{"id":4328,"date":"2011-05-10T14:59:39","date_gmt":"2011-05-10T21:59:39","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=4328"},"modified":"2018-01-30T11:11:49","modified_gmt":"2018-01-30T18:11:49","slug":"rogue-of-the-week-antivirus-center","status":"publish","type":"post","link":"https://www.webroot.com/blog/2011\/05\/10\/rogue-of-the-week-antivirus-center\/","title":{"rendered":"Antivirus Center: Rogue of the Week"},"content":{"rendered":"

By Andrew Brandt and Brenden Vaughan<\/strong><\/p>\n

\"\"\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"\"<\/p>\n

\"\"<\/a>Our Advanced Malware Removal group reported seeing several cases of a rogue called Antivirus Center<\/strong> this past week. The rogue isn’t new \u2013 we began seeing samples of it last year \u2013 but has re-emerged as a threat.<\/p>\n

This rogue is characterized by a close mimicry of some aspects of Microsoft’s free Windows Defender product, including the use of a program icon that looks like a castle, as well as some distinctive characteristics of its active file components. For example, the rogue’s application consistently uses a naming convention that looks like a long string of random alphanumeric characters, with a .dat extension, located in the Application Data folder of the “All Users” profile. As we’ve written before<\/a>, no programs should run from the Application Data folder, so anything in that location is automatically suspect.<\/p>\n

That said, it’s still going through the same stupid rogue AV motions, with all the exaggerated detections and predictably hilarious bad grammar we’ve come to expect. Read on for more details.<\/p>\n

\"\"<\/a><\/p>\n

The file’s name, while random, is readily identifiable because it always groups the random characters in the filename the same way. As you can see, the name of both the malware executable and its icon file use a group of eight characters, then three groups of four, then a group of 12 characters, each group separated by hyphens. This 8-4-4-4-12.dat<\/strong> pattern makes it very easy to spot, especially because it’s always in the “All Users” version of the Application Data folder.<\/p>\n

\"\"<\/a><\/p>\n

Even the “purchase” process emulates the activation procedure used by Microsoft for Windows and other products. Though in the end, you’re still just led to a Web page where you’re asked to pay a whopping $80 for this sham (a $50 discount off previous frauds).<\/p>\n

\"\"<\/a><\/p>\n

Antivirus Center also creates copies of itself in the current user’s Local SettingsTemp folder, named mv2.tmp<\/strong> and wrk3.tmp<\/strong>, as well as a copy of its icon named ins1.tmp<\/strong><\/strong>. (The main rogue file in the screenshot below was renamed for the sake of clarity.)<\/p>\n

\"\"<\/a><\/p>\n

<\/strong>If you click the Help menu within Antivirus Center, a compressed help file named hlp4.tmp.chm<\/strong> appears in the same Temp folder location. The “license” part of the help file tells you to head to Microsoft’s Web site and search for “Antivirus Center license terms<\/strong>” for more details. Needless to say, that would be a pointless exercise.<\/p>\n

\"\"<\/a><\/p>\n

The rogue adds a run key for itself under the HKEY_CURRENT_USER hive. The rogue’s executable is actually a DLL, even though it uses a .dat extension, so the run key actually launches the legitimate Windows app rundll32.exe and passes the rogue’s filename as a parameter to rundll32.exe in order to launch the rogue.<\/p>\n

\"\"<\/a><\/p>\n

If you find yourself infected with this rogue, start the computer in Safe Mode with Networking (the rogue won’t execute), and you should be able to perform a full sweep to remove it.<\/p>\n

\"\"<\/a><\/p>\n

The only other registry entry it creates is a firewall exception for rundll32.exe, which allows the rogue to connect to its “buy the license key” Web site.<\/p>\n

Here are some examples of the program’s active windows.<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

And these are some of the warning messages you’re likely to see. Keep offa my treats<\/em>, rogue!<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

We highly recommend you deny the moronic criminals behind this junk their payday.\"Webroot<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

By Andrew Brandt and Brenden Vaughan Our Advanced Malware Removal group reported seeing several cases of a rogue called Antivirus Center this past week. The rogue isn’t new \u2013 we began seeing samples of it last year \u2013 but has re-emerged as a threat. This rogue is characterized by a close mimicry of some aspects […]<\/p>\n","protected":false},"author":65,"featured_media":17052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[4263,8425,4811,8419,4209,8421,8417,8427,5685,8423,3619,4241,6281,7311,8005,4893,3905,3471,4621,3951],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/4328"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=4328"}],"version-history":[{"count":1,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/4328\/revisions"}],"predecessor-version":[{"id":23580,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/4328\/revisions\/23580"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17052"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=4328"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=4328"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=4328"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=4328"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}