Spy(ware) vs (Anti)Spam

SpamButcher uses a common component to recover intercepted messages and send spam email reports to users. It turns out that a few pieces of malware use the same component to in fact send spam emails from hijacked zombie computers.

Certain anti-spyware products apparently identify the component as being a possible trouble-maker and remove it. Obviously this creates a major problem and the product doesn't function properly. SpamButcher spam protection continues to function, but it has problems restoring messages. At least intercepted emails can still be viewed within the application.

I'm a little frustrated that anti-spyware vendors would be so indiscriminate. At the same time, it wouldn't surprise me if over 90% of installed instances of the component were the result of something malicious. As a spam filter author, I certainly understand that compromises have to be made when designing filters and algorithms.

The quick remedy is to re-install. For some users with more aggressive monitoring products this only presents a very temporary solution.

As anti-spyware products have become more popular, the problem has increased. The good news is that there appears to be a work-around. The new code is integrated in the latest version of SpamButcher. It's of course the same work-around that malware authors might use to avoid detection. Hopefully another round on re-engineering won't be required.

The component itself is just a programming tool. Like a nail-gun, it's neither good nor evil. In the right hands it's an effective tool. In the wrong hands it can make a real mess.

Back