ADW_PCMIGHT

This adware may arrive bundled with malware packages as a malware component. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats.

Arrival Details

This adware may arrive bundled with malware packages as a malware component.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This adware drops the following file(s)/component(s):

• %Application Data%\PC MightyMax 2012\DiagnosticReporter.exe
• %Application Data%\PC MightyMax 2012\DiagnosticReporter.ico
• %Application Data%\PC MightyMax 2012\ElevateHelper.exe
• %Application Data%\PC MightyMax 2012\FileExtHandler.exe
• %Application Data%\PC MightyMax 2012\icon.ico
• %Application Data%\PC MightyMax 2012\ICSharpCode.SharpZipLib.dll
• %Application Data%\PC MightyMax 2012\pcmm2012.exe
• %Application Data%\PC MightyMax 2012\ScanSpecific.dll
• %Application Data%\PC MightyMax 2012\taskkill.exe
• %Application Data%\PC MightyMax 2012\TrayIcon.exe
• %Application Data%\PC MightyMax 2012\Uninstall.exe
• %User Profile%\Application Data\PCMM2012\diagnostic\trace.log
• %User Temp%\nsm4.tmp\NSISpcre.dll
• %User Temp%\nshB.tmp\InstallOptions.dll
• %User Temp%\nshB.tmp\ioSpecial.ini
• %User Temp%\nshB.tmp\modern-wizard.bmp
• %User Temp%\~nsu.tmp\Au_.exe
• %Start Menu%\Programs\PC MightyMax 2012\Create Diagnostic Report.lnk
• %Start Menu%\Programs\PC MightyMax 2012\PC MightyMax 2012.lnk
• %Start Menu%\Programs\PC MightyMax 2012\Uninstall.lnk
• %Desktop%\PC MightyMax 2012.lnk

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista and 7.. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Desktop on Windows Vista and 7.)

It creates the following folders:

• %Application Data%\PC MightyMax 2012
• %Application Data%\PC MightyMax 2012\AgentID
• %Application Data%\PC MightyMax 2012\DownloadID
• %User Profile%\Application Data\licenses
• %User Profile%\Application Data\licenses\PCMightyMaxfebfe168-41ca-41d5-8bc3-4e56f27af863
• %Start Menu%\Programs\PC MightyMax 2012
• %User Profile%\Application Data\PCMM2012
• %User Profile%\Application Data\PCMM2012\diagnostic
• %User Profile%\Application Data\PCMM2009
• %User Profile%\Application Data\PCMM2009\diagnostic
• %User Profile%\Application Data\PCMM2009\diagnostic\last-scan
• %User Profile%\Application Data\PCMM2009\pcmm2009-configuration

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista and 7.)

Autostart Technique

This adware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
PC MightyMax 2012 Tray Icon = ""C:\Documents and Settings\winxp.KARLD-WINXP\Local Settings\Application Data\PC MightyMax 2012\TrayIcon.exe""

Other System Modifications

This adware adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\PC MightyMax 2012
(Default) = "%Application Data%\PC MightyMax 2012"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{3f6555c4-0a24-11dc-8314-0800200c9a66}
DisplayName = "PC MightyMax 2012"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{3f6555c4-0a24-11dc-8314-0800200c9a66}
UninstallString = %Application Data%\PC MightyMax 2012\Uninstall.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{3f6555c4-0a24-11dc-8314-0800200c9a66}
DisplayIcon = %Application Data%\PC MightyMax 2012\pcmm2012.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{3f6555c4-0a24-11dc-8314-0800200c9a66}
Publisher = "PC MightyMax"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{3f6555c4-0a24-11dc-8314-0800200c9a66}
HelpLink = "http://www.pcmightymax.net"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{3f6555c4-0a24-11dc-8314-0800200c9a66}
NoModify = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{3f6555c4-0a24-11dc-8314-0800200c9a66}
NoRepair = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{3f6555c4-0a24-11dc-8314-0800200c9a66}
VersionMajor = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{3f6555c4-0a24-11dc-8314-0800200c9a66}
VersionMinor = "3"

Download Routine

This adware connects to the following malicious URLs:

• www.{BLOCKED}tymax.net

NOTES:

It accesses the following websites after installation:

• http://www.{BLOCKED}tymax.net/AfterInstall/ThankYou2009.php?id=
• http://www.{BLOCKED}tymax.net/kwtf/valuecheck.php

It accesses http://www.{BLOCKED}tymax.net/AfterInstall/Exit.php?id= after uninstalling the software.