Early last week the FTC took aim at Antivirus XP and the people behind it. This kind of scareware is a well known scam. My colleague Joe Stewart had previously investigated a similar scam, run by the Russian Baka software group. From the court filings, the group the FTC is pursuing is run by American and Canadian citizens. The FTC sought and was granted a temporary restraining order (TRO) that requires the entities and people behind Antivirus XP to stop claiming they are performing AV scanning, concealing their identities (including to cease use of any domains registered using false information), and to not spend, hide or transfer any of their ill-gotten gains.
The TRO also extends to the defendants' web hosting providers and banks. They are respectively ordered to take down and preserve web properties and to freeze assets owned by the defendants.
These scareware products have been marketed under a wide variety of names, those listed in the FTC's complaint include: WinFixer, WinAntivirus, DriveCleaner, WinAntispyware, ErrorProtector, ErrorSafe, SystemDoctor, AdvancedCleaner, Antivirus XP, and XP Antivirus 2008. These are remarkably similar to the names used by the Baka software group that Joe reported on: Easy Spyware Cleaner, SpyRid, InfeStop, WinIFixer, Advanced XP Defender, Advanced XP Fixer, Malware Protector 2008, Antivirus XP 2008. We do not believe these groups are related, but rather that this is another example of successful tactics being copied by other malicious actors.
These scareware products have defrauded millions of dollars from consumers and left them vulnerable to other malware. It's great to see the FTC take action against them. The order also requires the defendants to supply the FTC with business records, including affiliate data.
Hopefully the FTC will also be able to go after the affiliates as well. As we previously disclosed, affiliates can earn big money from this kind of scam. A hacker known as NeoN, broke into the Baka software affiliate website and found that some affiliates were earning in excess of a hundred thousand dollars a week installing Antivirus scareware.
The hearing for this issue is scheduled for this (Friday, December 12, 2008) afternoon. The defendants are ordered to appear, but personally I don't have terribly much confidence they will be there. The complaint, restraining order, and press release can be found at the FTC's website. Even if not, I'd like to see the FTC follow the paper trail and seize assets. Good job FTC, and good luck chasing the money trail.