ADW_RELEVANT

Installation

This adware drops the following files:

• %Program Files%\crazydancing\crazydancing.exe
• %Program Files%\crazydancing\freeoffer\FreeScreenSaver&Game.url
• %Program Files%\crazydancing\freeoffer\purefunland.ico
• %Program Files%\crazydancing\RelevantKnowledge
• %Program Files%\crazydancing\RelevantKnowledge\ins_cs.exe
• %Program Files%\crazydancing\RelevantKnowledge\relevantknowledge_logo.bmp
• %Program Files%\crazydancing\RelevantKnowledge\rkeula.rtf
• %Program Files%\crazydancing\unins000.dat
• %Program Files%\crazydancing\unins000.exe
• %User Profile%\Desktop\Play Free Games and download Screensaver!.lnk
• %User Profile%\Start Menu\Programs\crazydancing\crazydancing.lnk
• %User Profile%\Start Menu\Programs\crazydancing\Uninstall crazydancing.lnk
• %User Temp\is-3ILC4.tmp\rkverify.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It drops the following component file(s):

• %System%\rkinstaller.exe - detected as ADW_RELEVANT.A

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It creates the following folders:

• %Program Files%\crazydancing
• %User Profile%\Start Menu\Programs\crazydancing

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Other Details

Based on analysis of the codes, it has the following capabilities:

• It creates the following registry key and entry:
  

  HKEY_CURRENT_USER\Software\Microsoft\
  Windows\CurrentVersion\RunOnce
  Del41 = "cmd /c del %System%\rkinstaller.exe"

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
  Windows\CurrentVersion\
  Uninstall\crazydancing_is1

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It connects to the following possibly malicious URL:

• http://{BLOCKED}evantknowledge.com/campaignstatus.aspx?campaign_id=222