AVGAntivirus2011 threat description - Microsoft Security Intelligence

Summary

'AVG Antivirus 2011' is a variant of Win32/FakeXPA - a family of programs that claims to scan for malware and displays fake warnings of malicious programs and viruses. They then inform the user that they need to pay money to register the software to remove these non-existent threats. Some members of the Win32/FakeXPA family might also download additional malware and have been observed in the wild downloading variants of Win32/Alureon.

Special Note:
Reports of Rogue Antivirus programs have been more prevalent as of late. These are programs that generate misleading alerts and false detections in order to convince users to purchase illegitimate security software. Some of these programs, such as Trojan:Win32/Antivirusxp and Program:Win32/FakeRednefed may display product names or logos in an apparently unlawful attempt to impersonate Microsoft products. These products may represent themselves as "Antivirus XP", "AntivirusXP 2008", "WinDefender 2008", "XP Antivirus", or similar.

Use Microsoft Windows Defender, Microsoft Security Essentials, the Microsoft Safety Scanner, or another up-to-date scanning and removal tool to detect and remove this threat and other unwanted software from your computer. For more information on Microsoft security products, see http://www.microsoft.com/protect/products/computer/default.mspx.

To detect and remove this threat and other malicious software that may be installed on your computer, run a full-system scan with an appropriate, up-to-date, security solution. The following Microsoft products will detect and remove this threat:

For more information on antivirus software, see http://www.microsoft.com/windows/antivirus-partners/.

For information on additional support options worldwide, see http://www.microsoft.com/protect/support/default.mspx.

Threat behavior

'AVG Antivirus 2011' is a variant of Win32/FakeXPA - a family of programs that claims to scan for malware and displays fake warnings of "malicious programs and viruses". They then inform the user that they need to pay money to register the software in order to remove these non-existent threats. Some members of the Win32/FakeXPA family may also download additional malware and have been observed in the wild downloading variants of Win32/Alureon.

Win32/FakeXPA has been distributed with many different names. The name used by the malware, the user interface and other details vary to reflect each variant’s individual branding. The following details describe Win32/FakeXPA when it is distributed with the name 'AVG Antivirus 2011'.

Installation

The following system changes may be made by Win32/FakeXPA when distributed as 'AVG Antivirus 2011'. When installed, the rogue copies itself to the following locations:

%ProgramFiles%\AVG Antivirus 2011\avg.exe
%system%\iesafemode.exe

When installed, the rogue creates the following shortcuts:

%DESKTOPFOLDER%\AVG Antivirus 2011.lnk - desktop link
%COMMON_STARTMENU%\AVG Antivirus 2011\AVG Antivirus 2011.lnk - Start Menu link

The rogue makes the following modification to the registry to ensure its copy executes at each Windows start:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Adds value: "AVG Antivirus 2011"

With data: "%ProgramFiles%\AVG Antivirus 2011\avg.exe"

The rogue sets itself as the default debugger for Internet Explorer, Firefox, Opera, Chrome, and Safari, so that when the user attempts to launch these applications, the malware is launches instead:

In subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

Sets value: "Debugger"