Trojan:Win32/FakeXPA is a family of programs that claims to scan for malware and displays fake warnings of “malicious programs and viruses”. They then inform the user that they need to pay money to register the software in order to remove these non-existent threats. This trojan may display a dialog that mimics the Windows Security Center. Some members of the Win32/FakeXPA family may also download additional malware and have been observed in the wild downloading variants of
Win32/Alureon.
Installation
Members of the Trojan:Win32/FakeXPA family use various installation methods, with filenames and system modifications that can differ from one variant to the next.
Trojan:Win32/FakeXPA has been distributed with several different names such as the following examples:
-
XP Antivirus
-
Antivirus 2009
-
Antivirus 2010
-
Antivirus 360
-
Personal Antivirus
The user interface and some other details vary to reflect each variant’s individual branding. Please see below for examples of different distributions of this trojan family.
MaCatte
The MaCatte installer downloads a file from a server such as macatte.com and saves it to a location such as %AllUsersAppData%\msca\macinstall.exe. This drops a password protected zip to a subdirectory of the %temp% directory (eg ~dfa3da.tmp) with a filename of mc.exe. This in turn extracts the fake scanner executable to the same directory with a filename of mac.exe.
In addition to the scanner window, this executable displays an icon in the system tray (and popup messages from that icon), popup alerts warning of "infections", "database update" dialogs and a window that imitates the Windows Security Center.
See below for examples of these:
The links displayed in this Window all redirect to a purchase page at a location such as macatte.com.
It may create registry entries similar to the following:
Under key: HKCU\Software\mac\mac\{FBF234D4-8743-DAC4-FFA3-555FF4334B54}
Adds value: {88A65DC8-BF6C-EBF5-86EA-F5CEABFCEA86}
With data: 1
Adds value: {ACD09384-FC88-765D-BF76-DABF57F576DA}
With Data: <16 bytes> (eg D9 07 0B 00 03 00 0B 00 12 00 1F 00 38 00 6E 02)
This malware may also display a fake "blue screen" crash screen, followed by a fake restart screen.
Additional Payloads - MaCatte
Terminates Processes
Some variants’ installers attempt to terminate processes from products such as Windows Defender, McAfee and Eset. These processes include the following:
MSASCui.exe
mcregist.exe
wmiprvse.exe
mcsysmon.exe
Mcshield.exe
McNASvc.exe
MpfSrv.exe
McSACore.exe
mcagent.exe
msksrver.exe
MpfSrv.exe
mcmscsvc.exe
McProxy.exe
nod32krn.exe
Modifies hosts file
The malware may modify the hosts file to redirect attempts to visit domains used by various PC review sites to another location. This may be an attempt to convince the user that the fake scanner has received positive reviews.
-----
XP Antivirus
The following system changes may be made by Win32/FakeXPA when distributed as 'XP Antivirus'.
When installed, the following file folders are created:
The installer may place the following files into the '%ProgramFiles%\XP Antivirus' folder:
-
xpa.exe
-
xpantiviruspro.exe
-
xpa2008.exe
Next, the registry is modified to run a copy of Win32/XPAntiVirus at each Windows start.
Adds value: "XP Antivirus"
With data: "%ProgramFiles%\XP Antivirus\xpantiviruspro.exe"
To subkey: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Additionally, the installer may add the value "XP Antivirus" to this subkey:
HKEY_CURRENT_USER\Software
When Trojan:Win32/FakeXPA is run from the Start Menu, it launches the installed executable. When the user 'scans' the system, the program may display false detection alerts.
For example, when this program was run on a new and clean installation of Microsoft Windows XP Professional, the following warning was displayed:
In addition to the above, Trojan:Win32/FakeXPA continuously displays messages stating that the system is infected, as shown below.
Antivirus 2009
Please see below for examples of interface, fake alerts, false scanning results, and pop-ups used by Win32/FakeXPA when distributed as 'XP Antivirus'.
