Win32/FakeVimes

Win32/FakeVimes is a family of programs that claims to scan for malware and displays fake warnings of "malicious programs and viruses". They then inform you that you need to pay money to register the software and remove these non-existent threats. Members of the Win32/FakeVimes family use various file names and system modifications that can differ from one variant to the next. Win32/FakeVimes has been distributed with several different names. The user interface and some other details vary to reflect each variant's individual branding.

Recent variants at the time of publication have used the following names:

• Advanced Antispyware Solution
• Antimalware PC Safety
• Antivirus Smart Protection
• AV Security Essentials
• Best Antivirus Software
• Best Virus Protection
• Home Malware Cleaner
• Home Security Solutions
• Internet Security Guard
• Malware Protection Center
• Smart Anti-Malware Protection
• Strong Malware Defender
• System Protection Tools
• Total Anti Malware Protection

Older variants have used names like the following:

• Best Malware Protection
• Cleanup Antivirus
• Extra Antivirus
• Live PC Care
• Malware Catcher 2009
• My Security Engine
• My Security Shield
• My Security Wall
• Paladin Antivirus
• Security Antivirus
• Security Guard
• Security Master AV
• Smart Engine
• Ultra Antivirus 2009
• Virus Melt
• Windows PC Defender

Installation

Win32/FakeVimes is installed by a downloader, which might also be detected as Rogue:Win32/FakeVimes. This downloads an encrypted copy of the fake scanner, which it decrypts and writes to <commonappdata>\<five random hexadecimal digits>\<first two initials of product name><three random hexadecimal digits>_<four random decimal digits>.exe. An example location for Best Antivirus Software might be <commonappdata>\54fd6\BA3b8_8068.exe. It then launches the fake scanner.

It might copy itself to <commonappdata>\<five random hexadecimal digits>\<first two initials of product name><random digits>.exe (for example, Total Anti Malware Protection might copy itself to <commonappdata>\54fd6\TA239.exe).

It then creates a registry entry so that this copy is run each time Windows starts:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "<product name>"
With data: "<location of malware>" /s /d"

For example, Total Anti Malware Protection creates the following entry:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "Total Anti Malware Protection"
With data: "<location of malware>" /s /d" (for example, "<commonappdata>\54fd6\TA239.exe" /s /d)

While Best Antivirus Software creates the following:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "Best Antivirus Software"
With data: "<location of malware>" /s /d" (for example, "<commonappdata>\54fd6\BA3b8_8068.exe" /s /d)

It drops an icon file <Product initials>.ico to the same directory as the copied malware (for example, Total Anti Malware Protection might create a file like "<commonappdata>\54fd6\TAMP.ico", while Best Antivirus Software would create "BAS.ico"). It also creates empty folders "Quarantine Items" and "<Product initials>Sys" (for example, TAMPSys or BASSys) under the same folder as the original copy of the scanner.

It creates a desktop shortcut at <desktop folder>\<Product name>.lnk (for example, <desktop folder>\Total Anti Malware Protection.lnk)

Note that the icons used by the malware differ for each product name. Below are the icons used by Best Antivirus Software, Live PC Care and Security Antivirus:

It adds an item to the Start Menu by creating a file at <start menu>\<Product Name>.lnk (for example, <start menu>\Total Anti Malware Protection.lnk)

It adds an item to the Programs Menu by creating an file at %ProgramFiles%\<Product name>.lnk (for example, %ProgramFiles%\Best Antivirus Software.lnk).

It adds an icon to the Quick Launch bar by creating a file at %APPDATA%\Microsoft\Internet Explorer\Quick Launch\<Product name>.lnk.

It then creates a configuration file in a location like <commonappdata>\<first two product initials><random letters>\<first two product initials><different random letters>.cfg (for example, for Best Antivirus Software<commonappdata>\BAZUVONHOS\BAUTS.cfg).

It creates a number of small junk files in the %USERPROFILE%\Recent directory, which it can report as infected when doing its fake scan. These files are harmless by themselves.

Payload

Displays fake scanner

The malware masquerades as an antivirus scanner, and displays a number of windows, dialog boxes and system tray pop-ups by trying to convince you that you are infected. This appears to be an attempt to replicate the appearance of Microsoft Security Essentials. Earlier versions instead try to replicate the Windows Security Center. See the Additional information section below for images of these earlier versions.

