Link:

http://www.theregister.co.uk/2008/08/22/an...hack/print.html

Here is the hole description of what XP Antivirus 2008 does.

Stay away from this malware scam.

It's latest iteration is called Virus Sweeper. You can find it here in the following link exactly as described in the article. Please be aware this is fake AV and malware!

xttp://virussweeper-scan.net/?p=nqd2bF6poZ2eXpSWZGNeZ1in12rZpobPoNfFiZOglnPHwLKpl6aaWpmWmqueeqenhXN1

Ted.

Edited May 27, 200916 yr by CodeRipper

Seems that they change the domain very often.

This malware is based on W32.Trojan.Downloader.s read more on http://www.411-spyware.com/remove-w32-trojan-downloader-s

This malware has a lot of brothers:

- Antispywareboss.com read more on http://www.411-spyware.com/remove-antispywareboss

- antivirus-2008-pro.com read more on http://www.xp-vista.com/spyware-removal/an...al-instructions

- securityscannersite.com read more on http://www.411-spyware.com/remove-securityscannersite-com

- winantispyware2008.com read more on http://www.bleepingcomputer.com/malware-re...antispyware2008, on http://www.411-spyware.com/block-winantispyware2008-com or on http://removal-tool.com/winantispyware-2008/

- xpsecuritycenter.com read more on http://www.411-spyware.com/remove-xpsecuritycenter-com

http://www.blogcatalog.com/blog/411-spywarecom seems to give information on a lot of spywares. I love this website.

Edited May 27, 200916 yr by CodeRipper

It is worth downloading and taking a look in a closed environment to see how it works and behaves.

Certainly an up front and bold form of malware but I suspect as the author stated in the article it must catch many unwary internet users out and why it is still being used and developed further...

Ted.

I've had people call up my work who have had purchased 'anti-virus' software like this before.

Here is one of the installer builds. Only install this under a closed environment designed for analysis work...

Setup_build8_1003313.zip

Password: tuts4you

Ted.

Here is one of the installer builds. Only install this under a closed environment designed for analysis work...

Setup_build8_1003313.zip

Password: tuts4you

Ted.

I'll give it a fire up in one of my VM's later.

Eitherway, this reminds me of the days of SpySheriff/Pest Trap.