Win32/FakeDef

Installation

This rogue may be downloaded by other malware. In the wild, we've observed it being downloaded by Win32/Fareit.

Win32/FakeDef checks to see if your computer is already infected with this threat, by checking if the following file exists on your computer:

%ALLUSERPROFILE%\pcdfdata\vl.bin

If it doesn't find this file, it contacts collectingtabletfriendly.info to report a new infection. From there, it downloads the following file and loads it into the current running process:

sublistsvirus.info/content/scc

It then drops the following files in the %APPDATA% folder:

• <malware>.exe
• app.ico - icon used by the malware
• config.bin - data file used by the malware
• defs.bin - data file
• support.ico - icon used by the malware
• uninst.ico - icon used by the malware
• vl.bin - encrypted downloaded file

The rogue creates a file association, by setting values under the following key, so that it will run each time you run an executable (.EXE) file.

HKCU\Software\Classes\.exe

Payload

Displays false/misleading malware alerts

When run, FakeDef performs a fake scan of your computer, and falsely claims that a number of files on your computer are infected with malware. Should you request that it clean the reported infections, it advises you that you need to pay money to register the program in order for it to do so.

Some examples of the interface, fake alerts, fake scanning results, and pop-ups displayed by Win32/FakeDef are shown below:

Blocks running processes

Win32/FakeDef blocks certain processes from running. If you try to run these, it displays the following message:

We have observed this rogue stopping any executable file (.EXE) from running, for example, taskmgr.exe.

Analysis by Shawn Wang