ADW_VOOTRA.GBHO

October 22, 2014

Analysis by: RonJay Kristoffer Caragay

ALIASES:

Win64/Adware.Vonteera.A, Win32/AdWare.Vonteera.J (ESET-NOD32)

PLATFORM:

Windows

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

INFORMATION EXPOSURE:

Threat Type: Adware
Destructiveness: No
Encrypted: No
In the wild: Yes

OVERVIEW

Infection Channel: Downloaded from the Internet, Dropped by other malware

This adware may arrive bundled with malware packages as a malware component. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

It acts as a Browser Helper Object (BHO) that monitors a user's Internet-browsing habits.

TECHNICAL DETAILS

File Size: 186,816 bytes

File Type: DLL

Memory Resident: No

Initial Samples Received Date: 22 Sep 2014

Arrival Details

This adware may arrive bundled with malware packages as a malware component.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by the following malware:

ADW_VOOTRA

Autostart Technique

This adware adds the following registry keys to install itself as a Browser Helper Object (BHO):

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{GUID 1}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{GUID 1}

It adds the following registry entries to install itself as a Browser Helper Object (BHO):

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{GUID 1}
(Default) = "FoxPro"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{GUID 1}
(Default) = "FoxPro"

It acts as a Browser Helper Object (BHO) that monitors a user's Internet-browsing habits.

Other System Modifications

This adware adds the following registry keys:

HKEY_CLASSES_ROOT\FoxPro.FoxPro

HKEY_CLASSES_ROOT\FoxPro.FoxPro.1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
FoxPro.FoxPro

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
FoxPro.FoxPro.1

HKEY_CLASSES_ROOT\CLSID\{GUID 1}

HKEY_CLASSES_ROOT\AppID\{GUID 2}

HKEY_CLASSES_ROOT\TypeLib\{GUID 4}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID 1}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{GUID 2}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID 4}

HKEY_CLASSES_ROOT\Interface\{GUID 3}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID 3}

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
FoxPro.FoxPro
(Default) = "FoxPro Class"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
FoxPro.FoxPro\CLSID
(Default) = "{GUID 1}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
FoxPro.FoxPro\CurVer
(Default) = "FoxPro.FoxPro.1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
FoxPro.FoxPro.1
(Default) = "FoxPro Class"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
FoxPro.FoxPro.1\CLSID
(Default) = "{GUID 1}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\FoxPro.DLL
AppID = "{GUID 2}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{GUID 2}
(Default) = "FoxPro"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID 1}
(Default) = "FoxPro Class"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID 1}\InprocServer32
(Default) = "%\Application Data%\VolIE\FoxPro_32.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID 1}\InprocServer32
ThreadingModel = "Apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID 1}\ProgID
(Default) = "FoxPro.FoxPro.1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID 1}\TypeLib
(Default) = "{GUID 4}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID 1}\VersionIndependentProgID
(Default) = "FoxPro.FoxPro"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID 3}
(Default) = "IFoxProBHO"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID 3}\ProxyStubClsid
(Default) = "{GUID 5}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID 3}\ProxyStubClsid32
(Default) = "{GUID 5}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID 3}\TypeLib
(Default) = "{GUID 4}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID 4}\1.0
(Default) = "FoxPro 3.0 Type Library"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID 4}\1.0\
0\win32
(Default) = "%\Application Data%\VolIE\FoxPro_32.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID 4}\1.0\
HELPDIR
(Default) = "%\Application Data%\VolIE"

SOLUTION

Minimum Scan Engine: 9.700

SSAPI PATTERN File: 1.560.00

SSAPI PATTERN Date: 24 Oct 2014

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Remove the malware/grayware file that dropped/downloaded ADW_VOOTRA.GBHO. (Note: Please skip this step if the threat(s) listed below have already been removed.)

ADW_VOOTRA

Step 4

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_CLASSES_ROOT
- FoxPro.FoxPro
In HKEY_CLASSES_ROOT
- FoxPro.FoxPro.1
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes
- FoxPro.FoxPro
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes
- FoxPro.FoxPro.1
In HKEY_CLASSES_ROOT\CLSID
- {GUID 1}
In HKEY_CLASSES_ROOT\AppID
- {GUID 2}
In HKEY_CLASSES_ROOT\Interface
- {GUID 3}
In HKEY_CLASSES_ROOT\TypeLib
- {GUID 4}
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
- {GUID 1}
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID
- {GUID 2}
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
- {GUID 3}
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib
- {GUID 4}
In HKEY_CLASSES_ROOT\AppID
- FoxPro.DLL
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes
- AppID\FoxPro.DLL

To delete registry keys this malware/grayware created:

Open Registry Editor. To do this:
» For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
» For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
» For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
In the left panel of the Registry Editor window, double-click the following:
HKEY_CLASSES_ROOT
Still in the left panel, locate and delete the key:
FoxPro.FoxPro
Again Still in the left panel, locate and delete the key:
FoxPro.FoxPro.1
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes
Still in the left panel, locate and delete the key:
FoxPro.FoxPro
Again Still in the left panel, locate and delete the key:
FoxPro.FoxPro.1
In the left panel of the Registry Editor window, double-click the following:
HKEY_CLASSES_ROOT>CLSID
Still in the left panel, locate and delete the key:
{GUID 1}
In the left panel of the Registry Editor window, double-click the following:
HKEY_CLASSES_ROOT>AppID
Still in the left panel, locate and delete the key:
{GUID 2}
In the left panel of the Registry Editor window, double-click the following:
HKEY_CLASSES_ROOT>Interface
Still in the left panel, locate and delete the key:
{GUID 3}
In the left panel of the Registry Editor window, double-click the following:
HKEY_CLASSES_ROOT>TypeLib
Still in the left panel, locate and delete the key:
{GUID 4}
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
Still in the left panel, locate and delete the key:
{GUID 1}
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
Still in the left panel, locate and delete the key:
{GUID 2}
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
Still in the left panel, locate and delete the key:
{GUID 3}
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
Still in the left panel, locate and delete the key:
{GUID 4}
Again Still in the left panel, locate and delete the key:
FoxPro.DLL
Again Still in the left panel, locate and delete the key:
AppID\FoxPro.DLL
Close Registry Editor.

Step 5

Scan your computer with your Trend Micro product to delete files detected as ADW_VOOTRA.GBHO. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Did this description help? Tell us how we did.

ADW_VOOTRA.GBHO

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

ADW_VOOTRA.GBHO

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

The Americas

Middle East & Africa

Europe

Asia & Pacific