Initially when I saw all the many names of what I still call XP AntiVirus2008 I thought that every time it was blocked by all the major protection companies the makers just tweaked it a little, changed the name, and sent it back into the world winding its way back to popularity.  I no longer think this is the case.  It seems as though this is an intelligent self-updating program.  I believe the makers place a patch in some location that the program checks periodically and the copies of the virus still in circulation update themselves to survive another day.   These copies could still be in circulation because the operators of the computers where they have installed themselves have not updated their virus protection or have no protection at all.  The program not only patches its vulnerability to the protection programs it also seems to change appearance and name to appear different to the end user.  From what I have heard these creators of turmoil are making tons of cash for the people who believe their program has magically appeared on their system to help them and they pay $50 to register for the full protection.

So spread the word when you see a new name for these doom laced supposed helpers.  Maybe when the money train slows to a crawl these people will leave us alone.  Oh, and Happy Birthday AV2008!

Here are some links:
http://www.symantec.com/security_response/writeup.jsp?docid=2008-050906-3727-99
http://en.wikipedia.org/wiki/Antivirus_2009

Categories: Virus Removal ~ ~ Trackback