Win32/FakePlus is a rogue security program that falsely claims the user's system is infected and encourages the user to buy a promoted product in order 'remove' the bogus infections.
Installation
Win32/FakePlus may be downloaded and installed by additional malware. In the wild, it has been observed being downloaded and installed by
TrojanDownloader:Win32/Renos.BAO. Alternatively, the installation component may also be detected as Win32/FakePlus.Â
Â
The installer may display a series of installation dialogs as in the following examples:
Â
The following icon is also added to the system tray:
Â
The installer may download or drop the following files during the installation process:
Â
%windir%\system\rundll32.exe
%windir%\system\dop.exe
<system folder>\internetexplorer.dll
<system folder>\dmns.cfg
%program_files%\antivirus plus\antivirusplus.exe
%program_files%\antivirus plus\antivirusplus.grn
%USERPROFILE%\start menu\programs\antivirus plus\eula.lnk
%USERPROFILE%\start menu\programs\antivirus plus\antivirus plus.lnk
Â
It makes the following registry modification to ensure that FakePlus runs at each system start:
Â
Adds value: shell
With data: "%windir%\system\rundll32.exe"
To subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Â
It also makes the following modification:
Â
Sets value: (default)
With data: "<system folder>\internetexplorer.dll"
To subkey: HKLM\SOFTWARE\Classes\CLSID\{D032570A-5F63-4812-A094-87D007C23012}\InprocServer32
Â
During installation, Win32/Fakeplus may contact the following domain and download updates:
Payload
Displays False Alerts
Once installed on the system, Win32/FakePlus displays false reports of malware infection, even on a clean machine, as in the following example:
Â
Modifies System Security Settings
Win32/FakePlus makes the following registry modification to add itself as an exception to the Windows Firewall authorized application list, and avoid being filtered by the firewall when accessing the Internet:
Adds value: "%windir%\system\rundll32.exe"
With data: "%windir%\system\rundll32.exe:*:enabled:rundll32"
To subkey: HKLM\SYSTEM\ControlSet001Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
Â
Analysis by Francis Allan Tan Seng