Below is a sample of a false report displayed on a clean machine:
Clicking on the "Remove all threats now" button may display the following registration page:
Win32/FakeXPA periodically displays the following message in the system tray:
Clicking on the icon brings up this imitation and bogus Windows Security Center page:
All links under "Resources" and "Manage security settings for" are actually the same URL that points to the same order page at the site 'antivirus-database.com'. Win32/FakeXPA also periodically displays the following message:
Antivirus 2010
The Antivirus 2010 installer downloads and installs several files from the download-av2010.info domain, including:
This is the fake scanner itself. In addition to the scanner window, it displays an icon in the system tray (and popup messages from that icon), popup alerts warning of "infections", "database update" dialogs and a window that imitates the Windows Security Center.
It may be saved as:
C:\Documents and Settings\All Users\Application Data\AV2010\AV2010.exe.
See below for examples of the icon, pop-up alerts, update dialog and imitation Windows Security Center:
This component launches the fake scanner and can also download the latest version of any components if, for example, they are removed. It may be saved as:
C:\Documents and Settings\All Users\Application Data\SysLoader.exe. See below for an example of the fake scanning interface:
It adds an entry to the registry so it is launched each time Windows starts, for example:
Value: Gamma Loader
Data: "C:\Documents and Settings\All Users\Application Data\SysLoader.exe" /adjustment
Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
The '/adjustment' parameter tells the launcher to be "silent", i.e. not show the installation dialog.
This component may be saved to:
C:\Documents and Settings\All Users\Application Data\AV2010\IEDefender.dll
It is installed as a BHO in order to display fake "drop-down" messages within Internet Explorer. Clicking on the message directs IE to a web page that allows the user to purchase "Antivirus 2010". Please see below for an example:
When registering IEDefender.dll as a BHO, the following registry changes may be made:
Key: HKCR\AppID\{3C40236D-990B-443C-90E8-B1C07BCD4A68}
Value: (Default)
Data: IEDefender
Key: HKCR\AppID\IEDefender.DLL
Value: AppID
Data: {3C40236D-990B-443C-90E8-B1C07BCD4A68}
Key: HKCR\IEDefender.IEDefenderBHO.1
Value: (Default)
Data: IEDefenderBHO Class
Key: HKCR\IEDefender.IEDefenderBHO.1\CLSID
Value: (Default)
Data: {FC8A493F-D236-4653-9A03-2BF4FD94F643}
Key: HKCR\IEDefender.IEDefenderBHO
Value: (Default)
Data: IEDefenderBHO Class
Key: HKCR\IEDefender.IEDefenderBHO\CLSID
Value: (Default)
Data: {FC8A493F-D236-4653-9A03-2BF4FD94F643}
HKCR\IEDefender.IEDefenderBHO\CurVer
Value: (Default)
Data: HelloWorld.HelloWorldBHO.1
Key: HKCR\CLSID\{FC8A493F-D236-4653-9A03-2BF4FD94F643}
Value: (Default)
Data: IEDefenderBHO Class
Key: HKCR\CLSID\{FC8A493F-D236-4653-9A03-2BF4FD94F643}\ProgID
Value: (Default)
Data: IEDefender.IEDefenderBHO.1
Key: HKCR\CLSID\{FC8A493F-D236-4653-9A03-2BF4FD94F643}\VersionIndependentProgID
Value: (Default)
Data: IEDefender.IEDefenderBHO
Key: HKCR\CLSID\{FC8A493F-D236-4653-9A03-2BF4FD94F643}\InprocServer32
Value: (Default)
