McAfee > Theat Center > PUP Detail Page

Characteristics

McAfee(R) AVERT™ recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application. If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software. Please contact the software vendor for further information.

See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.

Summary:

This is not a virus or Trojan. It is a direct adware marketing application. Upon execution it adds a toolbar in the Internet Explorer. It adds several Browser Helper Objects (BHO) and adds itself in system tray. In the background it makes internet connections with “exfol.com”, “clickspring.net” and “spywarelabs.com”. It also gives some popup while browsing the internet.
Upon execution following window appears.

Privacy:

No license agreement is displayed during installation, although one can be seen online by the link provided at the time of execution.

Installation:

File name: Pawn008.exe
MD5Hash: a82460ab45b427eb87164be2b770bab8

File name: TMS008.exe 
MD5Hash: 38c942e52b30d781957047a9373c4af0

On the execution of the application, a toolbar is installed as shown below.

Following folder are added in

• %Program Files%\AdDestroyer
• %Program Files%\Internet Optimizer
• %Program Files%\NaviSearch
• %Program Files%\SurfSideKick 3
• %Program Files%\VBouncer
• %Windows%\bsx32
• %Windows%\LastGood

Following files are added:

• tsuninst.exe
• VB1.exe
• zdinst_CORN001.exe
• sate.exe
• capp99.exe
• btnetInst.exe
• GLF85GLF85.EXE
• ts_8_new.exe
• tsinstall_4_0_3_8_b17.exe
• tsupdate_4_0_3_9_b2.exe
• McAppins.exe
• Setup.exe
• sf.exe
• ts_8_new.exe
• omf.exe
• AdDestroyer.exe
• adv.exe
• adx.exe
• bargains.exe
• wurma.exe
• wurml.exe
• wurmm.exe
• wurmp.exe
• optimize.exe
• nls.exe
• sf.exe
• snss.exe
• sk.exe
• Ssk3RepairInstall.exe
• AdDestroyerInner.EXE
• BundleOuter.EXE
• VBouncerInner.EXE
• VirtualBouncer.exe
• A0000573.exe (Some more EXEs with almost similar name are also dropped.)
• ahbutfco.exe
• newfrn.exe
• omf.exe
• pf79.exe
• pwmbusc.exe
• rk.exe
• shggftu.exe
• command.exe
• app_b.exe
• bk.exe
• dwdsregt.exe
• exdl.exe
• exdl1.exe
• exdl2.exe
• exul.exe
• exul1.exe
• irasyncd.exe
• kwinssaw.exe
• veiyxstx.dll
• asappsrv.dll
• irasvozz.dll
• msbe.dll
• nsi11.dll
• nsj9.dll
• nsuA.dll
• nvms.dll
• PopOops.dll
• PopOops2.dll
• repairs302972988.dll
• SWLAD1.dll
• SWLAD2.dll
• ExtractDLL.dll
• bxxs5.dll
• ltsiyhpe.dll
• nem220.dll
• A0000695.dll (Some more dlls with almost similar name are also dropped.)
• nem220.dll
• ADXML43.dll
• wurmc.dll
• freeprod.dll
• SskBho.dll
• SskCore.dll
• SetupRes.dll
• A0000600.dll

Following registry keys are added:

