Odd request about a virus

[Dav5049915]

I have an odd request.
recently some of the computers at my company have been getting the fun antivirus 2008/2009 virus on them. It's obviously caused by careless browsing, and i am already proficient at removing the problem.

my question is, we setup a test computer to try and infect with the virus so we could learn how to stop it before it infects the computer. no matter how many porn / hacking / torrent sites i went to, i couldn't get ONE hit with this virus.
how or where do i go to infect this computer with antivirus 2009?
our computers are currently protected with panda antivirus managed by our central server.
the only way i've been able to remove the threat is by running malwarebytes.
we've been playing with norton AV and a few other options.

if you know how or where to go to get infected, could you PM me the info? I don't want any direct links or anything posted in here (DUH).

lastly, i figured this was the best place to post b/c its security related.

thanks,
David

 

[XtremepH]

YHPM

 

[YeOldeStonecat]

As XPAntivirus fades....the trojans are using a new name now.....
Mimicking the Spybot Search and Destroy name...this malware goes under the name (currently) Search and Destroy 5.2
website is the name search and destroy (separated by hyphens) dot com

 

[Dav5049915]

search / destroy seems like the generic virus program / malware whatever you call it.

the best one i've seen so far is one that installs a screen saver that mimics a BSOD and then the XP booting process. it had me confused the first few times it happened. it also changes your background to look like there is a window saying that you are infected.

so far, i have search / destroy and winweb security virus scanner "installed" gonna throw on norton AV and see what it can kill

 

[YeOldeStonecat]

the best one i've seen so far is one that installs a screen saver that mimics a BSOD and then the XP booting process. it had me confused the first few times it happened. it also changes your background to look like there is a window saying that you are infected.

Yeah I recall one like that......the background with an infection warning..like it takes over your wallpaper with an activeX desktop.

Many of the new trojan variants are lumped under the "smitfraud" name, and/or Virtumondo (spelled several different ways). Another sub variant.."spyfalcon". From what I've read....they are all powered by the same trojan called "ZLob".

On one forum I frequent, where is a leading antivirus company programmer which helps develop the antivirus definitions...he said the writers of the ZLob trojan are releasing SEVERAL new variants PER DAY!

So whatever infection you pick up right now, under some name like XPAntivirus2009, in a few hours or the next day...if you pick up the same name...XPAntivirus2009...it may actually have different steps for proper renewal, different file names, and your programs that worked yesterday to clean it may not today.