PUA_PCPOWERSPEED.GA

This potentially unwanted application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be manually installed by a user.

Arrival Details

This potentially unwanted application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be manually installed by a user.

Installation

This potentially unwanted application adds the following folders:

• %User Temp%\is-{random characters}.tmp\{malware filename}.tmp
• %User Temp%\is-{random characters}.tmp\_isetup
• %Program Files%\PCPowerSpeed
• %Application Data%\PCPowerSpeed
• %ProgramData%\Microsoft\Windows\Start Menu\Programs\PC Power Speed

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following files:

• %User Temp%\is-{random characters}.tmp\_isetup\_RegDLL.tmp
• %User Temp%\is-{random characters}.tmp\_isetup\_shfoldr.dll
• %Program Files%\PCPowerSpeed\unins000.dat
• %Program Files%\PCPowerSpeed\unins000.exe
• %Program Files%\PCPowerSpeed\unins000.msg
• %Program Files%\PCPowerSpeed\PCPowerSpeed.exe
• %Program Files%\PCPowerSpeed\PCPowerTray.exe
• %Application Data%\PCPowerSpeed\faq.tmp
• %Desktop%\PC Power Speed - Optimize Your PC.lnk
• %ProgramData%\Microsoft\Windows\Start Menu\Programs\PC Power Speed\PC Power Speed.lnk
• %ProgramData%\Microsoft\Windows\Start Menu\Programs\PC Power Speed\PCPowerSpeed.com.url
• %ProgramData%\Microsoft\Windows\Start Menu\Programs\PC Power Speed\Uninstall PC Power Speed.lnk

Autostart Technique

This potentially unwanted application adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
PCPowerSpeed = ""%Program Files%\PCPowerSpeed\PCPowerTray.exe" /startup"

Other System Modifications

This potentially unwanted application adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1

HKEY_CURRENT_USER\Software\Microsoft\
Direct3D

HKEY_CURRENT_USER\Software\Microsoft\
Direct3D\MostRecentApplication

HKEY_CURRENT_USER\Software\PCPowerSpeed

HKEY_CURRENT_USER\Software\PCPowerSpeed\
AppMessages

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
Inno Setup: Setup Version = "5.3.8 (a)"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
Inno Setup: App Path = "%Program Files%\PCPowerSpeed"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
InstallLocation = "%Program Files%\PCPowerSpeed\"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
Inno Setup: Icon Group = "PC Power Speed"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
Inno Setup: User = "{username}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
Inno Setup: Language = "en"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
DisplayName = "PC Power Speed 2.1.0.108"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
DisplayIcon = "%Program Files%\PCPowerSpeed\PCPowerSpeed.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
UninstallString = "%Program Files%\PCPowerSpeed\unins000.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
QuietUninstallString = ""%Program Files%\PCPowerSpeed\unins000.exe" /SILENT"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
DisplayVersion = "2.1.0.108"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
Publisher = "Crawler Group, LLC"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
URLInfoAbout = "http://www.PCPowerSpeed.com/"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
HelpLink = "http://www.PCPowerSpeed.com/"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
URLUpdateInfo = "http://www.PCPowerSpeed.com/"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
NoModify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
NoRepair = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
InstallDate = "{Installation date}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
MajorVersion = "2"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
MinorVersion = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1
EstimatedSize = "14006"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
StartPage\NewShortcuts
%Application Data%\Microsoft\Windows\Start Menu\Programs\PC Power Speed\PC Power Speed.lnk = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
StartPage\NewShortcuts
%ProgramData%\Microsoft\Windows\Start Menu\Programs\PC Power Speed\PC Power Speed.lnk = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Direct3D\MostRecentApplication
Name = "PCPowerSpeed.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\PCPowerSpeed
INSTALL = "{hex value}"

HKEY_CURRENT_USER\Software\PCPowerSpeed
SCHEDULE_SCAN = "7"

HKEY_CURRENT_USER\Software\PCPowerSpeed
STARTUP_SCAN = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\PCPowerSpeed
SHOW_RESULTS = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\PCPowerSpeed
SHOW_TRAY = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\PCPowerSpeed
DELAY_STARTUP = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\PCPowerSpeed
CREATE_SYSTEMRP = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\PCPowerSpeed
CHECK_FOR_UPDATES = "1"

HKEY_CURRENT_USER\Software\PCPowerSpeed
LAST_UPDATE = "{hex value}"

HKEY_LOCAL_MACHINE\SOFTWARE\PCPowerSpeed
LANGUAGE = "en"

HKEY_LOCAL_MACHINE\SOFTWARE\PCPowerSpeed
INSTCFG = "29"

HKEY_LOCAL_MACHINE\SOFTWARE\PCPowerSpeed
UID = "{UID}"

HKEY_LOCAL_MACHINE\SOFTWARE\PCPowerSpeed
PARAM{number} = "{hex value}"

HKEY_CURRENT_USER\Software\PCPowerSpeed
OTF = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\PCPowerSpeed
SERVER_STATUS_TYPE = ""

Other Details

This potentially unwanted application connects to the following possibly malicious URL:

• http://www.{BLOCKED}rspeed.com/client.asmx
• http://www.{BLOCKED}rspeed.com/client.asmx/GetXML
• http://www.{BLOCKED}rspeed.com/client.asmx/Activate
• http://www.{BLOCKED}rspeed.com/client.asmx/SendLog
• http://www.{BLOCKED}rspeed.com/client.asmx/GetPhone
• http://www.{BLOCKED}rspeed.com/appDefault.aspx?page=app_help_pcsc&lng=en
• http://www.{BLOCKED}rspeed.com/appDefault.aspx?page=app_help_pcsc