Written by Peter Reginald | 18 March 2010
Posted in Security

XP Antimalware is a rogue (or fake) antispyware program that performs a computer scan and reports that your computer is infected. These security alerts and reports of infections are false. After running a security scan you will receive a pop up message that your computer is infected and that you must purchase the full version of XP Antimalware in order to rid your computer of the detected infections.

How did XP Antimalware get in my PC?

The two common methods of installing XP Antimalware is by opening an attachment in an email or opening a downloaded file using p2p networks like limewire or torrent.

In our workshop tests we downloaded a zip file attachment from the scam email with the subject Facebook Password Reset Confirmation! Support Message. . The zip file contained a file which looks like a Microsoft Word (version 2007) document named "Facebook_password_245.exe". This file is actually a trojan and once opened, the trojan downloaded and installed XP Antimalware on our computer automatically. Next, the Microsoft Word document icon disappears and after a few seconds we started to receive pop up security messages.
This file contains the trojan. The trojan downloads and installs XP Antimalware on your computer automatically.

During installation, XP Antimalware will turn off your Windows firewall, configure the Windows registry to run automatically every time when you start an application (files with “exe” extension). The rogue also uses this method of running to block the ability to run any programs, including your legitimate virus and spyware application.

How to remove XP Antimalware

There are a number of websites that provide a guide to remove XP Antimalware yourself but it is important that you know what you are doing as you risk losing your valuable photos, music and files.

---