Mystery around 'Winfixer' slowly unravels, lawyer says

Bochner acknowledges it's hard work to track down fraudsters who use the Internet's anonymity to commit crimes, but the criminals are real people who can be located. Bochner said he has compelling documentation to link the defendants named in the suit to Winfixer.

By researching IP (Internet Protocol) addresses that hosted the versions of Winfixer and their owners, Bochner alleges he has uncovered a fraud based in the U.S. that has escaped law enforcement scrutiny.

Reno ran a Web hosting company called ByteHosting Internet Service with a postal address in Amelia, Ohio. Bochner said at one time, a support number for Winfixer support also rang through to ByteHosting, which led in part to Reno being added to the suit.

Reno, along with other co-defendants and ByteHosting, was sued by Symantec in 2004 for allegedly creating pop-up ads that told consumers their Symantec software was about to expire. The ads then directed users to fake software that looked similar to Symantec products. Court records show Reno and Symantec reached a confidential settlement in December 2004.

Cohen was named for his connections with vipfares.com, a now-defunct travel Web site, Bochner said. At one time, the Winfixer software would hijack the user's browser and suddenly show vipfares.com, he said.

Efforts to reach Cohen and Reno for comment were unsuccessful on Wednesday and Thursday. However, Cohen's attorney, Judy Silverstein, appeared on a San Francisco TV news program on Feb. 26 regarding Winfixer and her client.

Silverstein said, "His [Cohen's] position is he's done nothing wrong. He's done nothing improper or illegal, and he's had no ownership interested in those Web sites."

Bochner said he has turned over some of his research to law enforcement agencies such as the U.S. Federal Bureau of Investigation and Secret Service along with California authorities.

While researching IP addresses that linked to Winfixer, Bochner said he suddenly came upon a database detailing sales of Winfixer and the other versions of the programs.

The multi-gigabyte database -- apparently left unsecured and open to the Internet -- contained names, addresses, credit-card numbers, transaction amounts and the version of Winfixer that was sold, he said. For example, on Jan. 20, 2006, the data showed 2,351 sales to users worldwide, with an average transaction amount of $40, Bochner said.

The database covers transactions made from January 2005 through January 2006. One of the records shows a transaction made by someone who lives across the street from his law office, Bochner said. The data, while incomplete, allows a view of the fraud ring's broad reach and scope, he said.

"I think this is far larger than anyone has ever expected," Bochner said. "It's not inconceivable that these people have made $150 million or more over the last few years."