ADW_EORENSO

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This adware creates the following folders:

• %User Profile%\Local Settings\Application Data\tuto4pc_jp_26
• %User Profile%\Local Settings\Application Data\tuto4pc_jp_26\tuto4pc_jp_26
• %User Profile%\Local Settings\Application Data\tuto4pc_jp_26\tuto4pc_jp_26\1.10

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Dropping Routine

This adware drops the following files:

• %User Profile%\Local Settings\Application Data\tuto4pc_jp_26\tuto4pc_jp_26\1.10\cnf.cyl
• %User Profile%\Local Settings\Application Data\tuto4pc_jp_26\tuto4pc_jp_26\1.10\eorezo.cyl
• %User Profile%\Cookies\{username}@.ldowi[2].txt
• %User Profile%\Cookies\{username}@affiliate.gwmtracker.txt
• %User Profile%\Cookies\{username}@mmy[2].txt
• %User Profile%\Cookies\{username}@network.adsmarket[2].txt
• %User Profile%\Cookies\{username}@sampleprizecenter[1].txt
• %User Profile%\Cookies\{username}@systweak[2].txt
• %User Profile%\Cookies\{username}@adxnxs[1].txt
• %User Profile%\Cookies\{username}@adds.yahoo[2].txt
• %User Profile%\Cookies\{username}@bluekai[2].txt
• %User Profile%\Cookies\{username}@exelator[1].txt
• %User Profile%\Cookies\{username}@ib.mookie1[2].txt
• %User Profile%\Cookies\{username}@legolas-media[2].txt
• %User Profile%\Cookies\{username}@mookie1[1].txt
• %User Profile%\Cookies\{username}@openx[1].txt
• %User Profile%\Cookies\{username}@pubmatic[2].txt
• %User Profile%\Cookies\{username}@ru4[1].txt
• %User Profile%\Cookies\{username}@tidaltv[2].txt
• %User Profile%\Cookies\{username}@yahoo[2].txt
• %Application Data%\Microsoft\Protect\{GUID}

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Other Details

This adware connects to the following possibly malicious URL:

• http://a.ldowi.com/click/?s=265604&c=899395&internal=113_69w9nj_1
• http://a.panxh.com/click/?s=265604&c=895042
• http://a.panxh.com/click/?s=265604&c=899395
• http://affiliate.gwmtracker.com/rd/r.php?sid=1641&pub=200978&c1=293834&c2=&c3=
• http://ajax.googleapis.com/ajax/libs/webfont/1/webfont.js
• http://cdn.cdncomputer.com/css/mobile/11826.css
• http://cdn.cdncomputer.com/images/11817/sprite.png
• http://cdn.cdncomputer.com/images/11826/bg_main.jpg
• http://cdn.cdncomputer.com/images/11826/sprite.gif
• http://cdn.cdncomputer.com/js/main.js
• http://cdn.dsultra.com/images/analytics/sprite5.gif
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/award_bg_left.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/award_bg_middle.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/award_bg_right.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/buttet.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/call_icon.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/cert.png
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/download3000_rating5.png
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/download_btn_0.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/feature_bg_LeftBottom.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/feature_bg_LeftMiddle.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/feature_bg_LeftTop.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/feature_bg_RightBottom.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/feature_bg_RightMiddle.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/feature_bg_RightTop.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/feature_bg_TopMiddle.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/feature_bg_bottomMiddle.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/filecluster_scan_report.gif
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/fiveStar.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/green_tick.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/head_bg.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/mscp_logo.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/scan_icon.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/si_editor5.gif
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/speed_icon.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/step1_download.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/step2_run_0.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/step3_rcpScreen_0.jpg
• http://cdn.systweak.com/downloads/website/images/RC/DownloadST/DownloadLp/step_box.jpg
• http://fonts.googleapis.com/css?family=Libre+Baskerville
• http://images.scanalert.com/meter/www.systweak.com/13.gif
• http://network.adsmarket.com/click/jmJsmGPKfJiRZnKWjZuplLdiaZZfnYCbiZBsnmSdf5W3aGmbY5ypmYpmaZ1f
• http://themes.googleusercontent.com/static/fonts/librebaskerville/v1/pR0sBQVcY0JZc_ciXjFsK2F7WC2UG4aaA4SZk0HPHJg.eot
• http://www.google-analytics.com/ga.js
• http://www.google.com/ads/search/module/ads/1.0/1b925b7b2536cdc80ff264525f37f95ef5c0aa3a/n/domains.js
• http://www.google.com/adsense/domains/caf.js
• http://www.gstatic.com/domainads/tracking/caf.gif?ts=1384558806250&rid=7980525
• http://www.gstatic.com/domainads/tracking/caf.gif?ts=1384559104859&rid=52527
• http://www.systweak.com/registrycleaner/mmy/?utm_source=matomy&utm_campaign=matomy&pub_id=61335&ce_cid=20ncUV21vVkRuzrB1SY7ig1vHdVN000.