Antivirus X P 2008 - crownprogs’s blog

As new threats for Windows XP, Windows Vista, Windows 7 and Windows 8 emerge, Symantec immediately builds new protection updates and makes them available for.

Norton AntiVirus is a well-known security application made to fight off malware in all shapes and sizes. Featuring a real-time shield, multiple scan modes.

Panda Security gives you the best antivirus software for Windows and Android devices. Protect your computer from malware and scams.

Oct 05, 2015 Download Norton AntiVirus 2014 21.6.0.32 - Stay protected with the world s most trusted antivirus software.

Award-winning antivirus and security software from Bitdefender. Get the best real-time security for your PC, Mac and mobile devices.

Looking for free Open Source Antivirus for Windows. Download ClamWin Free Antivirus and get free virus scanning and free virus definition updates.

Not to be confused with Microsoft Anti-Virus or Microsoft Security Essentials. MS Antivirus also known as Spyware Protect 2009 is a scareware rogue anti-virus which claims to remove fake virus infections found on a computer running Microsoft Windows. It attempts to scam the user into purchasing a full version of the software. 1

Contents

1 Names

2 Symptoms of infection

3 Malicious actions

4 Earnings

5 Court actions

6 See also

7 References

8 External links

Many clones of MS Antivirus that include slight variations have been distributed throughout the web. They are known as XP Antivirus, 2 Vitae Antivirus, Windows Antivirus, Win Antivirus, Antivirus Action, Antivirus Pro 2009, 2010,2017 or simply just Antivirus Pro, Antivirus 2007, 2008, 2009, 2010, 2011, and 360, AntiMalware GO, Internet Antivirus Plus, System Antivirus, Spyware Guard 2008 and 2009, Spyware Protect 2009, Winweb Security 2008, System Security, Malware Defender 2009, Ultimate Antivirus2008, Vista Antivirus, General Antivirus, AntiSpywareMaster, Antispyware 2008, XP AntiSpyware 2008, 2009 and 2010, Antivirus Vista 2010, Real Antivirus, WinPCDefender, Antivirus XP Pro, Anti-Virus-1, Antivirus Soft, Vista Antispyware 2012, Antispyware Soft, Antivirus System PRO, Antivirus Live, Vista Anti Malware 2010, Internet Security 2010, XP Antivirus Pro, Security Tool, VSCAN7, Total Security, PC Defender Plus, Disk Antivirus Professional, AVASoft Professional Antivirus, System Care Antivirus, and System Doctor 2014. Another MS Antivirus clone is named ANG Antivirus. This name is used to confuse the user of the software into thinking that it is the legitimate AVG Antivirus before downloading it. 3

Symptoms of infection edit

SWP 09 protecting the user from microsoft.com. Notice that the word type is different than what Internet Explorer usually uses.

Each variant has its own way of downloading and installing itself onto a computer. MS Antivirus is made to look functional to fool a computer user into thinking that it is a real anti-virus system in order to convince the user to purchase it. In a typical installation, MS Antivirus runs a scan on the computer and gives a false spyware report claiming that the computer is infected with spyware. Once the scan is completed, a warning message appears that lists the spyware found and the user either has to click on a link or a button to remove it. Regardless of which button is clicked -- Next or Cancel a download box will still pop up. This deceptive tactic is an attempt to scare the Internet user into clicking on the link or button to purchase MS Antivirus. If the user decides not to purchase the program, then they will constantly receive pop-ups stating that the program has found infections and that they should register it in order to fix them. This type of behavior can cause a computer to operate more slowly than normal. MS Antivirus will also occasionally display fake pop-up alerts on an infected computer. These alerts pretend to be a detection of an attack on that computer and the alert prompts the user to activate, or purchase, the software in order to stop the attack. More seriously it can paste a fake picture of a Blue Screen of Death over the screen and then display a fake startup image telling the user to buy the software. The malware may also block certain Windows programs that allow the user to modify or remove it. Programs such as Regedit can be blocked by this malware. The registry is also modified so the software runs at system startup. The following files may be downloaded to an infected computer: 4

MSASetup.exe

MSA.exe

MSA.cpl

MSx.exe

Depending on the variant, the files have different names and therefore can appear or be labeled differently. For example, Antivirus 2009 has the. Exe file name a2009.exe. Citation needed

In addition, in an attempt to make the software seem legitimate, MS Antivirus can give the computer symptoms of the viruses that it claims are on the computer. 5 For example, some shortcuts on the desktop may be changed to link to pornographic websites instead. Malicious actions edit

Most variants of this malware will not be overtly harmful, as they usually will not steal a user s information as spyware nor critically harm a system. However, the software will act to inconvenience the user by frequently displaying popups that prompt the user to pay to register the software in order to remove non-existent viruses. Some variants are more harmful; they display popups whenever the user tries to start an application or even tries to navigate the hard drive, especially after the computer is restarted. It does this by modifying the Windows registry. This can clog the screen with repeated pop-ups, potentially making the computer virtually unusable. It can also disable real antivirus programs to protect itself from removal. Whichever variant infects a computer, MS Antivirus always uses system resources when running, potentially making an infected computer run more slowly than before. The malware can also block access to known spyware removal sites and in some instances, searching for antivirus 2009 or similar search terms on a search engine will result in a blank page or an error page. Some variants will also redirect the user from the actual Google search page to a false Google search page with a link to the virus page that states that the user has a virus and should get Antivirus 2009. In some rare cases, with the newest version of the malware, it can prevent the user from performing a system restore. 6

Antivirus 2009 can also disable legitimate anti-malware programs and prevent the user from opening or re-enabling them. Anti-malware applications disabled by Antivirus 2009 include McAfee, Spybot - Search Destroy, AVG, Malwarebytes Anti-Malware, and Superantispyware. Earnings edit

In November 2008, it was reported that a hacker known as NeoN hacked the Bakasoftware s database, and posted the earnings of the company received from XP Antivirus. The data revealed the most successful affiliate earned USD 158,000 in a week. 7 8

Court actions edit

On December 2, 2008 the U.S. District Court for the District of Maryland issued a temporary restraining order against Innovative Marketing, Inc. And ByteHosting Internet Services, LLC after receiving a request from the Federal Trade Commission FTC. According to the FTC, the combined malware of WinFixer, WinAntivirus, DriveCleaner, ErrorSafe, and XP Antivirus has fooled over one million people into purchasing the software marketed as security products. The court also froze the assets of the companies in an effort to provide some monetary reimbursement to affected victims. The FTC claims the companies established an elaborate ruse that duped Internet advertising networks and popular Web sites into carrying their advertisements. According to the FTC complaint, the companies charged in the case operated using a variety of aliases and maintained offices in the countries of Belize and Ukraine Kiev. ByteHosting Internet Services is based in Cincinnati, Ohio. The complaint also names defendants Daniel Sundin, Sam Jain, Marc D Souza, Kristy Ross, and James Reno in its filing, along with Maurice D Souza, who is named relief defendant, for receiving proceeds from the scheme. 9