ADW_OPENTAB
Adware.Popuppers (Symantec)
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
Threat Type: Adware
Destructiveness: No
Encrypted: No
In the wild: Yes
OVERVIEW
This adware may arrive bundled with malware packages as a malware component. It may be manually installed by a user.
TECHNICAL DETAILS
Arrival Details
This adware may arrive bundled with malware packages as a malware component.
It may be manually installed by a user.
Installation
This adware drops the following file(s)/component(s):
- %Program Files%\OpenTab\catedomain.dt
- %Program Files%\OpenTab\category.dat
- %Program Files%\OpenTab\categoty.dt
- %Program Files%\OpenTab\domainmatch.dat
- %Program Files%\OpenTab\except.dat
- %Program Files%\OpenTab\hka.dll - also detected by Trend Micro as ADW_OPENTAB
- %Program Files%\OpenTab\mainsite.dat
- %Program Files%\OpenTab\OpenTab.dll - also detected by Trend Micro as ADW_OPENTAB
- %Program Files%\OpenTab\Opentab.exe - also detected by Trend Micro as ADW_OPENTAB
- %Program Files%\OpenTab\Opentabch.exe - also detected by Trend Micro as ADW_OPENTAB
- %Program Files%\OpenTab\Opentabhper.exe - also detected by Trend Micro as ADW_OPENTAB
- %Program Files%\OpenTab\OpenTabUninstall.exe
- %Program Files%\OpenTab\Opentabup.exe - also detected by Trend Micro as ADW_OPENTAB
- %Program Files%\OpenTab\sitedepth1.dat
(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)
It creates the following folders:
- %Program Files%\OpenTab
(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)
Autostart Technique
This adware adds the following registry entries to enable its automatic execution at every system startup:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Opentab = "%Program Files%\OpenTab\Opentab.exe"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Opentabhper = "%Program Files%\OpenTab\Opentabhper.exe"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Opentabup = "%Program Files%\openTab\Opentabup.exe"
It registers itself as a BHO to ensure its automatic execution every time Internet Explorer is used by adding the following registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{DA742A73-CFA7-4DE2-BF28-1FC51CF214BC}
Other System Modifications
This adware adds the following registry keys:
HKEY_CLASSES_ROOT\CLSID\{DA742A73-CFA7-4DE2-BF28-1FC51CF214BC}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Opentab
HKEY_LOCAL_MACHINE\SOFTWARE\Opentab
It adds the following registry entries:
HKEY_CLASSES_ROOT\CLSID\{DA742A73-CFA7-4DE2-BF28-1FC51CF214BC}
(Default) = "오픈탭"
HKEY_CLASSES_ROOT\CLSID\{DA742A73-CFA7-4DE2-BF28-1FC51CF214BC}\
InProcServer32
(Default) = "%Program Files%\OpenTab\OpenTab.dll"
HKEY_CLASSES_ROOT\CLSID\{DA742A73-CFA7-4DE2-BF28-1FC51CF214BC}\
InProcServer32
ThreadingModel = "Apartment"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Opentab
DisplayName = "OpentabUninstall"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Opentab
DisplayIcon = "%Program Files%\OpenTab\Opentabuninstall.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Opentab
UninstallString = "%Program Files%\OpenTab\Opentabuninstall.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Opentab
part = "kmpopentab"
Adware Routine
This adware connects to the following URL(s) to display ads on the affected system:
- http://{BLOCKED}b.co.kr/nquery_v2.asp?sk={search string}&domain={search engine domain}&ptn=kmpopentab
- http://{BLOCKED}b.co.kr/appapi/double_keyword_xml.asp?keyword1=&keyword2=&orgkeyword={search string}&depth=1&domain={search engine domain}&ptn=kmpopentab
- http://{BLOCKED}b.co.kr/appapi/vd_double_keyword_xml.asp?keyword1=&keyword2=&orgkeyword={search string}&depth=1&domain={search engine domain}&ptn=kmpopentab
- http://{BLOCKED}n.{BLOCKED}b.co.kr/AppTag/KeywordCnt_V2.asp?keywords={random characters}&cddtc=kmpopentab
NOTES:
It monitors the following sites for search strings:
- 11st.co.kr
- auction.co.kr
- daum.net
- dreamwiz.com
- freechal.com
- gajai.com
- gmarket.co.kr
- google.co.kr
- google.com
- hanafos.com
- joinsmsn.com
- korea.com
- msn.com
- nate.com
- naver.com
- paran.com
- rc14.overture.com
- www.nate.com
- www.naver.com
- yahoo.co.kr
- yahoo.com
The BHO component inserts a toolbar at the bottom of the browser window where the advertisements related to search strings entered are displayed:
Clicking a tab at the bottom of the browser window opens a popup window containing the advertisement.
SOLUTION
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Close all opened browser windows
Step 3
Terminate a malware/grayware process
*Note: If the detected process is not displayed in theWindows Task Manager, continue doing the next steps.
- Opentab.exe
Step 4
Delete this registry key
=Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator’s help. You may also check out this Microsoft article first before modifying your computer's registry.
- In HKEY_CLASSES_ROOT\CLSID
- {DA742A73-CFA7-4DE2-BF28-1FC51CF214BC}
- {DA742A73-CFA7-4DE2-BF28-1FC51CF214BC}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
- {DA742A73-CFA7-4DE2-BF28-1FC51CF214BC}
- {DA742A73-CFA7-4DE2-BF28-1FC51CF214BC}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
- Opentab
- Opentab
- In HKEY_LOCAL_MACHINE\SOFTWARE
- Opentab
- Opentab
Step 5
Delete these registry values
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator’s help. You may also check out this Microsoft article first before modifying your computer's registry.
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- Opentab = "%Program Files%\OpenTab\Opentab.exe"
- Opentab = "%Program Files%\OpenTab\Opentab.exe"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- Opentabhper = "%Program Files%\OpenTab\Opentabhper.exe"
- Opentabhper = "%Program Files%\OpenTab\Opentabhper.exe"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- Opentabup = "%Program Files%\openTab\Opentabup.exe"
- Opentabup = "%Program Files%\openTab\Opentabup.exe"
Step 7
Scan your computer with your Trend Micro product to delete files detected as ADW_OPENTAB If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.