• HKEY_CURRENT_USER\Software\Avenue Media
• HKEY_CURRENT_USER\Software\Director
• HKEY_CURRENT_USER\Software\DR_S
• HKEY_CURRENT_USER\Software\In3rd
• HKEY_CURRENT_USER\Software\Netsetter
• HKEY_CURRENT_USER\Software\Policies\Avenue Media
• HKEY_CURRENT_USER\Software\searchforit
• HKEY_CURRENT_USER\Software\SurfSideKick3
• HKEY_CURRENT_USER\Software\VB and VBA Program Settings\AdDestroyer
• HKEY_CURRENT_USER\Software\VB and VBA Program Settings\VBouncer
• HKEY_CURRENT_USER\Software\XBTB07618
• HKEY_CLASSES_ROOT\CLSID\{00000010-6F7D-442C-93E3-4A4827C2E4C8}
• HKEY_CLASSES_ROOT\CLSID\{0019C3E2-DD48-4A6D-ABCD-8D32436323D9}
• HKEY_CLASSES_ROOT\CLSID\{02EE5B04-F144-47BB-83FB-A60BD91B74A9}
• HKEY_CLASSES_ROOT\CLSID\{09D98DB3-217F-4a37-950F-7FA1B08CE2B6}
• HKEY_CLASSES_ROOT\CLSID\{2296428D-C133-4928-B76A-A200FF409572}
• HKEY_CLASSES_ROOT\CLSID\{417386C3-8D4A-4611-9B91-E57E89D603AC}
• HKEY_CLASSES_ROOT\CLSID\{55B0D4C9-D320-BD1B-461D-9EF984FE961D}
• HKEY_CLASSES_ROOT\CLSID\{77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F}
• HKEY_CLASSES_ROOT\CLSID\{80715D9C-9D90-9ABE-4DDA-39C24CA25C79}
• HKEY_CLASSES_ROOT\CLSID\{95C60327-8E17-44D6-98EB-7EB70CC606DD}
• HKEY_CLASSES_ROOT\CLSID\{9ADE0443-2AB2-4B23-A3F8-AC520773DE12}
• HKEY_CLASSES_ROOT\CLSID\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344}
• HKEY_CLASSES_ROOT\CLSID\{B89E1A46-2768-646A-D303-0604E7946077}
• HKEY_CLASSES_ROOT\CLSID\{BC54B24C-5A97-4C19-9181-8B8A05B2E931}
• HKEY_CLASSES_ROOT\CLSID\{BD9584EF-C28C-4F6D-8D49-0CEE3C0E442F}
• HKEY_CLASSES_ROOT\CLSID\{C7888681-1A83-4C14-B9A5-95F91240B44F}
• HKEY_CLASSES_ROOT\CLSID\{D52433A9-A44C-43AB-A013-24B3C756DD2B}
• HKEY_CLASSES_ROOT\CLSID\{F4E04583-354E-4076-BE7D-ED6A80FD66DA}
• HKEY_CLASSES_ROOT\Interface\{05080E6B-A88A-4CFD-8C3D-9B2557670B6E}
• HKEY_CLASSES_ROOT\Interface\{10D7DB96-56DC-4617-8EAB-EC506ABE6C7E}
• HKEY_CLASSES_ROOT\Interface\{1C01D150-91A4-4DE0-9BF8-A35D1BDF1001}
• HKEY_CLASSES_ROOT\Interface\{6CDC3337-01F7-4A79-A4AF-0B19303CC0BE}
• HKEY_CLASSES_ROOT\Interface\{795398D0-DC2F-4118-A69C-592273BA9C2B}
• HKEY_CLASSES_ROOT\Interface\{8EEE58D5-130E-4CBD-9C83-35A0564E1357}
• HKEY_CLASSES_ROOT\Interface\{B288F21C-A144-4CA2-9B70-8AFA1FAE4B06}
• HKEY_CLASSES_ROOT\Interface\{C6906A23-4717-4E1F-B6FD-F06EBED11357}
• HKEY_CLASSES_ROOT\TypeLib\{0DC5CD7C-F653-4417-AA43-D457BE3A9622}
• HKEY_CLASSES_ROOT\TypeLib\{40B1D454-9CA4-43CC-86AA-CB175EAC52FB}
• HKEY_CLASSES_ROOT\TypeLib\{4DFD0B10-93DB-4D7E-9B34-3D92CA493BE4}
• HKEY_CLASSES_ROOT\TypeLib\{4EB7BBE8-2E15-424B-9DDB-2CDB9516B2C3}
• HKEY_CLASSES_ROOT\TypeLib\{5279231E-FABE-4ABF-83A8-7C7E17E3CE1A}