Data: C:\Documents and Settings\All Users\Application Data\AV2010\IEDefender.dll
Key: HKCR\CLSID\{FC8A493F-D236-4653-9A03-2BF4FD94F643}\InprocServer32
Value: ThreadingModel
Data: Apartment
Key: HKCR\CLSID\{FC8A493F-D236-4653-9A03-2BF4FD94F643}\TypeLib
Value: (Default)
Data: {705FD64B-2B7B-4856-9337-44CA1DA86849}
Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC8A493F-D236-4653-9A03-2BF4FD94F643}
Value: (Default)
Data: IEDefenderBHO
Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC8A493F-D236-4653-9A03-2BF4FD94F643}
Value: NoExplorer
Data: 1
Key: HKCR\TypeLib\{705FD64B-2B7B-4856-9337-44CA1DA86849}\1.0
Value: (Default)
Data: HelloWorld 1.0 Type Library
Key: HKCR\TypeLib\{705FD64B-2B7B-4856-9337-44CA1DA86849}\1.0\FLAGS
Value: (Default)
Data: 0
Key: HKCR\TypeLib\{705FD64B-2B7B-4856-9337-44CA1DA86849}\1.0\0\win32
Value: (Default)
Data: C:\Documents and Settings\All Users\Application Data\AV2010\IEDefender.dll
Key: HKCR\TypeLib\{705FD64B-2B7B-4856-9337-44CA1DA86849}\1.0\HELPDIR
Value: (Default)
Data: C:\Documents and Settings\All Users\Application Data\AV2010
Key: HKCR\Interface\{7BC7565C-5062-43CE-8797-DC2C271140A9}
Value: (Default)
Data: IHelloWorldBHO
Key: HKCR\Interface\{7BC7565C-5062-43CE-8797-DC2C271140A9}\ProxyStubClsid
Value: (Default)
Data: {00020424-0000-0000-C000-000000000046}
Key: HKCR\Interface\{7BC7565C-5062-43CE-8797-DC2C271140A9}\ProxyStubClsid32
Value: (Default)
Data: {00020424-0000-0000-C000-000000000046}
Key: HKCR\Interface\{7BC7565C-5062-43CE-8797-DC2C271140A9}\TypeLib
Value: (Default)
Data: {705FD64B-2B7B-4856-9337-44CA1DA86849}
Key: HKCR\Interface\{7BC7565C-5062-43CE-8797-DC2C271140A9}\TypeLib
Value: Version
Data: 1.0
This program displays a fake "blue screen" crash screen, followed by a fake restart screen. It may be saved to:
C:\Documents and Settings\All Users\Application Data\AV2010\svchost.exe.
The installer also creates the following shortcut on the desktop:
C:\Documents and Settings\All Users\Desktop\AV2010.lnk
and a folder containing two items in the start menu:
C:\Documents and Settings\All Users\Start Menu\Programs\AV2010\AV2010.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\AV2010\Uninstall.lnk
Win32/FakeXPA may also make the following registry modifications when distributed as Antivirus 2010:
HKCU\Software\AV2010\AV2010\{F275E931-AFEC-4f70-B0D4-CC2731B945E0}
Value: {9BB761E6-288E-4782-8538-9069141F34B6}
Data: 1
Key: HKCU\Software\AV2010\AV2010\{F275E931-AFEC-4f70-B0D4-CC2731B945E0}
Value: {BE8A5069-82B0-4214-98DB-715C2B6D3117}
Data: D8 07 0C 00 01 00 16 00 15 00 39 00 27 00 E7 03
Personal Antivirus
The installer component (seen below) downloads the 'Personal Antivirus' executable, pav.exe, and runs it.
Pav.exe in turn copies itself to %PROGRAM_FILES%\PAV\pav.exe and creates these shortcuts:
-
%COMMON_STARTMENU%\PAV\Personal Antivirus.lnk
-
%COMMON_STARTMENU%\PAV\Uninstall.lnk
-
%DESKTOPDIRECTORY%\Personal Antivirus.lnk
It adds this registry entry:
To key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Adds value: "PAV"
With data: "%PROGRAM_FILES%\PAV\pav.exe"
Please see below for examples of interface, fake alerts, false scanning results, and pop-ups used by Win32/FakeXPA when distributed as 'Personal Antivirus':
AntivirusBEST
The following system changes may be made by Win32/FakeXPA when distributed as 'AntivirusBEST'.
