Content

AdClicker-DW

Type
Trojan
SubType
Win32
Discovery Date
12/19/2005
Length
Minimum DAT
4653 (12/19/2005)
Updated DAT
5242 (02/29/2008)
Minimum Engine
5.1.00
Description Added
12/19/2005
Description Modified
01/29/2006 7:55 PM (PT)
Risk Assessment
Corporate User
Low
Home User
Low

Tab Navigation

Characteristics

This trojan installs two BHOs to Internet Explorer.

It may use following aliases to connect to epromosystems.com in order to download more malicious files and to show targeted ads.At the time of testing the sample the download sites were down.

  • http://sortbycool.info
  • http://somethngcool.info
  • http://wannabcool.info
  • http://CLEVERHEAD.INFO
  • http://mucho-cool.com
  • http://epromosystems.com

DNS query on most of the sites above return the common IP address of 200.73.174.158.

Files Added

  • %WINDIR% \system32\kaboom.dll (44544 Bytes)
  • %WINDIR% \system32\gtrack.dll ( 30208 bytes )

Registry

The following registry keys are created:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\
    {4BC9A7AC-2329-49D0-B07F-5FE484029DC2}\VersionIndependentProgID\:
    "Watcher.GoogleTracker"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\
    {4BC9A7AC-2329-49D0-B07F-5FE484029DC2}\TypeLib\: "
    {023E6659-1A0A-4724-9273-66EA06A82C98}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\
    {4BC9A7AC-2329-49D0-B07F-5FE484029DC2}\ProgID\:

    "Watcher.GoogleTracker.1"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

    {4BC9A7AC-2329-49D0-B07F-5FE484029DC2}\InprocServer32\:

    "C:\WINDOWS\System32\gtrack.dll"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

    {4BC9A7AC-2329-49D0-B07F-5FE484029DC2}\InprocServer32\

    ThreadingModel: "Apartment"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

    {4BC9A7AC-2329-49D0-B07F-5FE484029DC2}\: "GoogleTracker"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

    {A853979C-2A9A-4ACB-8975-5740A7E26CB4}\VersionIndependentProgID\:

    "Kaboom.IEagent"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

    {A853979C-2A9A-4ACB-8975-5740A7E26CB4}\TypeLib\:

    "{E0C0FC76-CC5E-46E2-B77A-4C2ADD965B9F}"

    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

    {A853979C-2A9A-4ACB-8975-5740A7E26CB4}\ProgID\: "Kaboom.IEagent.1"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

    {A853979C-2A9A-4ACB-8975-5740A7E26CB4}\InprocServer32\:

    "C:\WINDOWS\System32\kaboom.dll"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

    {A853979C-2A9A-4ACB-8975-5740A7E26CB4}\InprocServer32\

    ThreadingModel: "Apartment"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\
    {A853979C-2A9A-4ACB-8975-5740A7E26CB4}\: "Site Update Watcher"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
    {BAA919E5-FD47-4D7E-95AB-5B2CDA493358}\TypeLib\: "{E0C0FC76-CC5E-46E2-B77A-4C2ADD965B9F}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
    {BAA919E5-FD47-4D7E-95AB-5B2CDA493358}\TypeLib\Version: "1.0"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
    {BAA919E5-FD47-4D7E-95AB-5B2CDA493358}\ProxyStubClsid32\: "
    {00020424-0000-0000-C000-000000000046}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
    {BAA919E5-FD47-4D7E-95AB-5B2CDA493358}\ProxyStubClsid\: "
    {00020424-0000-0000-C000-000000000046}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
    {BAA919E5-FD47-4D7E-95AB-5B2CDA493358}\: "IIEagent"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
    {D861BD5E-E1E7-4E5E-AB15-CB347FBDBC6D}\TypeLib\: "
    {023E6659-1A0A-4724-9273-66EA06A82C98}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
    {D861BD5E-E1E7-4E5E-AB15-CB347FBDBC6D}\TypeLib\Version: "1.0"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
    {D861BD5E-E1E7-4E5E-AB15-CB347FBDBC6D}\ProxyStubClsid32\:
    "{00020424-0000-0000-C000-000000000046}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
    {D861BD5E-E1E7-4E5E-AB15-CB347FBDBC6D}\ProxyStubClsid\:
    "{00020424-0000-0000-C000-000000000046}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
    {D861BD5E-E1E7-4E5E-AB15-CB347FBDBC6D}\: "IGoogleTracker"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\
    {023E6659-1A0A-4724-9273-66EA06A82C98}\1.0\0\win32\:
    "C:\WINDOWS\System32\gtrack.dll"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\
    {023E6659-1A0A-4724-9273-66EA06A82C98}\1.0\HELPDIR\:
    "C:\WINDOWS\System32\"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\
    {023E6659-1A0A-4724-9273-66EA06A82C98}\1.0\FLAGS\: "0"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\
    {023E6659-1A0A-4724-9273-66EA06A82C98}\1.0\: "watcher 1.0 Type Library"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\
    {E0C0FC76-CC5E-46E2-B77A-4C2ADD965B9F}\1.0\0\win32\:
      "C:\WINDOWS\System32\kaboom.dll"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\
    {E0C0FC76-CC5E-46E2-B77A-4C2ADD965B9F}\1.0\HELPDIR\:
    "C:\WINDOWS\System32\"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\
    {E0C0FC76-CC5E-46E2-B77A-4C2ADD965B9F}\1.0\FLAGS\: "0"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\
    {E0C0FC76-CC5E-46E2-B77A-4C2ADD965B9F}\1.0\: "kaboom 1.0 Type Library"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kaboom.
    IEagent\CurVer\: "Kaboom.IEagent.1"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kaboom.IEagent\CLSID\: "{A853979C-2A9A-4ACB-8975-5740A7E26CB4}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kaboom.IEagent\:
      "Site Update Watcher"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kaboom.IEagent.1\CLSID\:
    "{A853979C-2A9A-4ACB-8975-5740A7E26CB4}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kaboom.IEagent.1\: "Site Update Watcher"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Watcher.
    GoogleTrackerCurVer\: "Watcher.GoogleTracker.1"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Watcher.GoogleTracker\
    CLSID\: "{4BC9A7AC-2329-49D0-B07F-5FE484029DC2}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Watcher.GoogleTracker\: "GoogleTracker"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Watcher.GoogleTracker.1\CLSID\:
      "{4BC9A7AC-2329-49D0-B07F-5FE484029DC2}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Watcher.GoogleTracker.1\:  "GoogleTracker"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SUW\campaign_id: "0"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SUW\is_dialup: 0x00000000

