NWA-PCUG Newsletter Article, October 2008
XP Antivirus 2008 SCAMS and SCUMWARE
By Ira Wilsker, APCUG Director;
Columnist, The Examiner, Beaumont, TX; Radio & TV Show Host

(click to email author)

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php - INSTRUCTIONS
http://siri.urz.free.fr/Fix/SmitfraudFix.exe - PROGRAM FILE

I recently received a frantic phone call from a former employee of KLVI. He had a popup appear on his screen that told him that his computer was infected with over 300 pieces of malware, and he needed to purchase and download a special antivirus and anti-spyware program to remove it.

Believing the warning was authentic, as he had a major antivirus program installed and thought it was his program alerting him, he dutifully clicked on the link in the popup and downloaded a mischievous piece of scumware called XP Antivirus 2008. This malware is also widely circulating over the internet under the monikers Antivirus XP 2008, Vista Antivirus 2008, or XP Antivirus 2009, as well as other permutations of the name. This problem has become so widespread, that I get regular calls on my radio show and emails appealing for help in removing this scumware. To compound the problem, and ultimately add to the misery it brings, there are some other companion scumware products that offer to remove XP Antivirus 2008 and its variants for a fee, usually between $29 and $49. Not just are these rogue removal programs a gyp and do not really work, but they may also contain additional Trojans, spyware, viruses, and other pieces of malware which will infect the now compromised computer.

According to CNET’s Download.com, “Antivirus XP 2008 is back, unfortunately. It's not an antivirus app, but a cleverly disguised rogue security application that tries to get you to buy the non-existent ‘security’ it's selling. Advertised using the common tricks of Trojans and faux security alerts, this nasty piece of malware can take over your desktop settings to mimic safe mode, display fake virus detections, and opens a faux Internet Explorer window stating that Google has detected a malware infection.” The popular website About.com describes this scumware as, “XP Antivirus 2008 is classified as a rogue scanner, sometimes referred to as scareware. Rogue scanners masquerade as antivirus, antispyware, or other security software, claiming the user's system is infected in order to trick him into paying for a full version. In some cases, users who pay for the full version of a rogue scanner product will end up with erroneous charges on their credit card after purchase. For example, a rogue scanner may claim the price is $49 but the charge that appears on the credit card may be as high as $190 or more.” The descriptions on About.com for the variant names are almost identical. If this product does not easily fit in the categories of scams and scumware, then nothing would.

These rogue security programs effectively take control of the victim computer, and may block access to legitimate websites and online services which may be able to help remove the otherwise difficult to remove infection. This scumware is designed to protect itself from removal, and leaves the computer open to further attack. Anecdotes published on reputable websites indicate that the potential threats from this software may include key-logging Trojans that can steal user names and passwords from financial websites, making the compromised computer a tool in identity theft and further financial losses.

Fortunately for the user, more legitimate and free services are now available to protect against XP Antivirus 2008 and its variants. Most major legitimate antivirus and anti-spyware software will now detect and prevent infection from this particular malware, but new variants of this scumware appear periodically, and seem to be able to penetrate the protective wall of traditional security software, requiring the legitimate companies to produce and distribute updates in this long running cat and mouse game.

Depending on the variant, I have had some success in removing XP Antivirus 2008 from infected machines using the common and popular free online scans from Trend Micro (housecall.antivirus.com), or Microsoft’s OneCare (safety.live.com). While these online scans work on some variants, it needs to be noted that some of the malware variants explicitly block access to these online scans. One free legitimate program that has been well regarded in its ability to remove XP Antivirus 2008 and its variants is SmitFraudFix, available for download at siri.urz.free.fr/Fix/SmitfraudFix_En.php. This program runs in a DOS (CMD) window, and has a simple menu hierarchy. I recommend that users read the instructions on the SmitFraudFix webpage before using the program the first time.

Another program which has had some positive success in removing XP Antivirus 2008 and its variants is MalwareBytes AntiMalware, available for download (and purchase) at http://www.malwarebytes.org. This program can perform a comprehensive free scan for malware, and remove it, but paid registration is required to access all of its powerful features such as its real-time protection mode. The Malware Bytes website states it this way, “Activating the full version unlocks real-time protection, scheduled scanning, and scheduled updating. It is a one time fee of $24.95.” Some of the companion programs, like RogueRemover are available in both free versions, and the more powerful (paid) “Pro” versions.

A painful lesson that many users have learned is not to click on popups using fictitious allegations of malware infection. XP Antivirus 2008 has been shown to infect computers via a variety of means, but most often as a Trojan included with other downloads, or from visiting websites which have been programmed to automatically download the malware when visited. If you get attacked by XP Antivirus 2008 or its variants, do not panic. If you cannot access the Housecall, Windows OneCare, SmitFraud, or MalwareBytes websites from the compromised computer, as the XP Antivirus has taken over the computer and will protect itself from removal, download SmitFraudFix or MalwareBytes AntiMalware on another computer, and copy it to a flash drive or CD. Run one of these programs and follow the onscreen prompts to get the scumware off of your computer.

This is a scam that had raked in countless dollars to its progenitors overseas, and prevention is the best way to avoid being scammed. Again, do not purchase XP Antivirus 2008, or any of its self-promoted uninstallation programs, as you are being scammed out of your money. Use one of the legitimate programs above to rid yourself of this scumware.

Click here to return to top