Be on the lookout for another new supposed anti-spyware program that might be hijacking desktops any day now. This one is called PestTrap and it's a clone of SpySheriff. SpySheriff was one of the top 10 rogue anti-spyware apps of 2005, coming in at number 2. You can see a screenshot of the PestTrap website at SunbeltBLOG and a screenshot of the app itself, along with the false positives in the scan results here. You'll see that SpySheriff, SpyTrooper, SpyDemolisher, SpywareNo! and Spyware-Stop are almost identical. If you scroll down the page a bit, you can see the other families of apps like SpyAxe and RazeSpyware that are deemed to be CoolWebSearch related by spyware researchers.
PestTrap was found being advertised on a new fake security center web page, uptodatesecurity.com (link to whois info). I don't recommend going to that page in Internet Explorer. Even in Mozilla a fake warning pops up saying "your pc is infected with spyware blah.. blah...". The domain is showing up in HijackThis logs already. Example here.
Last week I mentioned ISPs hosting spyware, but where are these CWS related rogue apps being hosted? Look at the whois info for pesttrap.com. Unlike SpyAxe which is hosted in the Ukraine, the PestTrap site is hosted at IP address 18.104.22.168 which belongs to an ISP in California, InterCage, Inc., formerly known as Atrivo. Note the nameservers are mail.atrrivo.com and pavel.atrivo.com.
OrgName: InterCage, Inc.
Address: 1955 Monument Blvd.
Not surprisingly, SpySheriff.com (link to whois) is hosted at InterCage, and we have SpyTrooper.com on the same IP address, 22.214.171.124. The other domain on the IP is Spy-Sheriff.com. This IP is also currently blacklisted.
InterCage, Inc. INTERCAGE-NETWORK-GROUP (NET-69-50-160-0-1)
126.96.36.199 - 188.8.131.52
William Lu STANDARDSHELLS (NET-69-50-170-0-1)
184.108.40.206 - 220.127.116.11
The Intercage.com (link to site) home page is white and blank except for "..." in the upper left corner. Now, that seems odd to me. An ISP with a blank homepage? Google searches for Intercage.com and Intercage, Inc. bring up all kinds of interesting links. A Google search for Atrivo produces even more fascinating information like this and this. More on this one later.