When installed, the following file folders are created:
-
%COMMON_APPDATA%\AB\Installer.exe
-
%COMMON_APPDATA%\AB\ABEST.CAB
-
%COMMON_APPDATA%\AB\abest.exe
-
%COMMON_APPDATA%\AB\QWProtect.dll
-
%COMMON_APPDATA%\AB\svchost.exe
-
%COMMON_DESKTOP%\AntivirusBEST.lnk
-
%COMMON_PROGRAMS%\AntivirusBEST\AntivirusBEST.lnk
-
%COMMON_PROGRAMS%\AntivirusBEST\Uninstall.lnk
The following modifications are made to the registry (for example):
To subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Adds value: AntivirusBEST
With data: “%COMMON_APPDATA%\AB\Installer.exe”
Please see below for examples of interface, fake alerts, false scanning results, and pop-ups used by Win32/FakeXPA when distributed as 'AntivirusBEST'.
Cyber Security/Cyber Protection Center
The following system changes may be made by Win32/FakeXPA when distributed as 'Cyber Security' or 'Cyber Protection Center'.
When installed, the following files are created:
-
%program_files%\common files\csuninstall\uninstall.lnk
-
c:\documents and settings\administrator\desktop\cyber security.lnk
-
c:\documents and settings\administrator\application data\microsoft\internet explorer\quick launch\cs.lnk
-
c:\documents and settings\all users\start menu\cs\cyber security.lnk
-
c:\documents and settings\all users\start menu\cs\computer scan.lnk
-
c:\documents and settings\all users\start menu\cs\update.lnk
-
c:\documents and settings\all users\start menu\cs\settings.lnk
-
c:\documents and settings\all users\start menu\cs\help.lnk
-
c:\documents and settings\all users\start menu\cs\registration.lnk
-
c:\documents and settings\all users\start menu\cs\security center.lnk
The following modifications are made to the registry (for example):
To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Adds value: "CS"
With data: "%program_files%\cs\tsc.exe"
Green AV
The Green AV installer writes a number of files to the %AllUsersAppData%\gav directory. Some drop the files directly, while others download them from a location such as green-av.com, green-av-pro.com, or my-green-av.com. The installed files may include:
This is the fake scanner itself. In addition to the scanner window, it displays an icon in the system tray (and pop-up messages from that icon), pop-up alerts warning of "infections", "database update" dialogs and a window that imitates the Windows Security Center.
See below for examples of these:
The links displayed in this Window all redirect to a purchase page at a location such as green-av.com.
The installer may attempt to disable warnings from the real Windows Security Center with the following registry modification:
Key: HKLM\SOFTWARE\Microsoft\Security Center
Adds value: "AntiVirusDisableNotify"
Data: 1
This is installed as a BHO in order to display fake "drop-down" messages within Internet Explorer. Clicking on the message directs IE to a web page that allows the user to purchase "Antivirus 2010". Please see below for an example:
When registering QWProtect.dll as a BHO, registry entries such as the following may be created:
Key: HKCR\AppID\{29256442-2C14-48CA-B756-3EE0F8BDC774}
Value: (Default)
Data: QWProtect
Key: HKCR\AppID\QWProtect.DLL\
Value: AppID
Data: {29256442-2C14-48CA-B756-3EE0F8BDC774}
Key: HKCR\QWProtect.QWProtectBHO.1
Value: (Default)
Data: QWProtectBHO Class
Key: HKCR\QWProtect.QWProtectBHO.1\CLSID
Value: (Default)
Data: {70FEAD04-A7FD-4B89-B814-8A8251C90EF7}
Key: HKCR\QWProtect.QWProtectBHO
Value: (Default)
Data: QWProtectBHO Class
Key: HKCR\QWProtect.QWProtectBHO\CLSID
Value: (Default)
Data: {70FEAD04-A7FD-4B89-B814-8A8251C90EF7}
Key: HKCR\QWProtect.QWProtectBHO\CurVer
Value: (Default)
Data: QWProtect.QWProtectBHO.1
Key: HKCR\CLSID\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}
Value: (Default)
Data: QWProtectBHO Class
Key: HKCR\CLSID\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}\ProgID
Value: (Default)
Data: QWProtect.QWProtectBHO.1
Key: HKCR\CLSID\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}\VersionIndependentProgID
Value: (Default)
Data: QWProtect.QWProtectBHO
Key: HKCR\CLSID\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}\InprocServer32
Value: (Default)
Data: %AllUsersAppData%\gav\QWProtect.dll
Key: HKCR\CLSID\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}\InprocServer32
Value: ThreadingModel
Data: Apartment
Key: HKCR\CLSID\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}\TypeLib
Value: (Default)
Data: {512E801E-2F02-4ADE-ACAA-58F08A22B2F8}
Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}
Value: (Default)
Data: QWProtectBHO
Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7}
Value: NoExplorer
Data: 1
Key: HKCR\TypeLib\{512E801E-2F02-4ADE-ACAA-58F08A22B2F8}\1.0
Value: (Default)
Data: QWProtect 1.0 Type Library
Key: \TypeLib\{512E801E-2F02-4ADE-ACAA-58F08A22B2F8}\1.0\FLAGS
Value: (Default)
Data: 0
Key: HKCR\TypeLib\{512E801E-2F02-4ADE-ACAA-58F08A22B2F8}\1.0\0\win32
Value: (Default)
Data: %AllUsersAppData%\gav\QWProtect.dll
Key: HKCR\TypeLib\{512E801E-2F02-4ADE-ACAA-58F08A22B2F8}\1.0\HELPDIR
Value: (Default)
Data: %AllUsersAppData%\gav
Key: HKCR\Interface\{051C9A06-FB08-486F-B09B-8B33B261637D}
Value: (Default)
Data: IQWProtectBHO
Key: HKCR\Interface\{051C9A06-FB08-486F-B09B-8B33B261637D}\ProxyStubClsid
Value: (Default)
Data: {00020424-0000-0000-C000-000000000046}
Key: HKCR\Interface\{051C9A06-FB08-486F-B09B-8B33B261637D}\ProxyStubClsid32
Value: (Default)
Data: {00020424-0000-0000-C000-000000000046}
Key: HKCR\Interface\{051C9A06-FB08-486F-B09B-8B33B261637D}\TypeLib
Value: (Default)
Data: {512E801E-2F02-4ADE-ACAA-58F08A22B2F8}
Key: HKCR\Interface\{051C9A06-FB08-486F-B09B-8B33B261637D}\TypeLib
Value: Version
Data: 1.0
• svchost.exe
This program displays a fake "blue screen" crash screen, followed by a fake restart screen.
The file may be extracted from another file named wsdt05.exe or wsdt.exe. The installer also creates the following shortcut on the desktop:
C:\Documents and Settings\All Users\Desktop\Green AV.lnk
and a folder containing a start menu item:
C:\Documents and Settings\All Users\Start Menu\Programs\Green AV\ GreenAV.lnk
Additional Payloads - Green AV
Terminates Processes
Some variants install a batch file with a name such as wer.bat. This attempts to terminate the Windows Defender process MSASCui.exe. The installer may also create a registry entry such as the following to ensure that the batch file is run upon system startup:
Under key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Adds value: <digits> (eg “67569387646557683”)
With data: “%AllUsersAppData%\gav\wer.bat”
Other variants’ installers attempt to terminate processes from products such as Windows Defender, McAfee and Eset. These processes include the following:
MSASCui.exe
mcregist.exe
wmiprvse.exe
mcsysmon.exe
Mcshield.exe
McNASvc.exe
MpfSrv.exe
McSACore.exe
mcagent.exe
msksrver.exe
MpfSrv.exe
mcmscsvc.exe
McProxy.exe
nod32krn.exe
Note: Some variants also terminate iexplore.exe and firefox.exe during installation to ensure that the BHO is loaded when the browser is restarted.
Modifies Hosts File
The installer for some variants modifies the hosts file to redirect attempts to visit domains used by various PC review sites to a location such as 208.43.47.212. This may be an attempt to convince the user that the fake scanner has received positive reviews. One variant was observed to redirect the following domains:
a1.review.zdnet.com
reviews.riverstreams.co.uk
d1.reviews.cnet.com
review.2009softwarereviews.com
reviews.download.com
reviews.pcadvisor.co.uk
reviews.pcmag.com
reviews.pcpro.co.uk
reviews.techradar.com
toptenreviews.com
www.reevoo.com
Analysis by Shali Hsieh,
Hamish O'Dea, and David Wood
