Content

Adware-Crackedearth.dr

Type
Program
SubType
Dropper
Discovery Date
02/20/2006
Minimum DAT
4701 (02/20/2006)
Updated DAT
4701 (02/20/2006)
Minimum Engine
5.1.00
Description Added
02/20/2006
Description Modified
02/22/2006 3:18 AM (PT)

Tab Navigation

Characteristics

McAfee(R) AVERT™ recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application. If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software. Please contact the software vendor for further information.

See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.


Summary

This is not a virus or a Trojan. It is an adware dropper which drops adware component on the system. Upon execution, a setup window is displayed indicating the folder created and files dropped. The installer drops a dll which gets injected into the Internet Explorer. This dll is responsible for connecting to some sites whenever some specific keyword is typed in the Internet Explorer address bar.

For example, when typed "map" in the IE address bar, the following web page is displayed:

Similarly, different web pages can be seen for the following words:

  • weather
  • showtimes
  • encyclopedia

Privacy

No license agreement is displayed during installation, although one could be displayed by another installer if bundled with another application. No privacy policy related to the software could be found.

System Changes

File name: 243f9ae2.exe
MD5Hash: af575e1f6b5abeee3eb52f114d89c075

Upon executing the application, “C:\Program Files\smarturl” folder is created and following files are dropped in it:

  • SmartURL.dll
  • SmartURL.txt

Following registry entries are added:

  • HKEY_CLASSES_ROOT\CLSID\{C5067F59-9D0D-11D2-AA90-000000000000}
  • HKEY_CLASSES_ROOT\CLSID\{F08555B0-9CC3-11D2-AA8E-000000000000}
  • HKEY_CLASSES_ROOT\Interface\{F08555AF-9CC3-11D2-AA8E-000000000000}
  • HKEY_CLASSES_ROOT\SearchHook.SrchHook
  • HKEY_CLASSES_ROOT\SearchHook.SrchHook.1
  • HKEY_CLASSES_ROOT\SearchHook.URLSearchHook
  • HKEY_CLASSES_ROOT\SearchHook.URLSearchHook.1
  • HKEY_CLASSES_ROOT\TypeLib\{F08555A1-9CC3-11D2-AA8E-000000000000}
  • HKEY_LOCAL_MACHINE\SOFTWARE\android5
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
    Uninstall\smarturl

Aliases

Aliases

  • Spyware/ShopNav : Panda