Wednesday, September 24, 2008

New Spyware Threat

There a new nasty and aggressive type of malware that can be very difficult to remove. It calls itself XP Antivirus, but it is a total ripoff.

It will usually show up as a pop-up warning you that there is some sort of scary activity going on, with a link to download the software to protect yourself. The warning is a lie, and if you do download the software (a process that sometimes happens automatically without you doing anything to start it), XP Antivirus will install itself, giving you popups, and a lot of dire spyware warnings (all false except for the spyware XP Antivirus installs itself). And you will be required to purchase the program in order to “clean” your computer – really just turn off the fake warnings and keeping any spyware XP Antivirus installed.

It is one of the most despicable of scams. In addition, the software can really screw up your computer; there was one student whose desktop didn’t display once he got infected. I’ve also seen the Windows automatic update turned off – and you can’t turn it back on.

And it hides from many antispyware programs, so cleaning can be difficult. I've tried several times to use things like Ad-Aware, Spybot, Hijackthis, and even Vundofix -- all generally good programs, but no match for this one.

Luckily, there is now fix. Malwarebytes – a new anti-spyware program from malwarebytes.org – seems to clean it up quite well. If you’re infected, download the final, install it, and let it scan. Malwarebytes is new, so XP Antivirus isn’t set up to hide from it (yet). I’ve gotten some very good results on badly infected machines.

Of course, XP Antivirus will probably figure out a way to defeat Malwarebytes.  These type of spyware blackmailers are basically lower than pond scum, but, alas, they don't care.