The trail of bogus anti-virus software and the money it brings in leads to a software company in Russia, according to security researchers.