If you try to remove the listed threats, you will be taken to a webpage informing you that you must pay to register the scanner.

Adds details to Security Center

The malware adds its details to the legitimate Security Center by dropping a file named <four digit random number>.mof (for example, 5668.mof) to the directory in which it is running, and then launching a system tool using this file as input. It adds itself as both the Antivirus Product and Firewall Product:

Changes Hosts file

FakeVimes changes the Windows Hosts file. The local Hosts file overrides the DNS resolution of a website URL to a particular IP address. Malware might make changes to the Hosts file to redirect specified URLs to different IP addresses. Malware often changes a PC's Hosts file to stop users from accessing websites associated with particular security-related applications (like antivirus programs, for example).

FakeVimes tries to change the Hosts file at %windir%\drivers\etc\hosts to remove entries like the following if they are present:

• 64.86.17.32
• secure1.bestscansystems.com
• www5.total-anti-malware-protection.com
• safe-pay-vault.com
• secure-softsales-discount.com
• secure.securepay-processor.com
• vsoftstore.com
• webpayvault.com

These entries might have been added earlier (by competing malware, for instance, or even by another security-conscious administrator) to prevent you from visiting the websites of Win32/FakeVimes or its payment gateways.

Some variants of Win32/FakeVimes have also been reported to add additional entries to the Hosts file to block access to security related websites, or redirect visits to search pages to sites of the malware's choosing. For example, some variants redirect the following pages:

• 4-open-davinci.com
• au.search.yahoo.com
• bing.com
• ca.search.yahoo.com
• de.search.yahoo.com
• fr.search.yahoo.com
• getantivirusplusnow.com
• getavplusnow.com
• google-analytics.com
• google.be
• google.ca
• google.ch
• google.co.jp
• google.co.nz
• google.co.uk
• google.co.za
• google.com
• google.com.au
• google.com.br
• google.de
• google.dk
• google.fr
• google.ie
• google.it
• google.nl
• google.no
• google.pl
• google.se
• paysoftbillsolution.com
• privatesecuredpayments.com
• protected.maxisoftwaremart.com
• safebrowsing-cache.google.com
• search.live.com
• search.msn.com
• search.yahoo.com
• secure-plus-payments.com
• secure.paysecuresystem.com
• secure.privatesecuredpayments.com
• securesoftwarebill.com
• securitysoftwarepayments.com
• uk.search.yahoo.com
• urs.microsoft.com

to locations like the following:

• 206.53.61.77
• 74.125.45.100
• 94.228.209.236

Monitors browser traffic

The malware creates the following registry entry, which causes Internet Explorer to use a web proxy on the local PC.

In subkey: HKCU\Software\Microsoft\Internet Explorer
Sets value: "PRS"
With data: "hxxp://127.0.0.1:27777/?inj=%ORIGINAL%"

It then listens on port 27777 for the proxied web traffic. Should it find pages that it does not want you to view, it might block access to this content, or close browser tabs or windows. Should access be blocked, it might display a page like the following:

Changes default search page

The malware tries to alter the default search page for Internet Explorer by creating a registry entry like the following:

In subkey: HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes
Sets value: "URL"
With data: "hxxp://findgala.com/?&uid=8068&q={searchTerms}"

Changes security settings

It creates the following registry entries to try and let Internet Explorer run unsigned or incorrectly signed executables without displaying a warning:

In subkey: HKCU\Software\Microsoft\Internet Explorer\Download
Sets value: "CheckExeSignatures"
With data: "no"
Sets value: "RunInvalidSignatures"
With data: "1"

It might try to let itself access through Windows Firewall by creating the following registry entry:

In subkey: HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
Sets value: "<location of malware>" (for example, <commonappdata>\54fd6\BA3b8_8068.exe)
With data: "<location of malware>:*:Enabled:<Product Name>" (for example, <commonappdata>\54fd6\BA3b8_8068.exe:*:Enabled:Best Antivirus Software)

Some variants might also add the following:

In subkey: HKLM\System\CurrentControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
Sets value: <location of malware> (for example, <commonappdata>\54fd6\BA3b8_8068.exe)
With data: "<location of malware>:*:Enabled:<Product Name>" (for example, <commonappdata>\54fd6\BA3b8_8068exe:*:Enabled:Best Antivirus Software)

If the PC is running Windows Vista or later, FakeVimes might also temporarily change the registry entries below, to let the Hosts file changes above to be made without a UAC (User Account Control) warning being displayed. After it has doed the changes, it might increase the security on these entries, but might use values other than the ones originally used.

