Green AVĀ is a variant of Win32/FakeXPAĀ - a family of programs that claims to scan for malware and displays fake warnings of āmalicious programs and virusesā. They then inform the user that they need to pay money to register the software in order to remove these non-existent threats. Some members of the Win32/FakeXPA family may also download additional malware and have been observed in the wild downloading variants of
Win32/Alureon.
Ā
Win32/FakeXPAĀ has been distributed with many different names. The name used by the malware, the user interface andĀ other details vary to reflect each variantās individual branding. The following details describe Win32/FakeXPA when it is distributed with the name Green AV.
Installation
The Green AV installer writes a number of files to the %AllUsersAppData%\gav directory. Some drop the files directly, while others download them from a location such as green-av.com, green-av-pro.com, or my-green-av.com. The installed files may include:
Ā
This is the fake scanner itself. In addition to the scanner window, it displays an icon in the system tray (and pop-up messages from that icon), pop-up alerts warning of "infections", "database update" dialogs and a window that imitates the Windows Security Center.
Ā
See below for examples of these:
Ā
Ā
Ā
Ā
Ā
Ā
The links displayed in this Window all redirect to a purchase page at a location such as green-av.com.
The installer may attempt to disable warnings from the real Windows Security Center with the following registry modification:
Ā
Key: HKLM\SOFTWARE\Microsoft\Security Center
Adds value: "AntiVirusDisableNotify"
Data: 1
Ā
This is installed as a BHO in order to display fake "drop-down" messages within Internet Explorer. Clicking on the message directs IE to a web page that allows the user to purchase "Antivirus 2010". Please see below for an example:
Ā
When registering QWProtect.dll as a BHO, registry entries such as the following may be created:
Key: HKCR\AppID\{29256442-2C14-48CA-B756-3EE0F8BDC774}
Value: (Default)
Data: QWProtect
Ā
Key: HKCR\AppID\QWProtect.DLL\
Value: AppIDĀ
Data: {29256442-2C14-48CA-B756-3EE0F8BDC774}
Ā
Key: HKCR\QWProtect.QWProtectBHO.1
Value: (Default)Ā
Data: QWProtectBHO Class
Ā
Key: HKCR\QWProtect.QWProtectBHO.1\CLSID
Value: (Default)Ā
Data: {70FEAD04-A7FD-4B89-B814-8A8251C90EF7}
Ā
Key: HKCR\QWProtect.QWProtectBHO
Value: (Default)Ā
Data: QWProtectBHO Class
Ā
Key: HKCR\QWProtect.QWProtectBHO\CLSID
Value: (Default)Ā
Data: {70FEAD04-A7FD-4B89-B814-8A8251C90EF7}
Ā
Key: HKCR\QWProtect.QWProtectBHO\CurVer
Value: (Default)Ā
Data: QWProtect.QWProtectBHO.1
Ā
Key: HKCR\CLSID\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}
Value: (Default)Ā
Data: QWProtectBHO Class
Ā
Key: HKCR\CLSID\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}\ProgID
Value: (Default)Ā
Data: QWProtect.QWProtectBHO.1
Ā
Key: HKCR\CLSID\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}\VersionIndependentProgID
Value: (Default)Ā
Data: QWProtect.QWProtectBHO
Ā
Key: HKCR\CLSID\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}\InprocServer32
Value: (Default)Ā
Data: %AllUsersAppData%\gav\QWProtect.dll
Ā
Key: HKCR\CLSID\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}\InprocServer32
Value: ThreadingModelĀ
Data: Apartment
Ā
Key: HKCR\CLSID\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}\TypeLib
Value: (Default)Ā
Data: {512E801E-2F02-4ADE-ACAA-58F08A22B2F8}
Ā
Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}
Value: (Default)Ā
Data: QWProtectBHO
Ā
Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}
Value: NoExplorer
