The crooks also have a tenuous deniability, said Stewart, since his analysis of Antivirus XP showed that it did, in fact, detect a very small number of threats. "They have some plausible deniability," he argued. "They could just say they didn't know that the program sucked so badly."
Useless security programs like Antivirus XP rely on their near-constant blizzard of pop-up warnings -- all faked -- to irritate or worry users enough to pay for the software. Only after paying for the program, then registering it, do the pop-ups stop.
The brazenness of the criminals' claims are astounding: On a PC running a pristine, just-installed copy of Windows, Stewart said that Antivirus XP "found" and "disinfected" more then 300 non-existent threats.
But while affiliates can make serious amounts of money, Stewart speculated that Bakasoftware's operator might be making even more. And not by just taking his cut of the money coming in.
"We think that Bakasoftware might just serve as a way to launder money," Stewart said, adding that there's some evidence that stolen credit cards are used by at least one affiliate member to pay for downloaded and installed copies of Antivirus XP. Even though the bulk of those payments are denied by the credit card companies, enough get through to launder significant sums. "From what we can tell, it looks like [Bakasoftware] may be doing this themselves," said Stewart, "and hiding a smaller volume of fraudulent money in the larger volume of legitimate credit card payments users are making for the software."
The Bakasoftware operation continues, Stewart said. "I don't think they've noticed our investigation," he said. But stopping even one affiliate program, much less the scores that are active, is nearly impossible.
"The best way to make money as a criminal is to set up an affiliate program of some kind, then get someone else to do the dirty work," said Stewart. "They don't even need to work hard at it" to make plenty of money.