How can an infection like Antivirus XP 2008 happen?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

I got rid of Antivirus XP 2008 by System Restore. An easy way to get of any virus, and a good reason to keep System Restore enabled.

First off I am a field technician for a "Geek" pc service company. I have been dealing with the Antivirus XP 2008 and it's many variants for the last several months. About 50% of our clients fall for it and purchase the fake product and most clients wait several weeks before calling for help. This leads to additional infections getting on the pc. I can say for sure that it gets by Mcafee completely. Even if fully updated it doesn't even see the infection. It also gets by Norton and Trend Micro PC-Cillin. They see it but can't remove it. Each of these products include firewalls. I use Malwarebytes to remove it . But if it has been running on the system for a day or longer it may have pulled down more malware. So I also run Spyware Terminator, Combofix, Smitfraudfix, Hijack This. Also I clean out all temporary files before and after the cleanup with Ccleaner. All are free programs. I leave Spyware Terminator installed as it provides excellent real time malware protection for the system and doesn't interfere with anti virus programs. I recommend AVG for Antivirus protection. Windows defender I find to be almost useless and Spybot has become slow, bloated and tends to miss alot of malware. The same is true of Adaware. I no longer waste my time with these apps. I would not depend on them to keep your system safe.

How can an infection like Antivirus XP 2008 happen?

First of all, I must emphasize that Antivirus XP 2008 keeps coming back in various innovative forms and as a FAMILY OF VIRUSES, each member supporting the others. Isn't this a marvelous idea?

Leo's assertion in this article that the main reason you get such a virus is your failure to update regularly the virus definition file of your antivirus program used to be true but no longer at all (see "e" below.)

Newer versions of Antivirus XP 2008 do the following to your computer, among other things, and unfortunately all these keep us wondering about what people at Microsoft have been doing to increase our computer security.

Specifically the new Antivirus XP 2008 virus:

a) Would reboot my computer any time my real antivirus program tried to remove some members of its family pack (Joke.Blusod and Trojan.Blusod)

b) Had disabled the Windows "Safe Mode" so I could no longer use the "Safe Mode" to do any debugging!!

c) Had infected Windows core and critical files in a Windows subdirectory called "System32." (Aren't all these files supposed to be protected by Windows itself?!!! ) For example:

c1) "Wscript.exe" was a big culprit. Microsoft Windows protects and prevents deletion of this critical program by regenerating it immediately. I think few users, however, know how to monitor, stop, debug, or control any malicious "Host Script" the virus directs this program to carry out. I tried to copy and rename my Notepad.exe to Wscript.exe in the hope of preventing the malicious scripts getting carried out but could not do that -- A Windows wrong sense of self protecting critical files. Remember the Safe Mode was also rendered unavailable to me by the virus.

c2) Yet Windows did not properly protect another file called "SVCHOST.EXE" in this subdirectory and the virus had infected it!! I cannot overemphasize how important this file is in providing or not providing malicious services to your computer!!!

c3) The same was true for Windows Installer 3.1 (Not protected properly and infected).

d)Had disabled Microsoft's "System File Check" (SFC) program so it could not check on the validity and version of Windows critical files any more. For example, the command "SFC /SANNOW" would not work at all!

e) Had disabled my Symantec/Norton Internet Anti Virus and its LiveUpdate programs; so I could not update the virus definition files anymore.

f) Had disabled all my Internet communication lines with Microsoft!

g) Had inserted and opened several communication ports on the "Exceptions" tab of the Windows "Firewall" and was taking over my computer remotely. Isn't it peculiar that once these ports are opened, Windows does not provide you a way to delete them from the "Exceptions" list of your computer Firewall?

h) Had removed the icon of "Network Connection Notification" from my System Tray to hide away the fact that my computer was being remotely accessed.

i) Had turned off and deleted all my "Windows Restore Points" so I could not revert to an earlier Windows configuration before the virus had attacked.

j) Had Done all the damage through Internet Explorer 7, which is supposed to have excellent security features (Microsoft people think so!!)

The Symantec/Norton Antivirus representative acknowledged the difficulties with "Antivirus XP 2008" virus and said the only thing to do was for me to use their special program by paying them $99 so their specialist in India would connect to my computer live and peruse it to remove the virus. The sales pitch was accompanied by many scary things that how dangerous this virus was, how I might lose my entire data and programs permanently, and how I might still have the virus even after reformatting my hard disk and starting with a fresh install of Windows, if I did it myself.

