Best Antivirus Software

Best Antivirus Software is a variant of Win32/FakeVimes - a family of programs that claims to scan for malware and displays fake warnings of "malicious programs and viruses". They then inform the user that they need to pay money to register the software in order to remove these non-existent threats. It may also modify security settings, prevent programs from running, and modify the Hosts file.

Installation

Best Antivirus Software is installed by a downloader, wich may also be detected as Rogue:Win32/FakeVimes. This downloads an encrypted copy of the fake scanner, which it decrypts and writes to %common_appdata%\<five random hexadecimal digits>\BA<three random hexadecimal digits>_<four random decimal digits>.exe. An example location for Best Antivirus Software might be %common_appdata%\54fd6\BA3b8_8068.exe. It then launches the fake scanner.

It then creates a registry entry so that this copy is run each time Windows starts:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "Best Antivirus Software"
With data: "<location of malware>" /s /d (for example, "%common_appdata%\54fd6\BA3b8_8068.exe" /s /d)

It drops an icon file BAS.ico to the same directory as the copied malware (for example, %common_appdata%\54fd6\BAS.ico)

It also creates empty folders "Quarantine Items" and "BASSys" under the same folder as the original copy of the scanner.

It creates a desktop shortcut at %desktopdir%\Best Antivirus Software.lnk.

It adds an item to Start Menu by creating a file at %startmenu%\Best Antivirus Software.lnk.

It adds an item to the Programs Menu by creating an file at %programs%\Best Antivirus Software.lnk.

It adds an icon to the Quick Launch bar by creating a file at %appdata%\Microsoft\Internet Explorer\Quick Launch\Best Antivirus Software.lnk.

Best Antivirus Software then creates a configuration file in a location such as %common_appdata\BAZUVONHOS\BAUTS.cfg.

Lastly, it creates a number of small junk files in the %userprofile%\Recent directory, which it can report as infected when performing its fake scan. These files are harmless by themselves.

Payload

Displays fake scanner

The malware masquerades as an antivirus scanner, and displays a number of windows, dialog boxes and system tray pop-ups in an attempt to convince you that you are infected. This appears to be an attempt to replicate the appearance of Microsoft Security Essentials.

If you try to remove the listed threats, you will be taken to a webpage informing you that you must pay to register the scanner in order to do so.

Adds details to Security Center

The malware adds its details to the legitimate Security Center by dropping a file named <four digit random number>.mof (for example, 5668.mof) to the directory in which it is running, and then launching a system tool using this file as input. It adds itself as both the Antivirus Product and Firewall Product:

Modifies Hosts file

Best Antivirus Software modifies the Windows Hosts file. The local Hosts file overrides the DNS resolution of a website URL to a particular IP address. Malware may make modifications to the Hosts file in order to redirect specified URLs to different IP addresses. Malware often modifies an affected computer's Hosts file in order to stop users from accessing websites associated with particular security-related applications (such as antivirus, for example).

Best Antivirus Software attempts to modify the Hosts file at %windows%\drivers\etc\hosts to remove certain entries if they are present. These entries may have been added earlier (by competing malware, for instance, or even by another security-conscious administrator) to prevent you from visiting the websites of Win32/FakeVimes or its payment gateways.

Some variants of Win32/FakeVimes have also been reported to add additional entries to the Hosts file in order to block access to security related websites, or redirect visits to search pages to sites of the malware's choosing.

Monitors browser traffic

The malware creates the following registry entry, which causes Internet Explorer to use a web proxy on the local computer.

