{"id":4277,"date":"2011-04-25T09:00:31","date_gmt":"2011-04-25T16:00:31","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=4277"},"modified":"2018-01-30T12:37:24","modified_gmt":"2018-01-30T19:37:24","slug":"rotw-total-security-and-antivirus-is","status":"publish","type":"post","link":"https://www.webroot.com/blog/2011\/04\/25\/rotw-total-security-and-antivirus-is\/","title":{"rendered":"ROTW: “Total Security” and Antivirus IS"},"content":{"rendered":"

By Brenden Vaughan and Andrew Brandt<\/strong><\/p>\n

\"\"\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"\"<\/p>\n

\"\"<\/a>This week, our support and advanced malware removal (AMR) team did not have a lot of new data to report about rogue security products. The most commonly encountered infection continues to be one of the rogues we reported about last week<\/a>.<\/p>\n

While we may refer to it as XP Total Security<\/strong>, it actually chooses one of a series of names at random, based on the operating system on the victim’s computer. Last week’s post contains a more comprehensive list of these names. As previously reported, you can remove the rogue by scanning (with our<\/em> product, not theirs) while the computer is in Safe Mode.<\/p>\n

Its main executable has a random, three-character filename, and gets installed into a random, three-character folder inside the Application Data folder for the user who is currently logged on at the time of the infection. The rogue’s install location is:<\/p>\n

 %UserProfile%Local SettingsApplication Data<random><random>.exe<\/pre>\n
AMR reported seeing another rogue called Antivirus IS<\/strong>. While this is the first time they have mentioned it, Brenden believes it is a bit older, and has been floating around since late last year. Its logo is a blue shield with a single red diagonal stripe; its tagline, “Innovative protection for your PC,” is utter nonsense.
\n
\nIt’s worth mentioning, as well, that there shouldn’t be any<\/em> programs in the Application Data folder. Legitimate programs usually create folders inside that directory, and maintain data files, logs, and other files they require inside of those folders. Technically speaking, there are two of these folders for a given user account.<\/p>\n
To see what’s inside each of your Application Data folders, click the Start menu, select Run…, then type either of the following commands into the text field and hit the Enter key or the OK button. Each will take you to a different folder.<\/p>\n
%appdata%\n%UserProfile%Local SettingsApplication Data<\/pre>\n
The directories should be full of other folders, and should not have any executable files in them, though there may be a few stray (harmless) data files or .ini files. Common legitimate<\/strong> three-character folder names include Sun<\/strong> (which contains files for Java) or vlc<\/strong> (used by the popular media player of the same name). There are probably many other legitimate three-letter folder names as well. Don’t delete anything from these locations unless you know what you’re doing.<\/p>\n
Antivirus IS<\/h3>\n
\"\"<\/a><\/p>\n
Antivirus IS makes some system modifications that inhibit your ability to use the browser.<\/p>\n
The rogue changes your DNS server settings, which permits the rogue’s operators to direct your computer to sites other than the ones you intend to visit. We were shocked, shocked<\/em> to discover that the DNS servers it points to are in a range of IP addresses assigned to an ISP in Ukraine. It also sets a registry key that disable the Internet Explorer Phishing Filter, and other keys that permit the rogue to act as a local Web proxy on port 5643 of the infected machine, which serves to prevent the browser from visiting certain Web sites.<\/p>\n
The following registry keys are some of the ones Antivirus IS created on a research testbed:<\/p>\n
HKEY_LOCAL_MACHINESystemCurrentControlSetServicesTcpipParameters\n NameServer=93.188.163.182,93.188.166.182\n\nHKEY_CURRENT_USERSOFTWAREMicrosoftInternet ExplorerPhishingFilter\n Enabled=0\n\nHKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionrun\n <random>=%UserProfile%Local SettingsApplication Data<random><random>.exe<\/pre>\n
(<random>, in this case, is typically three alphabetic characters chosen at random.)<\/p>\n
In the presence of some or all of the above registry settings, the following ones may also be considered harmful. If you manually remove the rogue and fail to remove these keys as well, your browser will not be able to surf the Web until you turn off the local proxy by setting ProxyEnable<\/strong> to 0<\/strong> (zero):<\/p>\n
HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet Settings\n ProxyEnable=1\n ProxyOverride=<local>\n ProxyServer=127.0.0.1:5643<\/pre>\n
— Vaughan<\/em>
\n\"Webroot<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
By Brenden Vaughan and Andrew Brandt This week, our support and advanced malware removal (AMR) team did not have a lot of new data to report about rogue security products. The most commonly encountered infection continues to be one of the rogues we reported about last week. While we may refer to it as XP […]<\/p>\n","protected":false},"author":65,"featured_media":17052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[8441,4811,8421,8417,3769,8445,8423,3483,4241,8447,8451,6567,8453,8437,8449,8435,4893,8443,8439,3471],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/4277"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=4277"}],"version-history":[{"count":1,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/4277\/revisions"}],"predecessor-version":[{"id":23851,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/4277\/revisions\/23851"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17052"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=4277"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=4277"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=4277"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=4277"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}