McAfee Labs Threat Advisory FakeAlert System Defender

Transcription

1 McAfee Labs Threat Advisory FakeAlert System Defender June 15, 2011 Summary FakeAlert System Defender Trojan is software that masquerades as a legitimate security application purely to make money for its developer. Currently, System Defender is one of the most prevalent FakeAlert threat families. This particular application creates a fake hardware failure message to scare the users and instigate the procurement of a license. Aliases: FakeSysdef FakeAlert-HDD FraudLoad Dapato Detailed information about the worm, its propagation, and mitigation are in the following sections: Infection and Propagation Vectors Characteristics and Symptoms Restart Mechanism Getting Help from the McAfee Foundstone Services team Infection and Propagation Vectors FakeAlert families are commonly found to be installed by other trojan downloaders. These trojans usually arrive as attachments, or via drive-by-download attacks exploiting vulnerabilities in Windows and third-party applications. Mitigation Users should be cautious with suspicious attachments. Users should apply the latest security patches for Windows and third-party applications including the following, which are popular targets: Internet Explorer Microsoft Office (Excel, Word, PowerPoint, etc.) Adobe Reader Java Flash Player RealPlayer QuickTime

2 Characteristics and Symptoms Description Upon execution, FakeAlert-SysDef copies itself to the following paths: %ALLUSERSPROFILE%\Application Data\ [A-Z]{7}[0-9]{5}\ [A-Z]{7}[0-9]{5}.exe %USERPROFILE%\Local Settings\Temp\tmp[random].tmp (Where %UserProfile% is the Windows user profile folder, e.g. C:\Documents and Settings\(User), and %ALLUSERSPROFILE% is the Windows all users profile folder, e.g. C:\Documents and Settings\AllUsers.) For example: C:\Documents and Settings\All Users\Application Data\WyIE0SaAdnFPj.exe FakeAlert-SysDef evolves its appearance and may present itself using one of the following graphical user interfaces: Windows XP Recovery

3 Windows Recovery Once the scan finish and the user go to the option Fix Error the malware will simulate the process or fixing and repairing the hard drive but showing fake error messages: Fix Error

4 FakeAlert-SysDef periodically will also show some of the following errors to scare the user: Critical Hard Disk Drive Error Critical Hard Drive Failure Delayed Write Field: If the activation code is not entered, FakeAlert-SysDef can also perform a reboot in order to fake a hardware failure. Once the system is up again, all the Start Menu and Desktop shortcuts will be hidden:

5 Hiding Start Menu and Desktop shortcuts Also FakeAlert-SysDef disables the Task Manager, change the Wallpaper and disable the controls to change it again: Finally, most of the icons in all the drives will be recursevily hidden (file attributes are going to be changed) and, periodically, it will change the file attributes again by executing the command Attrib +h C:\*.* /s /d :

6 Network Connection: Recent variants attempt to establish HTTP connections to the following domain names upon infection and should be blocked at the desktop and/or a perimeter firewall: Searchanswer.org Searchallow.org Searchatmo.org Searchbeginning.org Clickwet,org Findchest.org Searchalphabet.org Clickdesmoines.org Mitigation Using VirusScan Enterprise Access Protection Rules: FakeAlert-SysDef usually installs itself into the Application Data folders. Users can configure and test Access Protection Rules to restrict the creation of new files and folders when there are no other legitimate uses. Select New files being created and include the following folders: %UserProfile%\Application Data %UserProfile%\Local Settings\Application Data %ALLUSERSPROFILE%\Application Data\ %ALLUSERSPROFILE%\Local Settings\Application Data

7 Where possible, it is also recommended to select and test Files being executed for the above folders and add only known legitimate programs under the Application Data folder to Process to exclude. You should first test these rules to verify that there are no other legitimate applications that need to write to these folders. Updating VirusScan DAT files McAfee Labs updates the daily DAT files to detect the newest variants of FakeAlert. Network Mitigation Block access to the domain names associated with FakeAlert-SysDef. Restart Mechanism FakeAlert-SysDef creates a Run registry key to start itself every time the system is started: For example: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run [A-Z]{7}[0-9]{5} = (filepath) HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run FVHAXclnXknQk="C:\Documents and Settings\All Users\Application Data\lHfHkLn06308\FVHAXclnXknQk.exe" It can also drop additional shortcut files: For example: C:\Documents and Settings\Administrator\Desktop\Windows Recovery.lnk C:\Documents and Settings\Administrator\Start Menu\Programs\Windows Recovery\Uninstall Windows Recovery.lnk C:\Documents and Settings\Administrator\Start Menu\Programs\Windows Recovery\Windows Recovery.lnk Getting Help from the McAfee Foundstone Services team This document is intended to provide a summary of current intelligence and best practices to ensure the highest level of protection from your McAfee security solution. The McAfee Foundstone Services team offers a full range of strategic and technical consulting services that can further help to ensure you identify security risk and build effective solutions to remediate security vulnerabilities. You can reach them here: McAfee, Inc. All rights reserved.