BitDefender weekly review – The marvelous Antivirus 360

Antivirus 360. If that's not a “genuine” antivirus product name then what is? As “real” as it may sound, we assure you its nothing but a fake. Its sole purpose is to harass users with unreal infections on their PCs in order to make them buy the product, which is supposed to clean the “infections”.

Win32.Worm.Autorun.QR
This worms usually comes inside NSIS (Nullsoft Installer) files pretending to be an installer for QuickWatch, a modal window used for debugging purposes. After this check, the installer will drop a file called QuickWatch.exe into %temp% and execute it.

QuickWatch.exe will then create an autorun.inf file in the root folder of every accessible drive. They contain a lot of garbage characters used to deceive detection of its real purpose, namely the execution of malware hidden in the RECYCLER folder with a random name.

The form of the random name is: S-3-0-68-100021457-100021691-100001035-4746.com, where each number seems to be randomly generated.

Every time the worm is executed, it will try to spread to other drives, including USB sticks and network drives. It will launch msiexec.exe, and keep the process running to mark its presence on the system. Afterwards it will copy msi.dll in %temp% patch it with several instructions which will make it delete the worm if it's manually executed.
Details: http://www.bitdefender.com/VIRUS-1000483-en--Trojan.Injector.CZ.html

Trojan.Downloader.FakeAv.AH
This Trojan is part of a rogue antivirus spreading chain. The “security product” is called Antivirus 360. This downloader will attempt to open a browser window with a malicious website which is either the download page for Antivirus 360 or its “remote scanning” module, which, after the quick scan, will yield many infection on the victims system. All of them are obviously fake, and their sole purpose is to freak out the user which will then attempt to download and install Antivirus 360 and perhaps even buy the product in order to have its computer “cleaned”.

Message displayed after scanning is complete can be one of the following:

"Your computer contains various signs of viruses and malware programs presence.
Your system requires immediate anti viruses check!
Antivirus 360 will perform a quick and free scanning of your PC for viruses and malicious programs."

"Your computer remains infected by viruses!
They can cause data loss and file damages and need to be cured as soon as possible.
Return to Antivirus 360 and download it secure to your PC"

"Your computer remains infected by viruses!
They can cause data loss and file damages and need to be cured as soon as possible.
Return to Antivirus 360 and download it secure to your PC"

Possible fake detections include:
Other fake-malware detected by it may be:
Email-Worm.Win32.Net
Email-Worm.Win32.Myd
Trojan-Downloader.Win

They are accompanied by a message like:

"This program is potentially dangerous for your system. Trojan-Downloader stealing passwords,
credit cards and other personal information from your computer.
Advice:
You need to remove this threat as soon as possible!"

Information in this article is available courtesy of BitDefender virus researchers: Lutas Andrei Vlad