Green AV is a variant of Win32/FakeXPA - a family of programs that claims to scan for malware and displays fake warnings of “malicious programs and viruses”. They then inform the user that they need to pay money to register the software in order to remove these non-existent threats. Some members of the Win32/FakeXPA family may also download additional malware and have been observed in the wild downloading variants of
Win32/Alureon.
Win32/FakeXPA has been distributed with many different names. The name used by the malware, the user interface and other details vary to reflect each variant’s individual branding. The following details describe Win32/FakeXPA when it is distributed with the name Green AV.
Installation
The Green AV installer writes a number of files to the %AllUsersAppData%\gav directory. Some drop the files directly, while others download them from a location such as green-av.com, green-av-pro.com, or my-green-av.com. The installed files may include:
This is the fake scanner itself. In addition to the scanner window, it displays an icon in the system tray (and pop-up messages from that icon), pop-up alerts warning of "infections", "database update" dialogs and a window that imitates the Windows Security Center.
See below for examples of these:
The links displayed in this Window all redirect to a purchase page at a location such as green-av.com.
The installer may attempt to disable warnings from the real Windows Security Center with the following registry modification:
Key: HKLM\SOFTWARE\Microsoft\Security Center
Adds value: "AntiVirusDisableNotify"
Data: 1
This is installed as a BHO in order to display fake "drop-down" messages within Internet Explorer. Clicking on the message directs IE to a web page that allows the user to purchase "Antivirus 2010". Please see below for an example:
When registering QWProtect.dll as a BHO, registry entries such as the following may be created:
Key: HKCR\AppID\{29256442-2C14-48CA-B756-3EE0F8BDC774}
Value: (Default)
Data: QWProtect
Key: HKCR\AppID\QWProtect.DLL\
Value: AppID
Data: {29256442-2C14-48CA-B756-3EE0F8BDC774}
Key: HKCR\QWProtect.QWProtectBHO.1
Value: (Default)
Data: QWProtectBHO Class
Key: HKCR\QWProtect.QWProtectBHO.1\CLSID
Value: (Default)
Data: {70FEAD04-A7FD-4B89-B814-8A8251C90EF7}
Key: HKCR\QWProtect.QWProtectBHO
Value: (Default)
Data: QWProtectBHO Class
Key: HKCR\QWProtect.QWProtectBHO\CLSID
Value: (Default)
Data: {70FEAD04-A7FD-4B89-B814-8A8251C90EF7}
Key: HKCR\QWProtect.QWProtectBHO\CurVer
Value: (Default)
Data: QWProtect.QWProtectBHO.1
Key: HKCR\CLSID\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}
Value: (Default)
Data: QWProtectBHO Class
Key: HKCR\CLSID\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}\ProgID
Value: (Default)
Data: QWProtect.QWProtectBHO.1
Key: HKCR\CLSID\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}\VersionIndependentProgID
Value: (Default)
Data: QWProtect.QWProtectBHO
Key: HKCR\CLSID\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}\InprocServer32
Value: (Default)
Data: %AllUsersAppData%\gav\QWProtect.dll
Key: HKCR\CLSID\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}\InprocServer32
Value: ThreadingModel
Data: Apartment
Key: HKCR\CLSID\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}\TypeLib
Value: (Default)
Data: {512E801E-2F02-4ADE-ACAA-58F08A22B2F8}
Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}
Value: (Default)
Data: QWProtectBHO
Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}
Value: NoExplorer
Data: 1
Key: HKCR\TypeLib\{512E801E-2F02-4ADE-ACAA-58F08A22B2F8}\1.0
Value: (Default)
Data: QWProtect 1.0 Type Library
Key: \TypeLib\{512E801E-2F02-4ADE-ACAA-58F08A22B2F8}\1.0\FLAGS
Value: (Default)
Data: 0
Key: HKCR\TypeLib\{512E801E-2F02-4ADE-ACAA-58F08A22B2F8}\1.0\0\win32
Value: (Default)
Data: %AllUsersAppData%\gav\QWProtect.dll
Key: HKCR\TypeLib\{512E801E-2F02-4ADE-ACAA-58F08A22B2F8}\1.0\HELPDIR
Value: (Default)
Data: %AllUsersAppData%\gav
Key: HKCR\Interface\{051C9A06-FB08-486F-B09B-8B33B261637D}
Value: (Default)
Data: IQWProtectBHO
Key: HKCR\Interface\{051C9A06-FB08-486F-B09B-8B33B261637D}\ProxyStubClsid
Value: (Default)
Data: {00020424-0000-0000-C000-000000000046}
Key: HKCR\Interface\{051C9A06-FB08-486F-B09B-8B33B261637D}\ProxyStubClsid32
Value: (Default)
Data: {00020424-0000-0000-C000-000000000046}
Key: HKCR\Interface\{051C9A06-FB08-486F-B09B-8B33B261637D}\TypeLib
Value: (Default)
Data: {512E801E-2F02-4ADE-ACAA-58F08A22B2F8}
Key: HKCR\Interface\{051C9A06-FB08-486F-B09B-8B33B261637D}\TypeLib
Value: Version
Data: 1.0
• svchost.exe
This program displays a fake "blue screen" crash screen, followed by a fake restart screen.
The file may be extracted from another file named wsdt05.exe or wsdt.exe. The installer also creates the following shortcut on the desktop:
C:\Documents and Settings\All Users\Desktop\Green AV.lnk
and a folder containing a start menu item:
C:\Documents and Settings\All Users\Start Menu\Programs\Green AV\ GreenAV.lnk
Payload
Displays false/misleading malware alerts
When run, the malware performs a fake scan of the system, and falsely claims that a number of files on the system are infected with malware. Should users request that it clean the reported infections, it advises them that they need to pay money to register the program in order for it to do so. This process is described in detail in the Installation section displayed above.
Terminates Processes
Some variants install a batch file with a name such as wer.bat. This attempts to terminate the Windows Defender process MSASCui.exe. The installer may also create a registry entry such as the following to ensure that the batch file is run upon system startup:
Under key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Adds value: <digits> (eg “67569387646557683”)
With data: “%AllUsersAppData%\gav\wer.bat”
Other variants’ installers attempt to terminate processes from products such as Windows Defender, McAfee and Eset. These processes include the following:
MSASCui.exe
mcregist.exe
wmiprvse.exe
mcsysmon.exe
Mcshield.exe
McNASvc.exe
MpfSrv.exe
McSACore.exe
mcagent.exe
msksrver.exe
MpfSrv.exe
mcmscsvc.exe
McProxy.exe
nod32krn.exe
Note: Some variants also terminate iexplore.exe and firefox.exe during installation to ensure that the BHO is loaded when the browser is restarted.
Modifies Hosts File
The installer for some variants modifies the hosts file to redirect attempts to visit domains used by various PC review sites to a location such as 208.43.47.212. The local Hosts file overrides the DNS resolution of a Web site URL to a particular IP address. This may be an attempt to convince the user that the fake scanner has received positive reviews. One variant was observed to redirect the following domains:
a1.review.zdnet.com
reviews.riverstreams.co.uk
d1.reviews.cnet.com
review.2009softwarereviews.com
reviews.download.com
reviews.pcadvisor.co.uk
reviews.pcmag.com
reviews.pcpro.co.uk
reviews.techradar.com
toptenreviews.com
www.reevoo.com
Analysis by Hamish O'Dea