Late last year, we talked about how fake system diagnostic tools were becoming the next step in the evolution of FAKEAV malware. These variants started to affect Japanese users as well.

Fake system diagnostic tools such as this variant named System Defragmenter were first discovered in October 2010. These tools very frequently change their names. At present, we are aware of at least 30 different names/aliases that these tools use. Cybercriminals may believe that changing their products’ names makes detecting and removing these much more difficult.

None of this should be taken to mean that conventional fake antivirus attacks have gone away, however. Last week, a very high-profile attack involving a rogue antivirus detected by Trend Micro as TROJ_FAKEAV.SMTV hit Twitter. Many users fell prey to this when they clicked links that used the goo.gl URL shortener to lead to this FAKEAV variant’s download.

Attacks involving fake diagnostic tools are similar to traditional FAKEAV attacks. A fake tool appears to function like a real system diagnosis tool though its supposed diagnostic functions never work. Once users’ PCs are infected by such a tool, these repeatedly displayed fake warnings saying that the system is suffering from hard disk problems.

Inexperienced users may worry and panic over these problems. They may end up paying for additional “tools” and giving cybercriminals their personal information such as email addresses and credit card numbers. Like FAKEAV, these fake diagnosis tools will cause many problems for users.

Infection Vectors

Fake diagnostic tools may arrive via several different infection vectors:

• Users visit malicious sites and manually download and install malicious files.
• Users visit malicious sites that are riddled with exploits, which silently install malicious files in the background.

The tactics cybercriminals use to distribute fake diagnostic tools are broadly similar to those used for FAKEAV malware. Cybercriminals may lead users to their own sites by using Black Hat Search Engine Optimization (SEO) poisoning or to compromised legitimate sites. Cases where these fake tools are installed without the users’ knowledge may lead them to think the fake tools are actually legitimate programs, allowing the attacks to succeed.

System Defragmenter is detected as TROJ_FAKEAL.GG. While the sites that distribute it are now inaccessible, similar attacks did not stop from being launched, albeit using constantly changing names and sites. Understanding how these attacks are conducted will help users avoid becoming their victims.

Its installer uses the same icon as Windows Update.

Fourteen minutes after the tool is installed, it displays a fake alert in the user’s notification area.

The following gallery shows the various fake images that this malware displays:

Here are some of the other names the fake diagnostic tools use:

• Check Disk
• Defragmenter
• Disk Doctor
• Disk Optimizer
• Disk Repair
• DiskOK
• EasyScan
• FastDisk
• GoodMemory
• Hard Drive Diagnostic
• HDDControl
• HDDDefragmenter
• HDDDiagnostic
• HDDFix
• HDDHelp
• HDDPlus
• HDDLow
• HDDRecovery
• HDDRepair
• HDDRescue
• HDDTools
• MemoryFixer
• MyDisk
• QuickDefrag
• Scan Disk
• Scanner
• Smart HDD
• Support Tool 2011
• System Degragmenter
• Ultra Defragger
• Win Defrag
• Win Defragmenter
• Win Scanner

Solutions and Workarounds

Trend Micro free tools can clean systems that have been affected by System Defragmenter. However, users have to first go around one of this malware’s behaviors—monitoring the execution of applications—so that some security tools like HijackThis as well as files in the C:\Windows and C:\Program Files folder will not run and instead display the following:

Users will have to terminate the malware process first. The procedure starts by determining the file name that malware used. To do this, follow these steps:

1. Right-click the shortcut (System Defragmenter) on the desktop and select Properties.
2. Check and note the file name, which is usually made up of random characters. In the following screenshot, the file name used was 1181500.exe.

After taking note of the file name, open Task Manager by pressing Ctrl+Alt+Delete and use it to terminate the fake tool’s process.

Using HijackThis, take note of any or all of the registry entries that the malware added. HijackThis can then remove these entries to stop the malware from running whenever the system starts. (The suspicious entries have been enclosed in a red box.)

Our online scanner HouseCall can then be used to scan and remove the malware from the system.

Post from: TrendLabs | Malware Blog – by Trend Micro

Fake System Tools Spread to Japan

Full story: TrendLabs | Malware Blog – by Trend Micro

• 3 Tools to Scan the File System With Custom Malware Signatures
  When analyzing malware discovered during a security incident, the investigator often formulates indicators of compromise (IOCs): the signs of infection that can help the enterprise determine what sys...
• Fake System Optimizer with special messages
  When analyzing malware, we often look for strings within the malware samples. Those give some interesting insights about the malware, its creators or the targets, for example. While poking into a fake...
• Beware of Japan fake quake relief scams !
  The Federal Bureau of Investigation has asked the public to beware of Japan quake relief scams, WKYC reports. The report provides ten tips to help identify fake 'charity' efforts, as under: 1. Don...
• Fake MoviStar Emails Spread Malware
  My colleague Josep Albors flagged this issue on the Ontinet blog a little earlier today. I've flagged it here as it's likely that there are similar messages carrying the same malware circulating in la...
• Malicious Spam on the increase again
  Malware distribution via email is far from dead.  While we had a distinctly quiet period from October 2010 to March 2011, our stats show the bot herders are gearing up again with the proportion o...
• The Royal Wedding and The Fake Antivirus
  The Royal Wedding of Prince William and Catherine Middleton that will be held tomorrow, on April 29, will attract the attention of many people around the world, and has become a trending topic on vari...
• Fake AV for mobile platform
  We have seen countless number of rogue security products for Windows platform however this one is targeted to trick mobile users.The sample masquerades itself as a certain AV for mobile and ...
• Hundreds of College and Government websites still redirecting to fake stores
  In January, I talked about high-profile websites, which had been hacked to redirect users to fake online stores. One unique aspect of the hack was the fact that the attackers had set up additional web...
• Fake Certificate in Malware – with Message
  The malware authors every now and then send us virus researchers some messages. For example in the compiled binary itself, or as debug output. Now we found a Zbot Trojan variant which tries to evade d...
• Fake AV served up by phony NACHA emails
  A little while ago, phishing mails claiming to be from NACHA were in circulation - it seems the phishers have had enough of that, deciding to send out malicious files instead. The mail claims an att...