➔
search
✕

ADW_OPENTAB

April 01, 2013
 Analysis by: Christopher Daniel So
 ALIASES:

Adware.Popuppers (Symantec)

 PLATFORM:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

 OVERALL RISK RATING:
 REPORTED INFECTION:
 SYSTEM IMPACT RATING:
 INFORMATION EXPOSURE:

  • Threat Type: Adware

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

This adware may arrive bundled with malware packages as a malware component. It may be manually installed by a user.

  TECHNICAL DETAILS

File Size:

Varies

File Type:

EXE, DLL

Memory Resident:

Yes

Initial Samples Received Date:

31 Mar 2013

Arrival Details

This adware may arrive bundled with malware packages as a malware component.

It may be manually installed by a user.

Installation

This adware drops the following file(s)/component(s):

  • %Program Files%\OpenTab\catedomain.dt
  • %Program Files%\OpenTab\category.dat
  • %Program Files%\OpenTab\categoty.dt
  • %Program Files%\OpenTab\domainmatch.dat
  • %Program Files%\OpenTab\except.dat
  • %Program Files%\OpenTab\hka.dll - also detected by Trend Micro as ADW_OPENTAB
  • %Program Files%\OpenTab\mainsite.dat
  • %Program Files%\OpenTab\OpenTab.dll - also detected by Trend Micro as ADW_OPENTAB
  • %Program Files%\OpenTab\Opentab.exe - also detected by Trend Micro as ADW_OPENTAB
  • %Program Files%\OpenTab\Opentabch.exe - also detected by Trend Micro as ADW_OPENTAB
  • %Program Files%\OpenTab\Opentabhper.exe - also detected by Trend Micro as ADW_OPENTAB
  • %Program Files%\OpenTab\OpenTabUninstall.exe
  • %Program Files%\OpenTab\Opentabup.exe - also detected by Trend Micro as ADW_OPENTAB
  • %Program Files%\OpenTab\sitedepth1.dat

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)

It creates the following folders:

  • %Program Files%\OpenTab

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)

Autostart Technique

This adware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Opentab = "%Program Files%\OpenTab\Opentab.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Opentabhper = "%Program Files%\OpenTab\Opentabhper.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Opentabup = "%Program Files%\openTab\Opentabup.exe"

It registers itself as a BHO to ensure its automatic execution every time Internet Explorer is used by adding the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{DA742A73-CFA7-4DE2-BF28-1FC51CF214BC}

Other System Modifications

This adware adds the following registry keys:

HKEY_CLASSES_ROOT\CLSID\{DA742A73-CFA7-4DE2-BF28-1FC51CF214BC}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Opentab

HKEY_LOCAL_MACHINE\SOFTWARE\Opentab

It adds the following registry entries:

HKEY_CLASSES_ROOT\CLSID\{DA742A73-CFA7-4DE2-BF28-1FC51CF214BC}
(Default) = "오픈탭"

HKEY_CLASSES_ROOT\CLSID\{DA742A73-CFA7-4DE2-BF28-1FC51CF214BC}\
InProcServer32
(Default) = "%Program Files%\OpenTab\OpenTab.dll"

HKEY_CLASSES_ROOT\CLSID\{DA742A73-CFA7-4DE2-BF28-1FC51CF214BC}\
InProcServer32
ThreadingModel = "Apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Opentab
DisplayName = "OpentabUninstall"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Opentab
DisplayIcon = "%Program Files%\OpenTab\Opentabuninstall.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Opentab
UninstallString = "%Program Files%\OpenTab\Opentabuninstall.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Opentab
part = "kmpopentab"

Adware Routine

This adware connects to the following URL(s) to display ads on the affected system:

  • http://{BLOCKED}b.co.kr/nquery_v2.asp?sk={search string}&domain={search engine domain}&ptn=kmpopentab
  • http://{BLOCKED}b.co.kr/appapi/double_keyword_xml.asp?keyword1=&keyword2=&orgkeyword={search string}&depth=1&domain={search engine domain}&ptn=kmpopentab
  • http://{BLOCKED}b.co.kr/appapi/vd_double_keyword_xml.asp?keyword1=&keyword2=&orgkeyword={search string}&depth=1&domain={search engine domain}&ptn=kmpopentab
  • http://{BLOCKED}n.{BLOCKED}b.co.kr/AppTag/KeywordCnt_V2.asp?keywords={random characters}&cddtc=kmpopentab

NOTES:

It monitors the following sites for search strings:

  • 11st.co.kr
  • auction.co.kr
  • daum.net
  • dreamwiz.com
  • freechal.com
  • gajai.com
  • gmarket.co.kr
  • google.co.kr
  • google.com
  • hanafos.com
  • joinsmsn.com
  • korea.com
  • msn.com
  • nate.com
  • naver.com
  • paran.com
  • rc14.overture.com
  • www.nate.com
  • www.naver.com
  • yahoo.co.kr
  • yahoo.com

The BHO component inserts a toolbar at the bottom of the browser window where the advertisements related to search strings entered are displayed:

Clicking a tab at the bottom of the browser window opens a popup window containing the advertisement.

  SOLUTION

Minimum Scan Engine:

9.300

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Close all opened browser windows

Step 3

Terminate a malware/grayware process

[ Learn More ]

*Note: If the detected process is not displayed in theWindows Task Manager, continue doing the next steps.

    • Opentab.exe

Step 4

Delete this registry key

[ Learn More ]

=Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator’s help. You may also check out this Microsoft article first before modifying your computer's registry.

  • In HKEY_CLASSES_ROOT\CLSID
    • {DA742A73-CFA7-4DE2-BF28-1FC51CF214BC}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
    • {DA742A73-CFA7-4DE2-BF28-1FC51CF214BC}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
    • Opentab
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • Opentab

Step 5

Delete these registry values

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator’s help. You may also check out this Microsoft article first before modifying your computer's registry.

  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Opentab = "%Program Files%\OpenTab\Opentab.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Opentabhper = "%Program Files%\OpenTab\Opentabhper.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Opentabup = "%Program Files%\openTab\Opentabup.exe"

Step 7

Scan your computer with your Trend Micro product to delete files detected as ADW_OPENTAB If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.