ADW_MEGASWELL

This adware drops files onto the affected system. It adds certain registry keys

It displays a popup window with the message, This advertisement delivered by {random string}.

This adware may be dropped by other malware.

It displays advertisements on Internet browsers.

Arrival Details

This adware may be dropped by the following malware:

• TROJ_DLOADR.LUT
• TROJ_DLWIMAD.SMI

It may be downloaded from the following remote site(s):

• http://www.{BLOCKED}mesplayer.com/license.cgi
• http://www.{BLOCKED}tmp3player.com/license.cgi
• http://www.{BLOCKED}ablesongslive.com/license.cgi
• http://www.{BLOCKED}eatsongs.com/license.cgi
• http://www.{BLOCKED}ablesongslive.com/affiliates/772466/20/PLAY_MP3.exe

Installation

This adware drops the following files:

• %Program Files%\{random string}\{random string}.dll - also detected as ADW_MEGASWELL

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

It drops the following non-malicious files:

• %Program Files%\PlayMP3z\PlayMP3.exe
• %Program Files%\PlayMP3z\uninstall.exe
• %Program Files%\PlayMP3z\confirm.xml
• %Program Files%\{random string}\uninstall.exe
• %Start Menu%\Programs\PlayMP3z\Run PlayMP3z.pif

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.)

It creates the following folders:

• %Start Menu%\Programs\PlayMP3z
• %Program Files%\{random string}
• %Program Files%\PlayMP3z

(Note: %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.)

Autostart Technique

This adware registers itself as a BHO to ensure its automatic execution every time Internet Explorer is used by adding the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{CLSID 1}

Other System Modifications

This adware adds the following registry keys:

HKEY_CLASSES_ROOT\{random string}.{random string}

HKEY_CLASSES_ROOT\{random string}.{random string}.1

HKEY_CLASSES_ROOT\AppID\{CLSID 2}

HKEY_CLASSES_ROOT\AppID\{random string}.DLL

HKEY_CLASSES_ROOT\CLSID\{CLSID 1}

HKEY_CLASSES_ROOT\Interface\{CLSID 3}

HKEY_CLASSES_ROOT\TypeLib\{CLSID 4}

HKEY_CURRENT_USER\Software\MediaHoldings

HKEY_CURRENT_USER\Software\{random string}

HKEY_CURRENT_USER\Software\PlayMP3

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{random string}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
PlayMP3

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{CLSID 1}
(Default) = "{random string}"

HKEY_CLASSES_ROOT\{random string}.{random string}
(Default) = "{random string}"

HKEY_CLASSES_ROOT\{random string}.{random string}\CLSID
(Default) = "{CLSID 1}"

HKEY_CLASSES_ROOT\{random string}.{random string}\CurVer
(Default) = "{random string}.{random string}.1"

HKEY_CLASSES_ROOT\{random string}.{random string}.1
(Default) = "{random string}"

HKEY_CLASSES_ROOT\{random string}.{random string}.1\CLSID
(Default) = "{CLSID 1}"

HKEY_CLASSES_ROOT\AppID\{CLSID 2}
(Default) = "{random string}"

HKEY_CLASSES_ROOT\AppID\{random string}.DLL
AppID = "{CLSID 2}"

HKEY_CLASSES_ROOT\CLSID\{CLSID 1}
(Default) = "{random string}"

HKEY_CLASSES_ROOT\CLSID\{CLSID 1}
AppID = "{CLSID 2}"

HKEY_CLASSES_ROOT\CLSID\{CLSID 1}\
InprocServer32
(Default) = "%Program Files%\{random string}\{random string}.dll"

HKEY_CLASSES_ROOT\CLSID\{CLSID 1}\
TypeLib
(Default) = "{CLSID 4}"

HKEY_CLASSES_ROOT\Interface\{CLSID 3}
(Default) = "I{random string}Object"

HKEY_CLASSES_ROOT\Interface\{CLSID 3}\
TypeLib
(Default) = "{CLSID 4}"

HKEY_CLASSES_ROOT\TypeLib\{CLSID 4}\
1.0
(Default) = "{random string} 1.0 Type Library"

HKEY_CLASSES_ROOT\TypeLib\{CLSID 4}\
1.0\0\win32
(Default) = "%Program Files%\{random string}\{random string}.dll"

Adware Routine

This adware displays advertisements on Internet browsers.

NOTES:
{random string} can be any of the following:

• z2010MegawildAdverpopper
• ExcellentAdDisplay

• AFEB5519-7ADD-2E4A-0343-519132B684DE
• F31C8969-83E7-A513-2E11-CB6D1837C2CB

• 418D86BE-7386-4F1A-83E0-53604ADBDA74
• 80EEBD97-B5BC-356F-B14E-0C1865B88474

• 2C8D7294-4F74-4147-277D-3FFF39E6EACB
• 51B8AFA0-3E42-B9F4-6DD9-8D64820A9475

• 26F1DC82-56EA-6FB6-89AF-B039D3CB9ED9
• 5CD14984-6934-02E1-E75F-26EBA3856F2D

It displays a popup window with the message, This advertisement delivered by {random string}.