In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Changes value: "ConsentPromptBehaviorAdmin"
Changes value: "ConsentPromptBehaviorUser"
Changes value: "EnableLUA"

Changes browser settings

FakeVimes changes your PC's browser settings by making the following changes to the registry:

In subkey: HKCU\Software\Microsoft\Internet Explorer
Sets value: "IIL"
With data: "0"
Sets value: "ltHI"
With data: "0"
Sets value: "ltTST"
With data: <five digit number> (for example, 20212)

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Sets value: "UID"
With data: <four digit identifier> (for example, 8068)

It also creates registry entries similar to the following, which add additional information to the string that a web browser uses to identify itself when connecting to a website:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
Sets value: <12 digit number> (for example, 786905932603)
With data: ""

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
Sets value: "ver:2.0<four digit identifier>" (for example, ver:2.08068)
With data: ""

Prevents programs from running

The malware tries to prevent a number of executables associated with Microsoft Security Essentials, Windows Defender, as well as E-set and AVG antivirus products from running. It does so by creating the following registry entries:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Sets value: "DisletRun"
With data: "1"

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisletRun
Sets value: "0"
With data: "msseces.exe"
Sets value: "1"
With data: "MSASCui.exe"
Sets value: "2"
With data: "ekrn.exe"
Sets value: "3"
With data: "egui.exe"
Sets value: "4"
With data: "avgnt.exe"
Sets value: "5"
With data: "avcenter.exe"
Sets value: "6"
With data: "avscan.exe"
Sets value: "7"
With data: "avgfrw.exe"
Sets value: "8"
With data: "avgui.exe"
Sets value: "9"
With data: "avgtray.exe"
Sets value: "10"
With data: "avgscanx.exe"
Sets value: "11"
With data: "avgcfgex.exe"
Sets value: "12"
With data: "avgemc.exe"
Sets value: "13"
With data: "avgchsvx.exe"
Sets value: "14"
With data: "avgcmgr.exe"
Sets value: "15"
With data: "avgwdsvc.exe"

The malware also tries to prevent a number of other programs from running, by setting the harmless system process "svchost.exe" as a debugger for these programs. This means that when you try to launch one of these programs, svchost.exe is run instead of the program that you want to run.

In subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<file name of blocked program>
Sets value: "Debugger"
With data: "svchost.exe"

for example:

In subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe
Sets value: "Debugger"
With data: "svchost.exe"

It does this for the following diagnostic or security-related security programs:

_ avp32.exe _avpcc.exe _avpm.exe a.exe aAvgApi.exe AAWTray.exe About.exe ackwin32.exe Ad-Aware.exe adaware.exe advxdwin.exe agentsvr.exe agentw.exe alertsvc.exe alevir.exe alogserv.exe AluSchedulerSvc.exe amon9x.exe anti-trojan.exe antivirus.exe ants.exe apimonitor.exe aplica32.exe apvxdwin.exe arr.exe Arrakis3.exe ashAvast.exe ashBug.exe ashChest.exe ashCnsnt.exe ashDisp.exe ashLogV.exe ashMaiSv.exe ashPopWz.exe ashQuick.exe ashServ.exe ashSimp2.exe ashSimpl.exe ashSkPcc.exe ashSkPck.exe ashUpd.exe ashWebSv.exe aswChLic.exe aswRegSvr.exe aswRunDll.exe aswUpdSv.exe atcon.exe atguard.exe atro55en.exe atupdater.exe atwatch.exe au.exe aupdate.exe auto-protect.nav80try.exe autodown.exe autotrace.exe autoupdate.exe avadmin.exe avcenter.exe avciman.exe avconfig.exe avconsol.exe ave32.exe AVENGINE.EXE avgcc32.exe avgchk.exe avgcmgr.exe avgcsrvx.exe avgctrl.exe avgdumpx.exe avgemc.exe avgiproxy.exe avgnsx.exe avgnt.exe avgrsx.exe avgscanx.exe avgserv.exe avgserv9.exe avgsrmax.exe avgtray.exe avgui.exe avgupd.exe avgw.exe avgwdsvc.exe avkpop.exe avkserv.exe avkservice.exe avkwctl9.exe avltmain.exe avmailc.exe avmcdlg.exe avnotify.exe avnt.exe avp32.exe avpcc.exe avpdos32.exe avpm.exe avptc32.exe avpupd.exe avsched32.exe avsynmgr.exe avupgsvc.exe AVWEBGRD.EXE avwin.exe avwin95.exe avwinnt.exe avwsc.exe avwupd.exe avwupd32.exe avwupsrv.exe avxmonitor9x.exe avxmonitornt.exe avxquar.exe b.exe backweb.exe bargains.exe bd_professional.exe bdagent.exe bdfvcl.exe bdfvwiz.exe BDInProcPatch.exe bdmcon.exe BDMsnScan.exe bdreinit.exe bdsubwiz.exe BDSurvey.exe bdtkexec.exe bdwizreg.exe beagle.exe belt.exe bidef.exe bidserver.exe bipcp.exe bipcpevalsetup.exe bisp.exe blackd.exe blackice.exe blink.exe blss.exe bootconf.exe bootwarn.exe borg2.exe bpc.exe brasil.exe brw.exe bs120.exe bspatch.exe bundle.exe bvt.exe c.exe cavscan.exe ccapp.exe ccevtmgr.exe ccpxysvc.exe ccSvcHst.exe cdp.exe cfd.exe cfgwiz.exe cfiadmin.exe cfiaudit.exe cfinet.exe cfinet32.exe cfp.exe cfpconfg.exe cfplogvw.exe cfpupdat.exe claw95.exe claw95cf.exe clean.exe cleaner.exe cleaner3.exe cleanIELow.exe cleanpc.exe click.exe cmd32.exe cmdagent.exe cmesys.exe cmgrdian.exe cmon016.exe connectionmonitor.exe control cpd.exe cpf9x206.exe cpfnt206.exe crashrep.exe cssconfg.exe cssupdat.exe cssurf.exe ctrl.exe cv.exe cwnb181.exe cwntdwmo.exe d.exe datemanager.exe dcomx.exe defalert.exe defscangui.exe defwatch.exe deloeminfs.exe deputy.exe divx.exe dllcache.exe dllreg.exe doors.exe dpf.exe dpfsetup.exe dpps2.exe driverctrl.exe drwatson.exe drweb32.exe drwebupw.exe dssagent.exe dvp95.exe dvp95_0.exe ecengine.exe efpeadm.exe egui.exe ekrn.exe emsw.exe ent.exe esafe.exe escanhnt.exe escanv95.exe espwatch.exe ethereal.exe etrustcipe.exe evpn.exe exantivirus-cnet.exe exe.avxw.exe expert.exe explore.exe f-agnt95.exe f-prot.exe f-prot95.exe f-stopw.exe fact.exe

fameh32.exe fast.exe fch32.exe fih32.exe findviru.exe firewall.exe fixcfg.exe fixfp.exe fnrb32.exe fp-win.exe fp-win_trial.exe fprot.exe frw.exe fsaa.exe fsav.exe fsav32.exe fsav530stbyb.exe fsav530wtbyb.exe fsav95.exe fsgk32.exe fsm32.exe fsma32.exe fsmb32.exe gator.exe gbmenu.exe gbpoll.exe generics.exe gmt.exe guard.exe guarddog.exe guardgui.exe hacktracersetup.exe hbinst.exe hbsrv.exe History.exe hotactio.exe hotpatch.exe htlog.exe htpatch.exe hwpe.exe hxdl.exe hxiul.exe iamapp.exe iamserv.exe iamstats.exe ibmasn.exe ibmavsp.exe icload95.exe icloadnt.exe icmon.exe icsupp95.exe icsuppnt.exe Identity.exe idle.exe iedll.exe iedriver.exe IEShow.exe iface.exe ifw2000.exe inetlnfo.exe infus.exe infwin.exe init.exe install.exe install[1].exe install[2].exe install[3].exe install[4].exe install[5].exe intdel.exe intren.exe iomon98.exe istsvc.exe jammer.exe jdbgmrg.exe jedi.exe JsRcGen.exe kavlite40eng.exe kavpers40eng.exe kavpf.exe kazza.exe keenvalue.exe kerio-pf-213-en-win.exe kerio-wrl-421-en-win.exe kerio-wrp-421-en-win.exe killprocesssetup161.exe ldnetmon.exe ldpro.exe ldpromenu.exe ldscan.exe licmgr.exe livesrv.exe lnetinfo.exe loader.exe localnet.exe lockdown.exe lockdown2000.exe lookout.exe lordpe.exe lsetup.exe luall.exe luau.exe lucomserver.exe luinit.exe luspt.exe mapisvc32.exe mcagent.exe mcmnhdlr.exe mcmscsvc.exe mcnasvc.exe mcproxy.exe McSACore.exe mcshell.exe mcshield.exe mcsysmon.exe mctool.exe mcupdate.exe mcvsrte.exe mcvsshld.exe md.exe mfin32.exe mfw2en.exe mfweng3.02d30.exe mgavrtcl.exe mgavrte.exe mghtml.exe mgui.exe minilog.exe mmod.exe monitor.exe moolive.exe mostat.exe mpfagent.exe mpfservice.exe MPFSrv.exe mpftray.exe mrflux.exe mrt.exe msa.exe msapp.exe MSASCui.exe msbb.exe msblast.exe mscache.exe msccn32.exe mscman.exe msconfig msdm.exe msdos.exe msfwsvc.exe msiexec16.exe mslaugh.exe msmgt.exe MsMpEng.exe msmsgri32.exe msseces.exe mssmmc32.exe mssys.exe msvxd.exe mu0311ad.exe mwatch.exe n32scanw.exe nav.exe navap.navapsvc.exe navapsvc.exe navapw32.exe navdx.exe navlu32.exe navnt.exe navstub.exe navw32.exe navwnt.exe nc2000.exe ncinst4.exe ndd32.exe neomonitor.exe neowatchlog.exe netarmor.exe netd32.exe netinfo.exe netmon.exe netscanpro.exe netspyhunter-1.2.exe netutils.exe nisserv.exe nisum.exe nmain.exe nod32.exe normist.exe norton_internet_secu_3.0_407.exe notstart.exe npf40_tw_98_nt_me_2k.exe npfmessenger.exe nprotect.exe npscheck.exe npssvc.exe nsched32.exe nssys32.exe nstask32.exe nsupdate.exe nt.exe ntrtscan.exe ntvdm.exe ntxconfig.exe nui.exe nupgrade.exe nvarch16.exe nvc95.exe nvsvc32.exe nwinst4.exe nwservice.exe nwtool16.exe OAcat.exe OAhlp.exe OAReg.exe oasrv.exe oaui.exe oaview.exe OcHealthMon.exe ODSW.exe ollydbg.exe OLT.exe onsrvr.exe optimize.exe ostronet.exe otfix.exe outpost.exe outpostinstall.exe outpostproinstall.exe padmin.exe panixk.exe patch.exe pavcl.exe PavFnSvr.exe pavproxy.exe pavprsrv.exe

