Update on XP AntiSpyware /XP AntiVirus Scam
The WinSoftware, Inc aka LocusSoftware Inc aka Innovative Marketing is behind this scam has updated their fake scan script and layout.
As mentioned in the earlier the group indeed is quick to changing their active scam site to trick more users into purchasing their rogue security application.
The new scam site used by the group:
Site Name: XPAntivirussecurity.com
IP Address: 89.149.197.240
As mentioned in the earlier the group indeed is quick to changing their active scam site to trick more users into purchasing their rogue security application.
The new scam site used by the group:
Site Name: XPAntivirussecurity.com
IP Address: 89.149.197.240
Screenshot of the new fake/scare scan pages
Screenshot of the new fake/scare scan pages
The site pushes “XPantivirus2008_v77002803.exe” file and detection of this file is really poor.
VirusTotal Scan Result: 1/32 (3.12%)
F-Prot 4.4.2.54 2008.03.30 W32/Downloader.F.gen!Eldorado
Other sites used by this group:
Antispycompani.com
Xp-protect-2008.com
Both these sites share the same IP address 67.228.137.29
Stay away from these sites.
Bharath M N
VirusTotal Scan Result: 1/32 (3.12%)
F-Prot 4.4.2.54 2008.03.30 W32/Downloader.F.gen!Eldorado
Other sites used by this group:
Antispycompani.com
Xp-protect-2008.com
Both these sites share the same IP address 67.228.137.29
Stay away from these sites.
Bharath M N
