ADW_BROWADS

This adware arrives as a component bundled with malware/grayware packages. It may be manually installed by a user.

It creates folders where it drops its files.

It comes with an uninstall package that completely removes the files it dropped and the registries it created.

Arrival Details

This adware arrives as a component bundled with malware/grayware packages.

It may be manually installed by a user.

Installation

This adware drops the following files:

• %User Temp%\_{11 random alphanumeric numbers 1}.bat
• %User Temp%\_{11 random alphanumeric numbers 2}.bat
• %User Temp%\_{11 random alphanumeric numbers 3}.bat
• %User Temp%\_{11 random alphanumeric numbers 4}.bat

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

• %Program Files%\Common Files\DealAlly
• %Program Files%\Common Files\Diagnostics

(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)

Autostart Technique

This adware registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\Diagnostics
Type = "10"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\Diagnostics
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\Diagnostics
ErrorControl = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\Diagnostics
ImagePath = ""%Program Files%\Common Files\Diagnostics\node\service.exe" -s "%Program Files%\Common Files\Diagnostics\node\diagnostics.js""

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\Diagnostics
DisplayName = "Diagnostics"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\Diagnostics
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\Diagnostics
Description = "Diagnostics service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\Proxy
Type = "10"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\Proxy
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\Proxy
ErrorControl = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\Proxy
ImagePath = ""%Program Files%\Common Files\Diagnostics\node\service.exe" -s "%Program Files%\Common Files\Diagnostics\node\proxy_master.js""

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\Proxy
DisplayName = "Proxy"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\Proxy
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\Proxy
Description = "Proxy service"

It registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\Diagnostics

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\Proxy

Other System Modifications

This adware adds the following registry entries:

HKEY_CURRENT_USER\Software\Classes\
Software\Microsoft\Windows\
CurrentVersion\Internet Settings
ProxyServer = "127.0.0.1:5050"

HKEY_CURRENT_USER\Software\Classes\
Software\Microsoft\Windows\
CurrentVersion\Internet Settings
ProxyEnable = "1"

It adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
CurrentVersion\Uninstall\DealAlly

Other Details

This adware adds the following registry entries to add an uninstall option to the Control Panel:

HKEY_CURRENT_USER\Software\Microsoft\
CurrentVersion\Uninstall\DealAlly
DisplayName = "DealAlly"

HKEY_CURRENT_USER\Software\Microsoft\
CurrentVersion\Uninstall\DealAlly
UninstallString = "%Program Files%\Common Files\DealAlly\uninst.exe"

HKEY_CURRENT_USER\Software\Microsoft\
CurrentVersion\Uninstall\DealAlly
DisplayVersion = "1"

HKEY_CURRENT_USER\Software\Microsoft\
CurrentVersion\Uninstall\DealAlly
Publisher = "Jet Applications"

It comes with an uninstall package that completely removes the files it dropped and the registries it added.

NOTES:

This adware uses its created folders to drop its installation component files.