• HKEY_CLASSES_ROOT\TypeLib\{53FD0D58-CD25-4E54-AD0A-A1BDE2FE5A94}
• HKEY_CLASSES_ROOT\TypeLib\{BF56BE6A-0AEA-45F3-8B10-7312876584A8}
• HKEY_CLASSES_ROOT\TypeLib\{D0C29A75-7146-4737-98EE-BC4D7CF44AF9}
• HKEY_CLASSES_ROOT\TypeLib\{D4C89C18-B4F3-46A9-8800-E9E7A55AFBD9}
• HKEY_CLASSES_ROOT\TypeLib\{E0D3B292-A0B0-4640-975C-2F882E039F52}
• HKEY_CLASSES_ROOT\Var9.IRiras
• HKEY_CLASSES_ROOT\XBTB07618.XBTB07618
• HKEY_CLASSES_ROOT\Main.MimeFilter.1
• HKEY_CLASSES_ROOT\NLS.UrlCatcher
• HKEY_CLASSES_ROOT\PopOops2.PopOops
• HKEY_CLASSES_ROOT\SWLAD1.SWLAD
• HKEY_CLASSES_ROOT\ToolBand.XBTP07618
• HKEY_CLASSES_ROOT\drs.n
• HKEY_CLASSES_ROOT\DyFuCA_BH.BHObj
• HKEY_CLASSES_ROOT\ADP.UrlCatcher
  HKEY_CLASSES_ROOT\AppID\{0DC5CD7C-F653-4417-AA43-D457BE3A9622}
• HKEY_CLASSES_ROOT\AppID\{E0DC5CC4-25A5-4BC7-A3AA-3525733DC796}
• HKEY_CLASSES_ROOT\AppID\BookedSpace.DLL
• HKEY_CLASSES_ROOT\AppID\Main.DLL
• HKEY_CLASSES_ROOT\BHO.Adware
• HKEY_CLASSES_ROOT\BHO.Hider
• HKEY_CLASSES_ROOT\BookedSpace.Extension
• HKEY_CLASSES_ROOT\btnetw.amo
• HKEY_CLASSES_ROOT\btnetw.iiittt
• HKEY_CLASSES_ROOT\btnetw.momo
• HKEY_CLASSES_ROOT\btnetw.ohb
• HKEY_LOCAL_MACHINE\SOFTWARE\Bargains
• HKEY_LOCAL_MACHINE\SOFTWARE\Bookedspace
• HKEY_LOCAL_MACHINE\SOFTWARE\ClickSpring
• HKEY_LOCAL_MACHINE\SOFTWARE\eXactUtil
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\Explorer\Browser Helper Objects\{00000010-6F7D-442C-93E3-4A4827C2E4C8}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\Explorer\Browser Helper Objects\{0019C3E2-
  DD48-4A6D-ABCD-8D32436323D9}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\Explorer\Browser Helper Objects\{2296428D-
  C133-4928-B76A-A200FF409572}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\Explorer\Browser Helper Objects\{55BE9F0D-
  6CAF-4c3e-B125-5A13A8C9D0EC}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\Explorer\Browser Helper Objects\{80715D9C-9D90-9ABE-4DDA-39C24CA25C79}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\Explorer\Browser Helper Objects\{95C60327-8E17-44D6-98EB-7EB70CC606DD}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\Explorer\Browser Helper Objects\{9ADE0443-2AB2-4B23-A3F8-AC520773DE12}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\Explorer\Browser Helper Objects\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\Explorer\Browser Helper Objects\{F4E04583-354E-4076-BE7D-ED6A80FD66DA}
• HKEY_LOCAL_MACHINE\SOFTWARE\NaviSearch
• HKEY_LOCAL_MACHINE\SOFTWARE\snss
• HKEY_LOCAL_MACHINE\SOFTWARE\TSA

Removal

Aliases

Aliases

• Trj/Downloader.GPU - Panda