Malware Database

Today I came across a new Antivirus 2009 binary with a 1 out of 36 detection ratio on VirusTotal.  The session starts at antivirus-best.com and that page is reduced to a pop-up message, as usual.  Then we are briefly taken to voodoorevenue.com where the affilliate information for the malware creators is sent and then redirected to the point of download, protection-overview.com.

Screenshot:

Removal Information:

We successfully tested MalwareBytes to remove this threat. 
Click here for more information on the removal process.

Session Summary

#    Result    Protocol    Host    URL    Body
538    200    HTTP    antivirus-best.com    /
539    200    HTTP    antivirus-best.com    /window.js
540    200    HTTP    CONNECT    urs.microsoft.com:443
541    200    HTTP    antivirus-best.com    /_freescan.php?id=
542    200    HTTP    antivirus-best.com    /fileslist.js
543    200    HTTP    antivirus-best.com    /progressbar2.js
544    200    HTTP    antivirus-best.com    /common.js
545    200    HTTP    antivirus-best.com    /hat1.jpg
546    200    HTTP    antivirus-best.com    /pixel_trans.gif
547    200    HTTP    antivirus-best.com    /bgleft.gif
548    200    HTTP    antivirus-best.com    /disks.gif
549    200    HTTP    antivirus-best.com    /bgtop1.gif
550    200    HTTP    antivirus-best.com    /warning.jpg
551    200    HTTP    antivirus-best.com    /pbbg2.gif
552    200    HTTP    antivirus-best.com    /table1.gif
553    200    HTTP    antivirus-best.com    /footer.gif
554    200    HTTP    antivirus-best.com    /bgright.gif
555    200    HTTP    antivirus-best.com    /popup4.gif
556    200    HTTP    antivirus-best.com    /pbbg.gif
557    200    HTTP    antivirus-best.com    /closebutton.gif
558    404    HTTP    antivirus-best.com    /favicon.ico
559    200    HTTP    antivirus-best.com    /warning2.jpg
560    200    HTTP    antivirus-best.com    /table2.gif
561    302    HTTP    voodoorevenue.com    /soft.php?aid=0777&d=100&product=XPA&refer=c79bfd2d5
562    302    HTTP    protection-overview.com    /2009/100/freescan.php?id=880777
563    200    HTTP    protection-overview.com    /2009/download/trial/A9installer_880777.exe

After Install

780    200    HTTP    secureupdateserver.com/download/av_2009.exe  > called by: a9installer_880777:1580
781    206    HTTP    secureupdateserver.com/download/av_2009.exe  > called by: a9installer_880777:1580
782    200    HTTP    secureupdateserver.com/download/av_2009.exe  > called by:a9installer_880777:1580
783    200    HTTP    secureupdateservice.com/firstrun.php?product=AV9&aff=880777&update=2409av9nv&time=00:00:00 > by:  av2009:732

Files:

DownloadPath\$$$$$$$$$.bat (deletes the installer)
%ProgramFiles%\Antivirus 2009\av2009.exe
%SystemRoot%\System32\scui.cpl

Registry:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: 66878074513444726827872864318771
Value: C:\Program Files\Antivirus 2009\av2009.exe

File: A9installer_880777.exe
VirusTotal: 1/36 (2.78%)

File: av2009.exe
VirusTotal: 3/36 (8.33%)

Removal:

Remove this threat with MalwareBytes!