pavsched.exe pavsrv51.exe pavw.exe pccwin98.exe pcfwallicon.exe pcip10117_0.exe pcscan.exe pctsGui.exe pdsetup.exe periscope.exe persfw.exe perswf.exe pf2.exe pfwadmin.exe pgmonitr.exe pingscan.exe platin.exe pop3trap.exe poproxy.exe popscan.exe portdetective.exe portmonitor.exe powerscan.exe ppinupdt.exe pptbc.exe ppvstop.exe prizesurfer.exe prmt.exe prmvr.exe procdump.exe processmonitor.exe procexplorerv1.0.exe programauditor.exe proport.exe protectx.exe PSANCU.exe PSANHost.exe PSANToManager.exe PsCtrls.exe PsImSvc.exe PskSvc.exe pspf.exe PSUNMain.exe purge.exe qconsole.exe qserver.exe rapapp.exe rav7.exe rav7win.exe rav8win32eng.exe ray.exe rb32.exe rcsync.exe realmon.exe reged.exe regedt32.exe rescue.exe rescue32.exe rrguard.exe rscdwld.exe rshell.exe rtvscan.exe rtvscn95.exe rulaunch.exe safeweb.exe sahagent.exe Save.exe savenow.exe sbserv.exe sc.exe scam32.exe scan32.exe scan95.exe scanpm.exe scrscan.exe seccenter.exe serv95.exe setloadorder.exe setup_flowprotector_us.exe setupvameeval.exe sgssfw32.exe sh.exe shellspyinstall.exe shield.exe shn.exe showbehind.exe signcheck.exe smc.exe sms.exe smss32.exe snetcfg.exe soap.exe sofi.exe sperm.exe spf.exe sphinx.exe spoler.exe spoolcv.exe spoolsv32.exe spyxx.exe srexe.exe srng.exe ss3edit.exe ssg_4104.exe ssgrate.exe st2.exe start.exe stcloader.exe supftrl.exe support.exe supporter5.exe svc.exe svchostc.exe svchosts.exe svshost.exe sweep95.exe sweepnet.sweepsrv.sys.swnetsup.exe symlcsvc.exe symproxysvc.exe symtray.exe system.exe system32.exe sysupd.exe taskmgr.exe taumon.exe tbscan.exe tc.exe tca.exe tcm.exe tds-3.exe tds2-98.exe tds2-nt.exe teekids.exe tfak.exe tfak5.exe tgbob.exe titanin.exe titaninxp.exe TPSrv.exe trickler.exe trjscan.exe trjsetup.exe trojantrap3.exe tsadbot.exe tvmd.exe tvtmd.exe uiscan.exe undoboot.exe updat.exe upgrad.exe upgrepl.exe utpost.exe vbcmserv.exe vbcons.exe vbust.exe vbwin9x.exe vbwinntw.exe vcsetup.exe vet32.exe vet95.exe vettray.exe vfsetup.exe vir-help.exe virusmdpersonalfirewall.exe VisthAux.exe VisthLic.exe VisthUpd.exe vnlan300.exe vnpc3000.exe vpc32.exe vpc42.exe vpfw30s.exe vptray.exe vscan40.exe vscenu6.02d30.exe vsched.exe vsecomr.exe vshwin32.exe vsisetup.exe vsmain.exe vsmon.exe vsserv.exe vsstat.exe vswin9xe.exe vswinntse.exe vswinperse.exe w32dsm89.exe w9x.exe watchdog.exe webdav.exe WebProxy.exe webscanx.exe webtrap.exe wfindv32.exe whoswatchingme.exe wimmun32.exe win-bugsfix.exe win32.exe win32us.exe winactive.exe window.exe windows.exe wininetd.exe wininitx.exe winlogin.exe winmain.exe winppr32.exe winrecon.exe winservn.exe winss.exe winssk32.exe winssnotify.exe WinSSUI.exe winstart.exe winstart001.exe wintsk32.exe winupdate.exe wkufind.exe wnad.exe wnt.exe wradmin.exe wrctrl.exe wsbgate.exe wscfxas.exe wscfxav.exe wscfxfw.exe wsctool.exe wupdater.exe wupdt.exe wyvernworksfirewall.exe xpf202en.exe zapro.exe zapsetup3001.exe zatutor.exe zonalm2601.exe zonealarm.exe

It also does the same for the following files used by other rogue antivirus software:

AdwarePrj.exe agent.exe AlphaAV AlphaAV.exe Anti-Virus Professional.exe AntispywarXP2009.exe AntiVirus_Pro.exe AntivirusPlus AntivirusPlus.exe AntivirusPro_2010.exe AntivirusXP AntivirusXP.exe antivirusxppro2009.exe av360.exe AVCare.exe brastk.exe Cl.exe csc.exe dop.exe frmwrk32.exe gav.exe gbn976rl.exe homeav2010.exe

init32.exe MalwareRemoval.exe ozn695m5.exe pav.exe pc.exe PC_Antispyware2010.exe pctsAuxs.exe pctsGui.exe pctsSvc.exe pctsTray.exe pdfndr.exe PerAvir.exe personalguard personalguard.exe protector.exe qh.exe Quick Heal.exe QuickHealCleaner.exe rwg rwg.exe SafetyKeeper.exe Save.exe SaveArmor.exe

SaveDefense.exe SaveKeep.exe Secure Veteran.exe secureveteran.exe Security Center.exe SecurityFighter.exe securitysoldier.exe smart.exe smartprotector.exe smrtdefp.exe SoftSafeness.exe spywarexpguard.exe tapinstall.exe TrustWarrior.exe tsc.exe W3asbas.exe winav.exe windll32.exe windows Police Pro.exe xp_antispyware.exe xpdeluxe.exe ~1.exe ~2.exe

Additional information

Older variants of FakeVimes might display images like the following:

Analysis by David Wood and Ray Roberts