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SUW\sleep_delay: 0x00000005

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SUW\install_delay: 0x000021C0

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SUW\main_delay: 0x000005A0

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SUW\stage: 0x00000000

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SUW\timeout: 0x43C578FB

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SUW\user_id: "235271"

Symptoms

Presence of aforementioned files and registry keys.

Method of Infection

Trojans do not self-replicate. They spread manually, often under the premise that the executable is something beneficial.
Trojans may also be received as a result of poor security practices, or un-patched machines and vulnerable systems.
Distribution channels include IRC, peer-to-peer networks, email, newsgroups postings, etc.

Removal

AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

Additional Windows ME/XP removal considerations

Variants

Variants

    N/A

All Information

Overview -

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

Characteristics -

This trojan installs two BHOs to Internet Explorer.

It may use following aliases to connect to epromosystems.com in order to download more malicious files and to show targeted ads.At the time of testing the sample the download sites were down.

  • http://sortbycool.info
  • http://somethngcool.info
  • http://wannabcool.info
  • http://CLEVERHEAD.INFO
  • http://mucho-cool.com
  • http://epromosystems.com

DNS query on most of the sites above return the common IP address of 200.73.174.158.

Files Added

  • %WINDIR% \system32\kaboom.dll (44544 Bytes)
  • %WINDIR% \system32\gtrack.dll ( 30208 bytes )

Registry

The following registry keys are created:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\
    {4BC9A7AC-2329-49D0-B07F-5FE484029DC2}\VersionIndependentProgID\:
    "Watcher.GoogleTracker"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\
    {4BC9A7AC-2329-49D0-B07F-5FE484029DC2}\TypeLib\: "
    {023E6659-1A0A-4724-9273-66EA06A82C98}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\
    {4BC9A7AC-2329-49D0-B07F-5FE484029DC2}\ProgID\:

    "Watcher.GoogleTracker.1"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

    {4BC9A7AC-2329-49D0-B07F-5FE484029DC2}\InprocServer32\:

    "C:\WINDOWS\System32\gtrack.dll"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

    {4BC9A7AC-2329-49D0-B07F-5FE484029DC2}\InprocServer32\

    ThreadingModel: "Apartment"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

    {4BC9A7AC-2329-49D0-B07F-5FE484029DC2}\: "GoogleTracker"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

    {A853979C-2A9A-4ACB-8975-5740A7E26CB4}\VersionIndependentProgID\:

    "Kaboom.IEagent"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

    {A853979C-2A9A-4ACB-8975-5740A7E26CB4}\TypeLib\:

    "{E0C0FC76-CC5E-46E2-B77A-4C2ADD965B9F}"

    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

    {A853979C-2A9A-4ACB-8975-5740A7E26CB4}\ProgID\: "Kaboom.IEagent.1"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

    {A853979C-2A9A-4ACB-8975-5740A7E26CB4}\InprocServer32\:

