Ultra Antivir 2009

Ultra Antivir 2009 (UltraAntivir2009) is a new rogue. It belongs to the same family as Virusdoctor, VirusMelt, VirusAlarm. The GUI is always the same, only the title name is changing.



Fake online scanners are redirecting to a new (and less expensive) way of hosting malware: Google Code.

trdatasft.com (64.86.17.9)
vmfastscanner.com (64.86.17.9)
tdncgo2009.com (64.86.133.91)
websecscan.com (64.86.133.91)
mysupervisorpop.co.cc (64.86.16.210)
onlinesecurescan.com (64.86.16.210)
vm-onlinescan.net (206.53.61.69)
virusalarm-scanvirus.net (206.53.61.76)
onlinescan-ultraantivirus2009.com (206.53.61.76)





Ultra Antivir 2009 removal instructions

Thanks to Bharath's.

Antivirus Agent Pro

The Rogue, Antivirus Agent Pro, detects infection on a clean system. It creates random junk files (not executable) and triggers them as infected.



Thanks to Miekiemoes.

Total Security

Total Security is a fake security application. It belongs to Antivirus 360 rogues family (same GUI).





It downloads files from:
platinumsecurityupdate.com (212.117.165.126)
antispywareupdateservice.com (89.149.217.205)

212.117.165.126 is a shared IP with Antivirus 2009 website and installer:
webscannertools.com (212.117.165.126)
central-scan.com (212.117.165.126)

BleepingComputer Removal Guide.
Bharath's Security Blog

Renus2008

Renus 2008 is a Fake Security application.



Renus 2008 always detects the same infections files as items strings are hardcoded in the application:



Thanks to Bharath (on Sunbelt Blog).
BleepingComputer Virus-Removal.

WinPC Defender

WinPC Defender is a Fake Security application (from the same creators of XP Police Antivirus, IE-Security, WinDefender 2009 and Total Secure 2009).



Let's see how the rogue detects infection when registered (no reboot, no cleaning):



Nothing more. All detected infections (1st capture) have disappeared !

win-pc-defender.com (206.125.44.28)
xp-police-09.com (206.125.44.28)
xp-police-2009.com (206.125.44.28)
xp-police-antivirus.com (206.125.44.28)
xp-police-av.com (206.125.44.28)
xp-police-engine.com (206.125.44.28)
xp-police.com (206.125.44.28)

XP-Police MAD, XP-Police/IEDef symptoms MAD.
BleepingComputer Removal Guide.

RegistryFox Rogue

RegistryFox is a Fake Security application from AntiSpyware LLC. The same company that use to create SmitfraudFixTool rogue (from the original and legit application SmitfraudFix), MalwareRemovalBot Rogue, and many other fake stuff.



The two rogue websites are hosted on the same server:
malwareremovalbot.com (74.53.169.2)
registryfox.com (74.53.169.2)

The application is contacting database.registrysmart.com (75.125.200.226) to update the "heavy" data base: 7Kb. IP shared with other rogues softwares:
adwarealert.com (75.125.200.226)
evidenceeraser.com (75.125.200.226)
registrysmart.com (75.125.200.226)
restore-pc.com (75.125.200.226)

In the code, there is a reference to file (DataBase.ref) downloaded from 2squared.com (75.125.61.162):
antispywarebot.com (75.125.61.162)
errorsweeper.com (75.125.61.162)
privacycontrol.com (75.125.61.162)
regclean.com (75.125.61.162)

There is also a link to Antispyware 2009 Rogue setup:
antispyware.com (75.125.241.58)
adwarebot.com (75.125.241.58)
antispyware2009.com (75.125.241.58)
errorsmart.com (75.125.241.58)
regsweep.com (75.125.241.58)

Thanks to NoVirusThanks

WinCoDecPRO Fake Codec

WinCoDecPRO is a Rogue like fake software.
While Rogues detect fake infections on a clean system and display alerts message, WinCoDecPRO displays fake codec error, redirecting infected user to WinCoDecPRO web site.

When Trying to run Windows Media Player, the malware closes it and displays a messagebox, choosing the text in a hardcoded list:



It also display regularly popups alerts:









The modified wallpaper:

IEDef family

IEDef family Codec has been update, it installs a file with semi-random filename composed from a dictionary:
e, g, y, j, f, g, win, sys

Possible filenames:
eyfwin.dll, eyfsys.dll, eygwin.dll, eygsys.dll, ejfwin.dll, ejfsys.dll, ejgwin.dll, ejgsys.dll, gyfwin.dll, gyfsys.dll, gygwin.dll, gygsys.dll, gjfwin.dll, gjfsys.dll, gjgwin.dll, gjgsys.dll

It displays alert messages with popups that download WinDefender 2009 or IE-Security:


and alerts messages that redirect to fake online scanner.


It also modifies Google result, and drops Internet Shortcut on the desktop, Favorites, Start Menu: Cheap Pharmacy Online.url, Cheap Software.url, MP3 Download.url, Search Online.url, SMS Trap.url and VIP Casino.url

Use SmitfraudFix to remove the infection.

Total Virus Protection

Total Virus Protection (TotalVirusProtection) is a new rogue (fake security software). It belongs to the same family as Anti-Virus Number-1, Antivirus Sentry, Antivirus 2010, Micro Antivirus 2009, MS Antivirus, Smart Antivirus 2009, System Antivirus 2008, Antivirus 2009, Internet-antivirus



This rogue detects infections on a clean system. It displays alerts and messages to sell a license to remove those fake infections.

Anti-Virus Number-1

Antivirus-1 is a new rogue (fake security software). It belongs to the same family as Total Virus Protection, Antivirus Sentry, Antivirus 2010, Micro Antivirus 2009, MS Antivirus, Smart Antivirus 2009, System Antivirus 2008, Antivirus 2009, Internet-antivirus