Diskscanfa
Overview
Executive Summary
DiskScanFA is a classification for a specific family of Rogue Security Software, commonly referred to as "FakeAV" or "Scareware." It masquerades as a legitimate Windows disk scanning or antivirus utility. Its sole purpose is financial extortion: it deliberately displays fake system errors, non-existent virus infections, and fictitious hard drive failures to frighten the victim into purchasing a worthless "premium" license to fix the fabricated issues.Infection Vector and Technical Capabilities
DiskScanFA is primarily distributed via drive-by downloads, malvertising (malicious ads that redirect to fake scanner pages), or bundled heavily with pirated software. The infection often begins with a web page that looks like a "My Computer" window, falsely scanning the user's hard drive. Once installed on the endpoint, DiskScanFA employs aggressive extortion tactics:- UI Subversion and Harassment: The malware launches a highly convincing, albeit fake, graphical interface resembling a Microsoft security product. It continuously bombards the user with high-priority alerts claiming the hard drive is failing, RAM is corrupted, or severe rootkits have been detected.
- System Lockdown: To force payment, DiskScanFA often blocks legitimate applications from launching. It intercepts executable launches (`.exe`) and displays a fake alert claiming the application is infected and must be blocked until the "premium" version is purchased.
- Security Disablement: The malware modifies the Windows Registry to disable the Task Manager, Registry Editor, and legitimate antivirus software to prevent the user from manually terminating the rogue process.
Threat Assessment
While the primary goal is financial fraud (stealing credit card details during the fake purchase process), the presence of DiskScanFA severely disrupts business operations by locking down the workstation. Furthermore, the payload is often distributed by pay-per-install botnets, meaning the endpoint is highly likely infected with secondary, silent threats like Info-Stealers.Incident Response and Remediation
- Safe Mode Triage: Because the rogue software blocks application execution, incident responders must boot the infected machine into Windows "Safe Mode with Networking" to bypass the malware's autostart mechanisms.
- Registry and File Eradication: In Safe Mode, utilize a reputable, enterprise-grade anti-malware scanner to locate and delete the hidden executables (often in `%AppData%`) and revert the malicious registry modifications (specifically `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`).
- Credit Card Monitoring: If the user entered their credit card information into the fake software portal, they must immediately contact their bank, cancel the card, and monitor for fraudulent transactions.
Known aliases
Threat reports may refer to this family under multiple names:
MITRE ATT&CK Techniques
This family has been observed using the following ATT&CK techniques: T1489 T1112 T1562.001 T1490
Generated Detections (Boilerplate)
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
YARA Rule
rule MALWARE_WIN_DISKSCANFA {
meta:
description = "Detects Diskscanfa (advanced_threat)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "diskscanfa" ascii wide nocase
$s2 = "rogue.diskscanfa" ascii wide nocase
$s3 = "fakeav.diskscan" ascii wide nocase
$s4 = "win32/fakeav" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Sigma Rule
title: Suspicious Diskscanfa Activity
id: 77d9833cf6a8fe0fdb441fad75745aee
status: experimental
description: Detects generic indicators of the diskscanfa malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*diskscanfa*"
- "*rogue.diskscanfa*"
- "*fakeav.diskscan*"
- "*win32/fakeav*"
condition: selection
level: mediumReferences & External Analysis
- Search "diskscanfa" on VirusTotal (External Analysis)
Frequently Asked Questions
How do I remove the Diskscanfa Advanced_Threat from Windows?
Manual removal of Diskscanfa is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
Is Diskscanfa a virus or a Advanced_Threat?
Diskscanfa is classified as a Advanced_Threat. Unlike traditional viruses that infect files, modern malware like Diskscanfa typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.
What are the main symptoms of a Diskscanfa infection?
Symptoms of Diskscanfa can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Related Families (Category: advanced_threat)
Explore other malware families in the same category:
Protect Your Network Against Advanced_Threats
Want to prevent Diskscanfa and similar threats from compromising your organization? Read our comprehensive defensive guide: Suspect an Infection? What to do.
Machine-readable
Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/diskscanfa.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.