Antivirus XP Pro 2009

Antivirus XP Pro 2009 is a fake security software (rogue). It displays fake alerts and detects fake infections on the system. AntivirusXPPro2009 is from the same family as Renus 2008

A real malware modifies the desktop (desktop hijack) and promote the rogue with popups.



Looking into the code, we can see that just after being registered, the rogue removes the malware and its restriction that prevent users to restore the original desktop background. Then it displays the "Register Success" Message box.

Desktop Hijack

This kind of Desktop Hijack is used to scare users. The evil code installs restrictions to prevent infected users to restore the original background picture.



The message in the taskbar is from the malware and leads to Antivirus XP Pro 2009 fake security software (rogue) website.

One of the Hijack symptom is the presence of this start key:
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe

WinPC Antivirus

WinPC Antivirus is a Fake Security application. It replaces WinPC Defender.

These rogues are from the same creators of XP Police Antivirus, IE-Security, WinDefender 2009 and Total Secure 2009.



Once registered, all the fake malwares detected are now missing. And it looks like designers forgot to remove a part of the GUI Skin.
(Click on the Help & Support button redirects to win-pc-defender Website).



Thanks to Bharath
WinPC Antivirus on MAD Blog
Bleepingcomputer Removal guide

Ultra Antivir 2009

Ultra Antivir 2009 (UltraAntivir2009) is a new rogue. It belongs to the same family as Virusdoctor, VirusMelt, VirusAlarm. The GUI is always the same, only the title name is changing.



Fake online scanners are redirecting to a new (and less expensive) way of hosting malware: Google Code.

trdatasft.com (64.86.17.9)
vmfastscanner.com (64.86.17.9)
tdncgo2009.com (64.86.133.91)
websecscan.com (64.86.133.91)
mysupervisorpop.co.cc (64.86.16.210)
onlinesecurescan.com (64.86.16.210)
vm-onlinescan.net (206.53.61.69)
virusalarm-scanvirus.net (206.53.61.76)
onlinescan-ultraantivirus2009.com (206.53.61.76)





Ultra Antivir 2009 removal instructions

Thanks to Bharath's.

Antivirus Agent Pro

The Rogue, Antivirus Agent Pro, detects infection on a clean system. It creates random junk files (not executable) and triggers them as infected.



Thanks to Miekiemoes.

Total Security

Total Security is a fake security application. It belongs to Antivirus 360 rogues family (same GUI).





It downloads files from:
platinumsecurityupdate.com (212.117.165.126)
antispywareupdateservice.com (89.149.217.205)

212.117.165.126 is a shared IP with Antivirus 2009 website and installer:
webscannertools.com (212.117.165.126)
central-scan.com (212.117.165.126)

BleepingComputer Removal Guide.
Bharath's Security Blog

Renus2008

Renus 2008 is a Fake Security application.



Renus 2008 always detects the same infections files as items strings are hardcoded in the application:



Thanks to Bharath (on Sunbelt Blog).
BleepingComputer Virus-Removal.

WinPC Defender

WinPC Defender is a Fake Security application (from the same creators of XP Police Antivirus, IE-Security, WinDefender 2009 and Total Secure 2009).



Let's see how the rogue detects infection when registered (no reboot, no cleaning):



Nothing more. All detected infections (1st capture) have disappeared !

win-pc-defender.com (206.125.44.28)
xp-police-09.com (206.125.44.28)
xp-police-2009.com (206.125.44.28)
xp-police-antivirus.com (206.125.44.28)
xp-police-av.com (206.125.44.28)
xp-police-engine.com (206.125.44.28)
xp-police.com (206.125.44.28)

XP-Police MAD, XP-Police/IEDef symptoms MAD.
BleepingComputer Removal Guide.

RegistryFox Rogue

RegistryFox is a Fake Security application from AntiSpyware LLC. The same company that use to create SmitfraudFixTool rogue (from the original and legit application SmitfraudFix), MalwareRemovalBot Rogue, and many other fake stuff.



The two rogue websites are hosted on the same server:
malwareremovalbot.com (74.53.169.2)
registryfox.com (74.53.169.2)

The application is contacting database.registrysmart.com (75.125.200.226) to update the "heavy" data base: 7Kb. IP shared with other rogues softwares:
adwarealert.com (75.125.200.226)
evidenceeraser.com (75.125.200.226)
registrysmart.com (75.125.200.226)
restore-pc.com (75.125.200.226)

In the code, there is a reference to file (DataBase.ref) downloaded from 2squared.com (75.125.61.162):
antispywarebot.com (75.125.61.162)
errorsweeper.com (75.125.61.162)
privacycontrol.com (75.125.61.162)
regclean.com (75.125.61.162)

There is also a link to Antispyware 2009 Rogue setup:
antispyware.com (75.125.241.58)
adwarebot.com (75.125.241.58)
antispyware2009.com (75.125.241.58)
errorsmart.com (75.125.241.58)
regsweep.com (75.125.241.58)

Thanks to NoVirusThanks

WinCoDecPRO Fake Codec

WinCoDecPRO is a Rogue like fake software.
While Rogues detect fake infections on a clean system and display alerts message, WinCoDecPRO displays fake codec error, redirecting infected user to WinCoDecPRO web site.

When Trying to run Windows Media Player, the malware closes it and displays a messagebox, choosing the text in a hardcoded list:



It also display regularly popups alerts:









The modified wallpaper: