XP Anti-Spyware

By Domesticus in Rogue Anti-Spyware Program

XP Anti-Spyware Image

XP Anti-Spyware is not what XP Anti-Spyware claims to be. Proceed with caution where this fake security program is concerned, because XP Anti-Spyware is malicious and fraudulent. If XP Anti-Spyware offers absolutely no functionality or benefit for your PC, then why pay for a XP Anti-Spyware license?

XP Anti-Spyware makes a lot of changes to the computers XP Anti-Spyware infects, so the symptoms of an infection will be impossible to ignore. XP Anti-Spyware will render your computer almost completely useless, while trying to convince you that XP Anti-Spyware is only interfering because your computer is infected with countless viruses. Basically, XP Anti-Spyware uses scare tactics to try to get you to fork over your credit card number, and XP Anti-Spyware also will try to prevent you from doing anything to disable or remove the malware.

Symptoms Caused by XP Anti-Spyware

The first thing you'll notice is that every time you start Windows, XP Anti-Spyware loads a fake user interface, where XP Anti-Spyware pretends to run a scan of the system. The interface will use a modified version of the Windows Security Center shield logo, as well as some other, more generic Windows icons, in order to attempt to make you rest assured that XP Anti-Spyware is some kind of Windows component. The scans that XP Anti-Spyware pretends to run from this interface will always turn up lengthy, fake lists of virus results, claiming that nonexistent files are infected with made-up viruses. Then, of course, XP Anti-Spyware will tell you that your only hope is to activate XP Anti-Spyware, by paying for a license. Needless to say, because XP Anti-Spyware is part of a scam, there are no real licenses to be had.

In order to see the desktop at all, you will have to wait through the scan animation and the whole show put on by the XP Anti-Spyware interface. Then, XP Anti-Spyware will continue to try to scare you, and XP Anti-Spyware will severely limit what you can do with your computer. You will see frequent pop-up alerts, typically appearing from the task bar or system tray, which begin with the phrases, "System hijack," "Stealth intrusion," and "System danger." These alerts will make very vague claims about malware detected on your computer, and they will often say that your personal information is at risk or is being stolen. (Note that any real anti-virus software would tell you what specific threat it had found, and where and when the threat was detected. XP Anti-Spyware's error messages don't include any of this information.) The alerts are always recommending to protect your computer, or to scan it, or to "activate" XP Anti-Spyware. Regardless of the wording of each different alert, the ultimate goal of all of them is the same. They are trying to get you to go to the payment site for XP Anti-Spyware, so that you will hand your credit card information over to the crooks who created the malware.

In order to prevent you from removing it, XP Anti-Spyware makes several important changes to your computer's settings, which can severely limit your ability to do anything with your own PC. XP Anti-Spyware uses a relatively large number of files compared to most other rogue security programs, and XP Anti-Spyware makes a large number of changes to the Windows registry. So, you will find that with XP Anti-Spyware infecting your PC your normal anti-virus software is disabled, as well as the Windows firewall. You will be unable to open other programs, including Task Manager, and you may not notice the Control Panel or system folders. XP Anti-Spyware will make changes to your Internet settings, specifically targeting Internet Explorer and Firefox for hijacking, so that when you try to go online, the only site you can view is the one that claims to sell XP Anti-Spyware. Essentially, XP Anti-Spyware will give itself root (administrative-level) access to your PC, and redefine your user settings and permissions by referring to XP Anti-Spyware's own files. Technically, however, XP Anti-Spyware can't really be called a rootkit, because XP Anti-Spyware does not prevent you from seeing XP Anti-Spyware or knowing where XP Anti-Spyware's files are.

Where Does XP Anti-Spyware Come From?

If you don't remember installing XP Anti-Spyware, you're not alone. XP Anti-Spyware relies on Trojans in order to get itself downloaded without users' knowledge. The Trojan may be hidden in a fake video codec or program update, in freeware, or a file downloaded from a peer-to-peer service. After the Trojan has downloaded, it will check your computer to see which version of Windows you are using, and XP Anti-Spyware will install itself and XP Anti-Spyware's files under a name that matches. So, XP Anti-Spyware is one of the names that this threat uses when it installs itself on computers running XP. There are many other names that this threat can use when it installs itself on an XP system, and other names that correspond to other versions of Windows. Therefore, you will only ever find XP Anti-Spyware on machines running XP, but XP Anti-Spyware is literally the same malware as all of the other names taken by this rogue security application, including XP Security 2011, Vista Antivirus 2011, etc. XP Anti-Spyware (and the same malware under its other names) has been causing infections since December 2010.

File System Details

XP Anti-Spyware may create the following file(s):
# File Name Detections
1. %UserProfile%\AppData\Local\pw.exe
2. %UserProfile%\Local Settings\Application Data\MSASCui.exe
3. %UserProfile%\Local Settings\Application Data\pw.exe
4. %UserProfile%\AppData\Local\MSASCui.exe
5. %UserProfile%\AppData\Local\opRSK
6. %UserProfile%\Local Settings\Application Data\opRSK

Registry Details

XP Anti-Spyware may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Classes\pezfile\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "%1" %*
HKEY_CLASSES_ROOT\pezfile\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "%1" %*
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode
HKEY_CURRENT_USER\Software\Classes\pezfile
HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "%1" %*
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "AntiVirusOverride" = "1"
HKEY_CLASSES_ROOT\pezfile
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "%1" %*
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "C:\Program Files\Internet Explorer\iexplore.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirewallOverride" = "1"

Trending

Most Viewed

Loading...