The brazenness of the criminals' claims are astounding: On a PC running a pristine, just-installed copy of Windows, Stewart said that Antivirus XP "found" and "disinfected" more then 300 non-existent threats.

But while affiliates can make serious amounts of money, Stewart speculated that Bakasoftware's operator might be making even more. And not by just taking his cut of the money coming in.

"We think that Bakasoftware might just serve as a way to launder money," Stewart said, adding that there's some evidence that stolen credit cards are used by at least one affiliate member to pay for downloaded and installed copies of Antivirus XP. Even though the bulk of those payments are denied by the credit card companies, enough get through to launder significant sums. "From what we can tell, it looks like [Bakasoftware] may be doing this themselves," said Stewart, "and hiding a smaller volume of fraudulent money in the larger volume of legitimate credit card payments users are making for the software."

The Bakasoftware operation continues, Stewart said. "I don't think they've noticed our investigation," he said. But stopping even one affiliate program, much less the scores that are active, is nearly impossible.

"The best way to make money as a criminal is to set up an affiliate program of some kind, then get someone else to do the dirty work," said Stewart. "They don't even need to work hard at it" to make plenty of money.