—–
http://blog.tmcnet.com/blog/tom-keating/microsoft/windows-defender-calls-alexa-toolbar-trojan.asp

So does Microsoft have it in for Alexa? What gives? This is a valuable tool used by millions of users to track their own traffic and their competitors traffic. Yes, it is a “form” of spyware since it reports your web surfing habits, but it certainly isn’t a “trojan clicker”. Clearly this is a mis-classification on Microsoft’s part. Also, the risk level should be “Medium” at worst – not “High”. I should add that most users that install the Alexa toolbar are aware that it reports which websites you visit .

I’m going to research this some more and post more here. Stay tuned!

Update:
One theory I have is that the actual Win32/VB.BZ “TrojanClicker” uses a very similar “signature” that Alexa does. Anti-virus and anti-spyware programs rely on signature fingerprints to identify threats. It’s possible Win32/VB.BZ “TrojanClicker” was developed with a similar signature as Alexa on purpose to try and masquerade itself as the Alexa toolbar. In the process of trying to look like Alexa’s signature, Microsoft Defender is probably identifying the Alexa Toolbar incorrectly.

Yes, Alexa stats are inaccurate.

If you rank high, you have very good traffic, but anything below 20,000 only tells you that there isn’t a flow of net savvy visitors.

Here is Matt Cutts’ thoughts on Alexa Traffic 2 years ago

Its funny, because I do use a FireFox plugin with Alexa Rankings, and I was working on a client’s project – and with just ME accessing the site many times a day to make changes to the site, I upped the rankings from the initial 26 mil to 6 mil within 2 weeks. Heh.

Avira says: Contains recognition pattern of the DR/AlexaBar.N.207 dropper.

Of course it’s been configured for maximum sensitivity (better safe than sorry).

I’ve also personally seen exactly how inaccurate Alexa’s statistics actually are, that is, unless you’re in the top 500 (very difficult to reach that one).

Looking past a bit of spying, some frivolous network traffic, a few spare cpu cycles and a prime strip of browser real estate it’s not all bad (or is it?).

Typically each toolbar user’s traffic is amplified by a very large factor to get a ballpark figure of traffic patterns, this presents the opportunity for a small group of users or a single user exploiting multiple accounts to significantly skewer the Alexa statistics.

Another potential issue might be a malicious exploit that hooks into the relatively insecure local toolbar via javascript to elevate access permission beyond those normally granted to remote scripts.

@ Kian Ann: AV scanners are a prime target for “smart” viruses trying to operate in stealth mode. Some taint the AV software while others have been known to disable and then mimic the user interface to provide a false sense of security. Rootkits take this a step further and go directly for the system kernel to hide their presence. Still, the most disturbing attack I’ve witnessed was an internet worm that gained entry to systems via Norton Anti-Virus’s “LiveUpdate” service. Now there’s irony for you.

Me better uninstall tonight.

John Tan
http://www.JohnTanBlog.com

Mark, thanks! In that case Alexa becomes pretty useless huh? The rankings are not really representative and the toolbar uses spyware!