The Microsoft Technical Support MVP (Most Valued Professional) gave me the link to a program called "The Spyware Doctor" to remove the virus. So I downloaded the Spyware Doctor and run it to test my computer. It reported yes, my computer was infected with Antivirus XP 2008 but I had to buy their registered version in order to remove it (Does this ring a bell? Yeah... the "Antivirus XP 2008" virus itself!!) - Did I mention when I run the Spy Doctor under my Norton Antivirus, it reported that Spyware Doctor was trying to install a Trojan Horse on my computer?)

I feel most disappointed with Microsoft because my computer has been constantly updated for security by "Automatic Updates" through them. If someone is able to create "Antivirus XP 2008" to completely take over my computer through simple means I have described above and despite years of Microsoft's Windows updates for security, Microsoft must take a closer look at its aptitude or intentions.

Another trend unfortunately fermenting is the proliferation of so many companies and websites claiming their Antivirus programs are the ultimate answer to our virus problems. They offer FREE TESTS and Web Site HOUSE CALLS only to scare us further into buying their products and if we did not, infecting our computers with their own brand of viruses. We badly need special standards for naming and categorizing viruses so a claim of one company can be verified by an antivirus program from another.

Warmest regards,
M. Malekzadeh

I read the articles and I had a simular problem but mine was antivirus 2009 and I didnt open it my virus protector didnt catch so I uninstalled it in control pannel as it was there and then it kept moving around and poping up in different files on my computer. Every time I deleted it it changed the name finally my spyeraser caught it and removed it. I know how you feel. Cant trust anything

The free Malwarebytes removes it. The download webpage mentions $24.00, but that is for the fulltime protection. Also, ComboFix at wwww.bleeping computers removes it too.

I use these two progs. to cleanup customer's computers. Before running Combofix there is a tutorial that should be read.

Packrat1947

Well let me tell you what this friggin virus did to me. First off I accidentally agreed to the contract. DOH! Not realizing what I had done immediately I went about my business around the house and I come back and there is a "scan" going on by this xp 2008 virus saying I have several hundred trojans, cookies, and viruses. It then prompts me to purchase their product... LOL... I didn't w00t But I did want to update my mcafee because I knew it was outdated... Well they wanted money too so I decided not to go that route either. So I let the virus sit there for about 24 hours, hooked up to the internet, not giving it a second thought. When I came back to the computer, I found something very strange. All restore points had been erased, My ability to defrag was gone, my ability to customize my desktop settings was gone, and there were about 9 corrupt files in my c:\ drive and registry files and system32 files. Then I noticed if I left the mouse alone for about 3 minutes the system reboot would occur claiming I had just recovered from a serious threat. And this would happen every 3 minutes, making the virus even worse.... So I said ok time to deal with this little booger... So I went to google, searched antivirus xp 2008 and came up with mr. leo's recommended site and I clicked on it... with no success, so I tried again and it wouldn't connect... So I tried another and all I would get is a no connection page, or a redirect to a spam site. So I tried 3 different browsers... aol, mozilla, and internet explorer... all the same results... so I disassembled my computer took it to a friend of mine and said fix it. We tried to defrag.. nothing, system restore points.. all gone, and I allow MAXIMUM space for restore points creating one every other day, and with every install and un-install. ALL GONE! So we tried something else, I grabbed my old xp boot discs and using nero I backed up all the files I needed from my computer and got ready for a re-format... That little booger (me thinks) would not let me... No matter what we tried, the system would not boot up to a new system... Finally I bring the computer home, after 8 days of this. I open up a browser thats been sitting on the shelf collecting dust for 3 years w/out update... MSN Explorer that came with xp... lmao It was unaffected by the browser re-directs and I was able to get to trend-micro housecall and quarantine most of the malicous software associated with this worm, and then I used malwarebytes to get the rest. And now I have AVG Security protecting my @$$ bye bye mcafee.

Dude... You DON'T need to reinstall your (old) browser because of the redirects! :)

Easy trick. Go to Google, lookup whatever it is you want. Click on the 'cached' link. Doesn't seem to be affected by the redirects. ;)

Leo, I came to your site to find out WHAT IS THE SOURCE of these infections?

Thanks Big Guy! :)

What is a virus which attacks or infects specific anti-virus software’s’ is known as?

MalwareBytes is a good choice, however, I've found that Spyware Doctor does a better job when removing malware. As for Antivirus XP 2008 there are many many manual removal guide on the net. For example:
Antivirus XP 2008 removal at bleepingcomputer.com
Antivirus XP 2008 removal at 2-spyware.com

To post a comment on "How can an infection like Antivirus XP 2008 happen?", please return to that article's main page.