The Federal Trade Commission has pulled the plug on a massive spyware operation that allegedly used Google Inc.s BlogSpot service to trick millions of computer users into downloading spyware and adware programs.
The FTC on Thursday announced a court order to shut down three California-based companies—Enternet Media Inc., Conspy & Co. Inc. and Networld One—that allegedly used free lyric files, browser upgrades and ring tones to push spyware programs on consumers computers.
The charges stem from the discovery earlier this year that Googles BlogSpot service was being used to spread spyware and adware programs such as "Search Miracle," "Miracle Search," "EM Toolbar," "EliteBar," and "Elite Toolbar."
According to the FTC complaint, the spyware ring used the iWebTunes Web site to promise free background music on the BlogSpot-hosted sites.
The pop-up warning promised browser upgrades and other PC maintenance software. Instead of getting security software, computer users who clicked on the pop-ups were tricked into downloading spyware programs that only served more pop-up ads, the FTC complaint alleged.
The federal agency said the court also froze the assets of the three outfits pending a further hearing.
The FTC also plans to ask the court to bar the deceptive and unfair practices permanently and require the operators to give up their gains.
"This is a big bust. Enternet media is the company behind one of the most destructive and abusive spyware programs," said Eric Howes, a renowned anti-spyware researcher who assisted the FTC with the investigations.
"These are guys behind SearchMiracle and EliteBar, two of the nastiest spyware programs. They were also using rootkit technology to hide files and defeat anti-spyware software. Were talking about one of the worst pieces of spyware around," Howes said in an interview.
Howes provided Ziff Davis Internet News with numerous screenshots of SearchMiracle and EliteBar pop-up advertising and installations, including logs from RootKitRevealer that show the company was hiding .dll files from the Windows API.