Sunday, June 24, 2007

AVSystemCare – New fake anti-malware

AVSystemCare is one of the latest fake/dubious anti-malware. The installer stub of AVSystemCare is detected by most of the AVs as a variant of "popular" WinFixer rogue software. AVSystemCare is one among numerous similar looking dubious software. Some of the clones are MenaceRescue, AntiSpywareSuite and GoldenAntiSpy etc. All of them have identical websites, and an example is shown in the below screen shot:

Below screen shot shows Malware Scanner scan results of the installer stub:

When this stub is executed, it downloads a 14 MB (!) setup file through which the actual AVSystemCare is installed. This is how AVSystemCare looks like:

AVSystemCare installs some SSDT hooks, IAT hooks and Message Hooks as part of its "real-time monitor" and creates some "Run" Registry keys, as shown in below screen shots:

AVSystemCare also "updates" itself automatically by connecting to one of their servers:

Interestingly, it does seem to monitor the system in real-time, and it alerts the user when it detects a malware or when user tries to execute malware files:

However, this software is dubious and is not at all recommended for usage. The uninstaller provided with the software removes almost all of its traces. However, it is recommended to scan a PC with any of the popular and legitimate anti-malware tools. Also, RogueRemover - a tool from - removes all the traces of AVSystemCare automatically, and it can be downloaded from here for free. More information about AVSystemCare is available at Symantec Security Response pages.

Saturday, June 23, 2007

InternetGameBox Rootkit

InternetGameBox touts itself as software, which allows you to play online, flash based online games. But, InternetGameBox is much more than gaming! It's an adware which uses Navipromo rootkit to hide its traces! As soon as InternetGamebox client program is installed from their website, the installer drops few files to System32 directory and creates a randomly named process which is hidden from user mode APIs.

This is how InternetGameBox client looks like:

Here's a screen shot of hidden process:

Files and Registry keys hidden by Navipromo:

Surprisingly, the hidden executable is barely detected by AVs. Here's a screen shot of Malware Scanner showing the scan result of the executable. It can be seen that only ArcaVir was able to detect it heuristically:

InternetGameBox' Navipromo rootkit can be completely removed using the Navilog1 tool. A tutorial to use the Navilog1 tool to remove Navipromo can be found at CastleCops Wiki.

Update! SysProt AntiRootkit v1.0.0.4 Beta

Here comes the next version of SysProt AntiRootkit. Several changes, fixes have been done in the version
Hidden process detection and removal
Hidden driver detection
SSDT hooks detection and removal
Kernel inline hooks detection and removal
Sysenter hook detection
Hidden "Services" Registry key detection and removal
Ports information
File system browser
And not to forget, it's faster than the older one :)

Process tab:

SSDT tab:

Kernel Inline Hooks tab:

Registry tab:

SysProt AntiRootkit