Tracking Cyber Crime: AV-AFF.BIZ (Total Protect FakeAV)

New fresh AV affiliate, they spread Total Protect.

I was approached the 12 Sept on a underground forum.

Here a some parts of my conversations, may that can interest some of you.

13 Sept:

AV AFF 20:11
hello

AloneWarrior 20:11
hi man
i've recevied a pm about your av program

AV AFF 20:11
That's good
we can offer pay-per-sale

AV AFF 20:12
best conversion for USA, GB, CA, etc

AloneWarrior 20:12
PPS ?

AV AFF 20:12
all AV are PPS
PPI always scam with shaving
we do not do shaving)

AloneWarrior 20:12
okay
there is no special '%' on specific country or shit like that?

AloneWarrior 20:13
also need to know if your AV will not kill my bots.
i've lost 2k bots

AV AFF 20:14
every AV destroys bots.
will not last very long.

AloneWarrior 20:14
hmm

AV AFF 20:14
therefore it makes better money than PPC.
best is buy exploit pack + traffic from earnings

AloneWarrior 20:14
ok

AV AFF 20:14
then you have a steady stream of installs
how many loads per day are we talking about?

AloneWarrior 20:15
not much for the moment
~100/200

AV AFF 20:15
mix? or USA?

AloneWarrior 20:15
mix

AV AFF 20:16
ok, I do not think that our system would be good for you yet.
at the moment we are still optimizing with big installation sources.
in 1-2 weeks we will have best conversion rates
then I suggest you to try us out.
I do not want you to lose your bots for a low amount.

AloneWarrior 20:17
ok
i will try to have more

AV AFF 20:17
you can already try if you wish
your decision)

AloneWarrior 20:18
why not, i will just register for the moment and will load when i will have more bots

AV AFF 20:19
ok to invite you into the system I will need an email address
where I can send the invitation

AloneWarrior 20:19
alonetrafic@yahoo.com

AloneWarrior 20:20
also i'm curious of av affiliate i've already used many program, but i wonder how to create one

AV AFF 20:20
)))
many people want to do this

AV AFF 20:21
if it was easy and possible for normal people there would be more programs

AloneWarrior 20:21
how to create is not really a problem but how to find a good programer is

AV AFF 20:21
no

AV AFF 20:22
)
different problems)

AloneWarrior 20:22
ah

AV AFF 20:22
programmer is very easy

AloneWarrior 20:22
payement system ?

AV AFF 20:22
exactly
anonymous banking setup offshore
and payment merchant visa mastercard
interpol, fbi, visa and mastercard make many many problems)

AloneWarrior 20:23
and for exe

AV AFF 20:23
did you register?
or what is your exact question about exe?

AloneWarrior 20:24
you program it or it's a usual av like security shield

AV AFF 20:24
own software
brb

AloneWarrior 20:24
ah cool
btw i've recevied no mail

AV AFF 20:24
check now

AloneWarrior 20:25
got it thanks

AloneWarrior 20:28
on the pm i got it's says that the payout method of your choice but there no really many only wmz and transfer wire

AV AFF 20:44
you will tell us what payment option you want
and we can arrange
no problem

AloneWarrior 20:45
no webmoney is good i will use that

AV AFF 20:45
very good)

AloneWarrior 20:46
where is the exe download?

AV AFF 20:46
on custom request only)

AloneWarrior 20:46
and there is a service who check for detection rate?
ah ok

AV AFF 20:46
no

AV AFF 20:47
our exe sadly detected at the moment
3 or 4 detections I think

AloneWarrior 20:47
there is a way you can build me one ? wanna try.

AV AFF 20:51
what do you want to try?

AloneWarrior 20:52
bot kill

AV AFF 20:52
it does not do botkilling
it does kill everything which starts 30 seconds after system boot
bots start earlier
but it will annoy the user so many people will format

AloneWarrior 20:54
or can you add a 'white list'?

AV AFF 20:54
it will not kill your bot
it will just kill common software
this is why the user will format sooner or later

AloneWarrior 20:54
ok

AV AFF 20:57
want an exe?

AloneWarrior 20:57
yeah

AV AFF 20:57
ok wait a moment.

AV AFF 20:59
I am a bit busy at the moment, will create you an exe later, ok?

AloneWarrior 20:59
no problem

~
14 Sept:

AV AFF 00:16
exe will be provided tomorrow.

AloneWarrior 00:16
okay

AV AFF 00:16
updated and newly tested exe for all affiliates including you

AV AFF 00:17
current exe have some small problem
need fix then new testing first for good quality assured
thank you for patience

~
15 Sept:

AloneWarrior 00:17
hi man, exe are ready to be spread ?

AV AFF 00:18
sorry for delay
during next 12-24 hours

AV AFF 00:19
we are fixing one bug with single affiliate
we are very sorry, but in 12.24 hours we can provide clean

AloneWarrior 00:19
okay

AV AFF 00:19
sorry for delay

~
16 Sept:

AV AFF 23:55
we are fixing tonight
thats why not being able to deliver

AV AFF 23:56
all other affiliates have had problems with conversions
we are really sorry for those problems, but we are a very new and young program, so we still have some problems to work on from time to time

AloneWarrior 23:59
okay

AV AFF 00:00
this is a bit of an embarassing situation
because I said exe will be ready 2 days ago

AV AFF 00:01
but our programmers found bugs which harm conversion rate very hard, I can't really give out buggy exe file
I hope you understand our problem)

~
19 Sept: AV program launched.

AloneWarrior 17:38
hi, any new for the launch date of program ?

AV AFF 17:38
want to try loading a few
?
can compile you now

AloneWarrior 17:39
don't need a beta or alpha but the launch date when we can start to mass load exe

AV AFF 17:39
software is ready

AV AFF 17:40
define mass load exe
load 1k for test then if you like rates load more
not load 100k at once

AloneWarrior 17:40
ah so the debug is finished we can start to work ?

AV AFF 17:40
yes

AloneWarrior 17:40
nice

AV AFF 17:40
debug finished some hours ago

AV AFF 17:41
we think all ok and good
tested with mix traffic got some conversions
technical department will create exe for you now
please stay ready for next 15 minutes to start traffic
but one rule - only send traffic when we allow; else if you send at bad time maybe when we work on system cant pay

AV AFF 17:42
always ask before you send traffic

AloneWarrior 17:42
ok

AV AFF 17:50
what is your username

AloneWarrior 17:51
AloneWarrior

AV AFF 17:52
ok

AV AFF 17:56
http://www63.zippyshare.com/v/*********
1k only please for beginning

AloneWarrior 17:56
ok

AV AFF 17:58
please tell when loading

Login:

Dashboard/install view:

 Show profile:

 Edit profile:

 Statistics:

 TotalProtect:

 AffiliateID is used here to reconize the partner:

http://totalsolutionantivirus.com/order/pay.php lead to https://migs.mastercard.com.au/vpcpay?o=pt&DOID=F0CCA67DEC356EFB40267C4896237237&paymentId=3842949780467128039

After a css file is added and the page is miraculously changed

VirusTotal:

Satisfied partner, good payments: