If anyone still wasn't convinced whether or not to install the program he or she could visit the program's
Web site which looked very professional
as you can see in the slide web site provided information about previous versions of the program and
new viruses it managed to discover when the program was installed.
It was only the beginning of the troubles
up to this moment.
The attackers managed to convince the victim to install the program on his or her computer.
The program uninstalled the victim's anti-virus software this alone was already a success for the attackers.
But in this situation they were after money.
The goal of the second phase of the attack was to convince the user to register the program.
It's harder to convince the user to do that than to convince him or her to merely install the software.
We are all still easily tricked into opening every program downloaded from the internet.
If you don't have to register it or pay for it it won't be a problem.
This is of course wrong but such an attitude persists.
So it took some effort to make the user pay for the program and alien program installed on a user's
computer can basically allow the attacker to remotely control its operating system.
XP in a virus was programmed to start on system startup and to always find lots of viruses
through an Internet Explorer plug in the program monitored the user's Internet activities on random
web sites XP and a virus regularly warns users that someone may be checking their data.
Clicking on a green button that promised solving the problem redirected the user to the program's registration
website.
There is a screensaver that imitates the windows blue screen error.
It's also called Stop Error.
It was created by Mark Russinovich who's a security expert at Microsoft
security companies that examined XP antivirus have found recent of a surname because the program used
his screensaver.
If you left your computer on for a while you would return to find an error screen.
In reality it was the screensaver but it gave the impression that the computer was infected by viruses
to hide the fact that it was only a screensaver.
The program hid the screen saver card from the control panel and from the display settings.
Moreover the program constantly displayed warnings telling the user that the computer was still at risk.
These warnings were also displayed on the system taskbar
in the slide above.
You can see two versions of Windows XP security center the one on the left is real.
The one on the right is fabricated by XP antivirus the program created short cuts to the fix security
center in the control panel and the start menu the most visible difference between the windows is that
there is only one button on the bar instead of three looking closer we can see that the main difference
concerns the section.
Virus protection.
The picture on the left shows that the system can't find any virus protection software.
The one on the right displays a message that Windows has detected an unregistered version of XP antivirus
and it recommends to register it a system message seems trustworthy.
Clicking the recommendations Button took the user to the XP antivirus registration website.
Many people went to that site because they couldn't use their computers anymore.
Messages generated by the program were very intrusive my friends often called me to help them with those
windows that would constantly pop up take up half the screen and couldn't be closed.
Many people paid just to get rid of the problem.
This is one of the manipulation techniques we've discussed.
The registration fee was set at only about $40.
Please note that the registration website didn't use a secure connection.
You can see only the age TTP protocol in the header field even back in those days.
Very few web sites used unsecured connections when requesting a credit card number to obtain a certificate
needed for secure connections.
The creators of XP and a virus would have had to disclose their true identities.
This was something they wanted to avoid
after the registration process.
It turned out that $39 wasn't the only fee that needed to be paid.
Additional payments ranged from 80 to $400 at least a few people paid $39 and the money went to bank
accounts in Eastern Europe.
There were more programs such as Expedia and a virus at that time because of the wide scale success
of the program.
Few other firms decided to seize the opportunity and created their own versions.
You can see another such program on the slide.
It's called anti-spyware master XP and or virus was being regularly developed for the next six months.
No one knows how much profit it brought to its creators.
It certainly was much more profitable than creating databases or such software.
Thank you for your attention.