ADW_BITBROWSE

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It arrives as a component bundled with malware/grayware packages.

Arrival Details

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It arrives as a component bundled with malware/grayware packages.

Installation

This adware drops the following copies of itself into the affected system:

• %ProgramData%\BitGuard\{Version Number}\{CLSID}\BitGuard.exe
• %ProgramData%\BitGuard\{Version Number}\{CLSID}\uninstall.exe

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This is usually C:\ProgramData in Windows Vista and 7, or C:\Program Files on Windows 2000, XP (32-bit), and Server 2003, or C:\Program Files (x86) on Windows XP (64-bit).)

It creates the following folders:

• %Start Menu%\Programs\BitGuard
• %ProgramData%\BitGuard
• %ProgramData%\BitGuard\{Version Number}
• %ProgramData%\BitGuard\{Version Number}\{CLSID}

(Note: %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista and 7.. %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This is usually C:\ProgramData in Windows Vista and 7, or C:\Program Files on Windows 2000, XP (32-bit), and Server 2003, or C:\Program Files (x86) on Windows XP (64-bit).)

Other System Modifications

This adware adds the following registry keys:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\BitGuard

It adds the following registry entries:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\BitGuard
ImagePath = "%ProgramData%\BitGuard\{Version Number}\{CLSID}\BitGuard.exe"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\BitGuard
DisplayName = "BitGuard"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\BitGuard
UninstallLinkPath = "%Start Menu%\Programs\Uninstall BitGuard.lnk"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\BitGuard
Description = "Your browser protector service"

Dropping Routine

This adware drops the following files:

• %Start Menu%\Programs\BitGuard\Uninstall BitGuard.lnk

(Note: %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista and 7.)

Other Details

This adware adds the following registry entries to add an uninstall option to the Control Panel:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall
{CLSID} = ""%ProgramData%\BitGuard\{Version Number}\{CLSID}\uninstall.exe" /Uninstall /{CLSID} / um"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall
DisplayName = "BitGuard"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall
UninstalLinkPath = "%Start Menu%\Programs\BitGuard\Uninstall BitGuard.lnk"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall
Publisher = "MediaTechSoft Inc"

NOTES:

This malware requires the file where this malware/grayware is bundled to perform its intended routine.