none of the former on Download.com.

I would consider this a rogue and malicious. I tested it myself, and it said I had 19 different infections. All but one of those (which was an older file whose ownership I could not determine) were Windows system files, Internet Explorer files, Windows Update files and standard registry entries. It even said that the HKLM Runservices key was a trojan. It also loads a hidden driver, and sets debug privileges.

Spyware Cease is a legit program (at least so far).
The program did not produce any false positives on a clean machine. They have also changed the shareware restrictions in the latest version and allow full removal during the trial period - not something a rogue app would do, as they try to scare people into purchase. It's not the greatest as far as features go, but it's not rogue.
If it is listed at snapfiles.com, you can be fairly certain that there is nothing rogue about it.

Both IObit Security 360 and Malwarebytes Pro flagged this software as "Rogue Anti-Spyware" upon attempt to install. This occurred with Spyware Cease versions 4.6.1 and 5.0.2.

~Hawk~