I recently had the pleasure of disinfecting a computer that had so much malware on it that the machine could no longer function. In addition to a barrage of typical pop-up windows, one interesting program I noticed on the machine was something called MS Antivirus 2008. It peaked my interest because it looked like a Microsoft program, but I knew that Microsoft doesn’t make anything called MS Antivirus 2008.
MS Antivirus 2008 is a very nasty bit of malware that fools the user into thinking it is a Microsoft product designed to protect your computer from viruses. It’s screens look just like a Microsoft product and on the surface
it looks like a legitimate program. However, it is a fake virus scanner that gives you all kinds of false infection notices just to trick you into ‘activating’ the software, which means they want you to pay for it. After you buy the software, it will tell you that those viruses you never had to begin with have been removed. A variant of this program, called Vista Antivirus 2008, has also been spotted on the web. It’s the same piece of malware.
The primary means of infection for a program like this is through a web browser pop-up window disguised as a Windows system message. You typically find these types of pop-ups on unscrupulous sites filled with porn and other things. It concerned me that this was a work computer that had been infected, so I had to wonder what kind of stuff the user had been browsing on the web when the machine got infected.
What happens is you get a pop-up message telling you that your computer is infected with a virus or spyware. The message looks just like the kind of alert you might get in Windows, and it contains buttons asking
you about getting rid of the virus. By clicking on the buttons and following the misleading instructions on screen, what you’re actually doing is installing this malware on your system. These things are designed to trick unknowing users into installing the software out of the fear that they have a virus.