In subkey: HKCU\Software\Microsoft\Internet Explorer
Sets value: "PRS"
With data: "hxxp://127.0.0.1:27777/?inj=%ORIGINAL%"

It then listens on port 27777 for the proxied web traffic. Should it find pages that it does not want you to view, it may block access to this content, or close browser tabs or windows. Should access be blocked, it may display a page such as the following:

Modifies default search page

The malware attempts to alter the default search page for Internet Explorer by creating a registry entry such as the following:

In subkey: HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes
Sets value: "URL"
With data: "hxxp://findgala.com/?&uid=8068&q={searchTerms}"

Modifies security settings

It creates the following registry entries in an attempt to allow Internet Explorer to run unsigned or incorrectly signed executables without displaying a warning:

In subkey: HKCU\Software\Microsoft\Internet Explorer\Download
Sets value: "CheckExeSignatures"
With data: "no"
Sets value: "RunInvalidSignatures"
With data: "1"

It may attempt to allow itself access through Windows Firewall by creating the following registry entry:

In subkey: HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
Sets value: "<location of malware>" (for example, %common_appdata%\54fd6\BA3b8_8068.exe)
With Data: "<location of malware>:*:Enabled:<Product Name>" (for example, %common_appdata%\54fd6\BA3b8_8068.exe:*:Enabled:Best Antivirus Software)

Some variants may also add the following:

In subkey: HKLM\System\CurrentControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
Sets value: <location of malware> (for example, %common_appdata%\54fd6\BA3b8_8068.exe)
With Data: "<location of malware>:*:Enabled:<Product Name>" (for example, %common_appdata%\54fd6\BA3b8_8068exe:*:Enabled:Best Antivirus Software)

If the computer is running Windows Vista or later, FakeVimes may also temporarily modify the registry entries below, to allow the Hosts file changes above to be made without a UAC (User Account Control) warning being displayed. After it has performed the changes, it may increase the security on these entries, but may use values other than the ones originally used.

In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Modifies value: "ConsentPromptBehaviorAdmin"
Modifies value: "ConsentPromptBehaviorUser"
Modifies value: "EnableLUA"

Prevents programs from running

The malware attempts to prevent a number of executables associated with Microsoft Security Essentials, Windows Defender, as well as E-set and AVG antivirus products from running. It does so by creating the following registry entries:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Sets value: "DisallowRun"
With data: "1"

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
Sets value: "0"
With data: "msseces.exe"
Sets value: "1"
With data: "MSASCui.exe"
Sets value: "2"
With data: "ekrn.exe"
Sets value: "3"
With data: "egui.exe"
Sets value: "4"
With data: "avgnt.exe"
Sets value: "5"
With data: "avcenter.exe"
Sets value: "6"
With data: "avscan.exe"
Sets value: "7"
With data: "avgfrw.exe"
Sets value: "8"
With data: "avgui.exe"
Sets value: "9"
With data: "avgtray.exe"
Sets value: "10"
With data: "avgscanx.exe"
Sets value: "11"
With data: "avgcfgex.exe"
Sets value: "12"
With data: "avgemc.exe"
Sets value: "13"
With data: "avgchsvx.exe"
Sets value: "14"
With data: "avgcmgr.exe"
Sets value: "15"
With data: "avgwdsvc.exe"

The malware also attempts to prevent a number of other programs from running, by setting the harmless system process "svchost.exe" as a debugger for these programs. This means that when you attempt to launch one of these programs, svchost.exe is run instead of the program that you want to run.

In subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<file name of blocked program>
Sets value: "Debugger"
With data: "svchost.exe"

for example:

In subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe
Sets value: "Debugger"
With data: "svchost.exe"

It does this for the following diagnostic or security-related security programs:

It also does the same for the following files used by other rogue antivirus software:

Modifies browser settings

Best Antivirus Software modifies the affected computer's browser settings by making the following changes to the registry:

In subkey: HKCU\Software\Microsoft\Internet Explorer
Sets value: "IIL"
With data: "0"
Sets value: "ltHI"
With Data: "0"
Sets value: "ltTST"
With Data: <five digit number> (for example, 20212)

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Sets value: "UID"
With data: <four digit identifier> (for example, 8068)

It also creates registry entries similar to the following, which add additional information to the string that a web browser uses to identify itself when connecting to a website:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
Sets value: <12 digit number> (for example, 786905932603)
With data: ""

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
Sets value: "ver:2.0<four digit identifier>" (for example, ver:2.08068)
With data: ""

Analysis by David Wood