    "C:\WINDOWS\System32\kaboom.dll"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

    {A853979C-2A9A-4ACB-8975-5740A7E26CB4}\InprocServer32\

    ThreadingModel: "Apartment"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\
    {A853979C-2A9A-4ACB-8975-5740A7E26CB4}\: "Site Update Watcher"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
    {BAA919E5-FD47-4D7E-95AB-5B2CDA493358}\TypeLib\: "{E0C0FC76-CC5E-46E2-B77A-4C2ADD965B9F}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
    {BAA919E5-FD47-4D7E-95AB-5B2CDA493358}\TypeLib\Version: "1.0"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
    {BAA919E5-FD47-4D7E-95AB-5B2CDA493358}\ProxyStubClsid32\: "
    {00020424-0000-0000-C000-000000000046}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
    {BAA919E5-FD47-4D7E-95AB-5B2CDA493358}\ProxyStubClsid\: "
    {00020424-0000-0000-C000-000000000046}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
    {BAA919E5-FD47-4D7E-95AB-5B2CDA493358}\: "IIEagent"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
    {D861BD5E-E1E7-4E5E-AB15-CB347FBDBC6D}\TypeLib\: "
    {023E6659-1A0A-4724-9273-66EA06A82C98}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
    {D861BD5E-E1E7-4E5E-AB15-CB347FBDBC6D}\TypeLib\Version: "1.0"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
    {D861BD5E-E1E7-4E5E-AB15-CB347FBDBC6D}\ProxyStubClsid32\:
    "{00020424-0000-0000-C000-000000000046}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
    {D861BD5E-E1E7-4E5E-AB15-CB347FBDBC6D}\ProxyStubClsid\:
    "{00020424-0000-0000-C000-000000000046}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
    {D861BD5E-E1E7-4E5E-AB15-CB347FBDBC6D}\: "IGoogleTracker"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\
    {023E6659-1A0A-4724-9273-66EA06A82C98}\1.0\0\win32\:
    "C:\WINDOWS\System32\gtrack.dll"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\
    {023E6659-1A0A-4724-9273-66EA06A82C98}\1.0\HELPDIR\:
    "C:\WINDOWS\System32\"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\
    {023E6659-1A0A-4724-9273-66EA06A82C98}\1.0\FLAGS\: "0"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\
    {023E6659-1A0A-4724-9273-66EA06A82C98}\1.0\: "watcher 1.0 Type Library"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\
    {E0C0FC76-CC5E-46E2-B77A-4C2ADD965B9F}\1.0\0\win32\:
      "C:\WINDOWS\System32\kaboom.dll"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\
    {E0C0FC76-CC5E-46E2-B77A-4C2ADD965B9F}\1.0\HELPDIR\:
    "C:\WINDOWS\System32\"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\
    {E0C0FC76-CC5E-46E2-B77A-4C2ADD965B9F}\1.0\FLAGS\: "0"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\
    {E0C0FC76-CC5E-46E2-B77A-4C2ADD965B9F}\1.0\: "kaboom 1.0 Type Library"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kaboom.
    IEagent\CurVer\: "Kaboom.IEagent.1"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kaboom.IEagent\CLSID\: "{A853979C-2A9A-4ACB-8975-5740A7E26CB4}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kaboom.IEagent\:
      "Site Update Watcher"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kaboom.IEagent.1\CLSID\:
    "{A853979C-2A9A-4ACB-8975-5740A7E26CB4}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kaboom.IEagent.1\: "Site Update Watcher"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Watcher.
    GoogleTrackerCurVer\: "Watcher.GoogleTracker.1"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Watcher.GoogleTracker\
    CLSID\: "{4BC9A7AC-2329-49D0-B07F-5FE484029DC2}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Watcher.GoogleTracker\: "GoogleTracker"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Watcher.GoogleTracker.1\CLSID\:
      "{4BC9A7AC-2329-49D0-B07F-5FE484029DC2}"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Watcher.GoogleTracker.1\:  "GoogleTracker"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SUW\campaign_id: "0"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SUW\is_dialup: 0x00000000

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SUW\sleep_delay: 0x00000005

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SUW\install_delay: 0x000021C0

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SUW\main_delay: 0x000005A0

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SUW\stage: 0x00000000

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SUW\timeout: 0x43C578FB

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SUW\user_id: "235271"

Symptoms

Symptoms -

Presence of aforementioned files and registry keys.

Method of Infection

Method of Infection -

Trojans do not self-replicate. They spread manually, often under the premise that the executable is something beneficial.
Trojans may also be received as a result of poor security practices, or un-patched machines and vulnerable systems.
Distribution channels include IRC, peer-to-peer networks, email, newsgroups postings, etc.

Removal -

Removal -

AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

Additional Windows ME/XP removal considerations

Variants

Variants -

    N/A