Data: 1
Ā
Key: HKCR\TypeLib\{512E801E-2F02-4ADE-ACAA-58F08A22B2F8}\1.0
Value: (Default)
Data: QWProtect 1.0 Type Library
Ā
Key: \TypeLib\{512E801E-2F02-4ADE-ACAA-58F08A22B2F8}\1.0\FLAGS
Value: (Default)Ā
Data: 0
Ā
Key: HKCR\TypeLib\{512E801E-2F02-4ADE-ACAA-58F08A22B2F8}\1.0\0\win32
Value: (Default)Ā
Data: %AllUsersAppData%\gav\QWProtect.dll
Ā
Key: HKCR\TypeLib\{512E801E-2F02-4ADE-ACAA-58F08A22B2F8}\1.0\HELPDIR
Value: (Default)
Data: %AllUsersAppData%\gav
Ā
Key: HKCR\Interface\{051C9A06-FB08-486F-B09B-8B33B261637D}
Value: (Default)Ā
Data: IQWProtectBHO
Ā
Key: HKCR\Interface\{051C9A06-FB08-486F-B09B-8B33B261637D}\ProxyStubClsid
Value: (Default)Ā
Data: {00020424-0000-0000-C000-000000000046}
Ā
Key: HKCR\Interface\{051C9A06-FB08-486F-B09B-8B33B261637D}\ProxyStubClsid32
Value: (Default)
Data: {00020424-0000-0000-C000-000000000046}
Ā
Key: HKCR\Interface\{051C9A06-FB08-486F-B09B-8B33B261637D}\TypeLib
Value: (Default)Ā
Data: {512E801E-2F02-4ADE-ACAA-58F08A22B2F8}
Ā
Key: HKCR\Interface\{051C9A06-FB08-486F-B09B-8B33B261637D}\TypeLib
Value: Version
Data: 1.0
ā¢Ā svchost.exe
This program displays a fake "blue screen" crash screen, followed by a fake restart screen.
The file may be extracted from another file named wsdt05.exe or wsdt.exe. The installer also creates the following shortcut on the desktop:
C:\Documents and Settings\All Users\Desktop\Green AV.lnk
Ā
and a folder containing a start menu item:
C:\Documents and Settings\All Users\Start Menu\Programs\Green AV\ GreenAV.lnk
PayloadĀ
DisplaysĀ false/misleading malware alerts
WhenĀ run, theĀ malware performsĀ a fakeĀ scan ofĀ the system,Ā and falselyĀ claims thatĀ a numberĀ of filesĀ on theĀ system areĀ infected withĀ malware. ShouldĀ users requestĀ that itĀ clean theĀ reported infections,Ā it advisesĀ them thatĀ they needĀ to payĀ money toĀ register theĀ program inĀ order forĀ it toĀ do so.Ā This process is described in detail in the Installation section displayed above.
Ā
Terminates Processes
Some variants install a batch file with a name such as wer.bat. This attempts to terminate the Windows Defender process MSASCui.exe. The installer may also create a registry entry such as the following to ensure that the batch file is run upon system startup:
Under key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Adds value: <digits> (eg ā67569387646557683ā)
With data: ā%AllUsersAppData%\gav\wer.batā
Ā
Ā
Other variantsā installers attempt to terminate processes from products such as Windows Defender, McAfee and Eset. These processes include the following:
Ā
MSASCui.exe
mcregist.exe
wmiprvse.exe
mcsysmon.exe
Mcshield.exe
McNASvc.exe
MpfSrv.exe
McSACore.exe
mcagent.exe
msksrver.exe
MpfSrv.exe
mcmscsvc.exe
McProxy.exe
nod32krn.exe
Ā
Note: Some variants also terminate iexplore.exe and firefox.exe during installation to ensure that the BHO is loaded when the browser is restarted.
Modifies Hosts File
The installer for some variants modifies the hosts file to redirect attempts to visit domains used by various PC review sites to a location such as 208.43.47.212. The localĀ Hosts file overrides the DNS resolution of a Web site URL to a particular IP address. This may be an attempt to convince the user that the fake scanner has received positive reviews. One variant was observed to redirect the following domains:
Ā
a1.review.zdnet.com
reviews.riverstreams.co.uk
d1.reviews.cnet.com
review.2009softwarereviews.com
reviews.download.com
reviews.pcadvisor.co.uk
reviews.pcmag.com
reviews.pcpro.co.uk
reviews.techradar.com
toptenreviews.com
www.reevoo.com
Ā
Analysis by Hamish O'Dea