Analysé par: Rhena Inocencio   
 Plate-forme:

Windows

 Overall Risk:
 Dommages potentiels: :
 Distribution potentielle: :
 reportedInfection:
 Information Exposure Rating::
Faible
Medium
Élevé
Critique

  • Type de grayware:
    Adware

  • Destructif:
    Non

  • Chiffrement:
     

  • In the wild::
    Oui

  Overview

Wird möglicherweise manuell von einem Benutzer installiert.

  Détails techniques

File size: 8,244,624 bytes
File type: EXE
Memory resident: Oui
Date de réception des premiers échantillons: 12 juin 2014

Übertragungsdetails

Wird möglicherweise manuell von einem Benutzer installiert.

Installation

Schleust folgende Komponentendateien ein:

  • %Program Files%\Linkey\Helper.dll
  • %Program Files%\Linkey\IEExtension
  • %Program Files%\Linkey\IEExtension\iedll.dll
  • %Program Files%\Linkey\IEExtension\iedll64.dll
  • %Program Files%\Linkey\log.log
  • %Program Files%\Linkey\module.dll
  • %Program Files%\Linkey\module64.dll
  • %Program Files%\Linkey\Uninstall.exe
  • %Program Files%\LinkeyDeals\insthlp.dll
  • %Program Files%\LinkeyDeals\LinkeyDealsUninst.exe
  • %Program Files%\LinkeyDeals\msilnk.dll
  • %Program Files%\LinkeyDeals\msilnk.exe
  • %Program Files%\Settings Manager\systemk\favicon.ico
  • %Program Files%\Settings Manager\systemk\Helper.dll
  • %Program Files%\Settings Manager\systemk\Internet Explorer Settings.exe
  • %Program Files%\Settings Manager\systemk\sysapcrt.dll
  • %Program Files%\Settings Manager\systemk\syskldr.dll
  • %Program Files%\Settings Manager\systemk\syskldr_u.dll
  • %Program Files%\Settings Manager\systemk\systemk.dll
  • %Program Files%\Settings Manager\systemk\systemkbho.dll
  • %Program Files%\Settings Manager\systemk\systemkChrome.dll
  • %Program Files%\Settings Manager\systemk\systemkmgrc1.cfg
  • %Program Files%\Settings Manager\systemk\SystemkService.exe
  • %Program Files%\Settings Manager\systemk\systemku.exe
  • %Program Files%\Settings Manager\systemk\tbicon.exe
  • %Program Files%\Settings Manager\systemk\Uninstall.exe
  • {All Users Profile}\Application Data\systemk\coordinator.cfg
  • {All Users Profile}\Application Data\systemk\general.cfg
  • {All Users Profile}\Application Data\systemk\S-1-5-32.cfg
  • %Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\DnsBHO.js
  • %Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\Error404BHO.js
  • %Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\MainBHO.js
  • %Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\NativeHelper.js
  • %Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\NewTabBHO.js
  • %Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\overlay.js
  • %Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\overlay.xul
  • %Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\RelatedSearch.js
  • %Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\RequestPreserver.js
  • %Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\SearchBHO.js
  • %Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\SettingManager.js
  • %Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF.xpt
  • %Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF{number}.dll

(Hinweis: %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.. %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT und C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000, XP und Server 2003.)

Erstellt die folgenden Ordner:

  • %Program Files%\Linkey
  • %Program Files%\LinkeyDeals
  • %Program Files%\Settings Manager
  • %Program Files%\Settings Manager\systemk
  • {All Users Profile}\Application Data\systemk

(Hinweis: %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.)

Autostart-Technik

Fügt die folgenden Registrierungseinträge hinzu, um sich als Browser Helper Object (BHO) zu installieren:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47}
(Default) = "Linkey"

Andere Systemänderungen

Fügt die folgenden Registrierungsschlüssel hinzu:

HKEY_CURRENT_USER\"Software\Linkey"

HKEY_CURRENT_USER\Software\SystemK

HKEY_LOCAL_MACHINE\SOFTWARE\Linkey

HKEY_LOCAL_MACHINE\SOFTWARE\LinkeyDeals

HKEY_LOCAL_MACHINE\SOFTWARE\SystemK

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Linkey.Linkey

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
SettingsManagerIEHelper.DNSGuard

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SystemkService

Fügt die folgenden Registrierungseinträge hinzu:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
bitguard.exe
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
bprotect.exe
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
bpsvc.exe
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
browserdefender.exe
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
browserprotect.exe
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
browsersafeguard.exe
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
dprotectsvc.exe
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
jumpflip
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
protectedsearch.exe
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
searchinstaller.exe
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
searchprotection.exe
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
searchprotector.exe
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
searchsettings.exe
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
searchsettings64.exe
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
snapdo.exe
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
stinst32.exe
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
stinst64.exe
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
umbrella.exe
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
utiljumpflip.exe
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
volaro
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
vonteera
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
websteroids.exe
debugger = "tasklist.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
websteroidsservice.exe
debugger = "tasklist.exe"