ADW_DLOADR

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This adware drops the following files:

• %Application Data%\iSafe\preference.ini
• %Application Data%\iSafe\log\bugreport.zip
• %Application Data%\iSafe\log\install.log
• %Application Data%\iSafe\log\iSafeTray.log
• %Application Data%\iSafe\log\uninstall.log
• %Application Data%\iSafe\log_bak\iSafeKrnlCall.LOG
• %Application Data%\iSafe\log_bak\iSafeSvc2.LOG
• %Program Files%\iSafe\iSafeKrnl.sys
• %Program Files%\iSafe\skin2\image\new\{multiple files}.png
• %Program Files%\iSafe\skin2\layout\new\{multiple files}.xml
• %Program Files%\iSafe\skin2\layout\new\pop\{multiple files}.xml
• %Program Files%\iSafe\tws\defs\base0000.dat
• %Program Files%\iSafe\tws\defs\catalog.dat
• %Program Files%\iSafe\tws\plugins\filavutd.dll
• %Program Files%\iSafe\tws\plugins\virut.tmp
• %Program Files%\iSafe\tws\quarantine\catalog.dat
• %User Temp%\downloader_helper.ini

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It drops and executes the following files:

• %User Temp%\dl_{random digits}.exe
• %User Temp%\DL_00000000\dl.exe
• %User Temp%\ISAFE_00000000\uninstall.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It creates the following folders:

• %All Users Profile%\Start Menu\Programs\YAC
• %Application Data%\iSafe
• %Application Data%\iSafe\log
• %Application Data%\iSafe\log_bak
• %Program Files%\iSafe
• %Program Files%\iSafe\cfg
• %Program Files%\iSafe\data
• %Program Files%\iSafe\font
• %Program Files%\iSafe\lang
• %Program Files%\iSafe\log
• %Program Files%\iSafe\skin2
• %Program Files%\iSafe\skin2\image
• %Program Files%\iSafe\skin2\image\new
• %Program Files%\iSafe\skin2\layout
• %Program Files%\iSafe\skin2\layout
• %Program Files%\iSafe\skin2\layout\new
• %Program Files%\iSafe\skin2\layout\new\pop
• %Program Files%\iSafe\skin2\sytle
• %Program Files%\iSafe\tws
• %Program Files%\iSafe\tws\defs
• %Program Files%\iSafe\tws\logs
• %Program Files%\iSafe\tws\plugins
• %Program Files%\iSafe\tws\quarantine
• %Program Files%\iSafe\tws\task
• %Program Files%\iSafe\tws\temp
• %Program Files%\iSafe\tws\trace
• %Program Files%\iSafe\tws\x64
• %Program Files%\iSafe\user

(Note: %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)

Autostart Technique

This adware registers its dropped component as a system service to ensure its automatic execution at every system startup. It does this by creating the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\iSafeNetFilter
DisplayName = "iSafeNetFilter"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\iSafeNetFilter
ImagePath = "%Program Files%\iSafe\iSafeNetFilter.sys"

It registers its dropped component as a system service to ensure its automatic execution at every system startup. It does this by creating the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\iSafeNetFilter

Other System Modifications

This adware adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
MenuOrder\Start Menu2\Programs\
YAC

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Session Manager
PendingFileRenameOperations = "{hex values}"

Other Details

This adware connects to the following possibly malicious URL:

• http://www.{BLOCKED}c.mx/{BLOCKED}load/config/db.php?name={malware file name}
• http://www.{BLOCKED}c.mx/{BLOCKED}nload/config/default.db
• http://www.{BLOCKED}c.mx/en/{BLOCKED}ion.html?uid=411f3a52-26ed-4872-9a07-8c966acba234_b0b2d6e3_1395017691
• http://www.{BLOCKED}.{BLOCKED}oud.com/v4/sof-easydl/VBOX_HARDDISK_VB316f4beb-ff70531b?action=dft.YAC.start
• {BLOCKED}3.{BLOCKED}3.180.130:80/original/iSafe_setup.exe
• http://www.{BLOCKED}m.{BLOCKED}65.com/ads/sendss?sid=yac&ptid=dft&hdid=VBOX_HARDDISK_VB316f4beb-ff70531b
• http://www.{BLOCKED}c.mx/{BLOCKED}nload/config/default.db