1. /
  2. Security Response/
  3. Adware.CWSIEFeats

Adware.CWSIEFeats

Updated:
February 13, 2007 11:41:30 AM
Type:
Adware
Risk Impact:
High
File Names:
feat2.dll,mshp.dll,systk.exe,mfceh.exe,addlv.dll,addmu32.dll,and addrm32.dll
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Adware.CWSIEFeats is executed, it performs the following actions:
  1. Creates or downloads the following files:
    • [directory]\feat2.dll (detected as Adware.CWSIEFeats)
    • %UserProfile%\Local Setting\Temp\2.tmp (a downloader that attempts to download a file from awmdabest.com and is detected as Downloader.Trojan)
    • %System%\s.bat (a batch file dropped by 2.tmp that runs in a continuous loop in an attempt to delete 2.tmp. This causes the CMD.exe process to be active)
    • %System%\mfceh.exe (downloaded by feat2.dll after it is registered and detected as Adware.CWSIEFeats)

      Notes:
    • %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
    • %Userprofile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).

  2. Creates the following files:

    • addlv.dll
    • addmu32.dll
    • addrm32.dll

  3. Creates an .html file, which replaces the about:blank file, under one of the following names:
    • %Windir%\mshp.dll
    • %Windir%kbxun.dl

      Note:
    • %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows (Windows 95/98/Me/XP)or C:\Winnt (Windows NT/2000).

  4. Creates a blacklist file under one of the following names:
    • %Windir%\bl.dat
    • %Windir%\mjjrr.dat

  5. Creates a file containing keywords for targeted advertising under one of the following names:
    • %Windir%\keywords.dat
    • %Windir%\jqfzv.dat
    • %Windir%\rsicgq.log

  6. The file feat2.dll downloads one of the following files and registers it as a service:
    • %Windir%\netrr.exe
    • %System%\systk.ex

  7. The file 2.tmp downloads one of the following files, which is detected as Dialer.WSV:
    • %System%\tibs3.exe
    • %System%\sbar.exe

  8. The files feat2.dll, netrr.exe, and mfceh.exe create the following registry keys when they are registered so they are run whenever Internet Explorer is started:

    HKEY_CLASSES_ROOT\CLSID\{E7EFBCA0-EAB9-E4C5-50C3-79622A93478A}
    HKEY_CLASSES_ROOT\CLSID\{676575DD-4D46-911D-8037-9B10D6EE8BB5}
    HKEY_CLASSES_ROOT\CLSID\{A5B6EDE1-CC5A-B569-AB04-69AC5C0B7B59}
    HKEY_CLASSES_ROOT\CLSID\{7A7FFD7B-4E13-D1D1-FA76-0910B513E4DE}
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7EFBCA0-EAB9-E4C5-50C3-79622A93478A}
    HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks\{E7EFBCA0-EAB9-E4C5-50C3-79622A93478A}
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\HSA
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\SW
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\SE
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\Legacy_[]*008*0010%AF*00E5*0003*0017*001A*00A4*00B6*00C0*00A8
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\[random ASCII characters]

  9. Adds the value:

    "[adware file name]" = "%Windir%\system32\[adware file name]"


    to the registry key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

    so that the Adware runs every time Windows starts.

    Note: "[adware file name]" may be the value "mfceh.exe".

  10. Modifies or creates the following values:

    "Use Search Asst" = "no"
    "Default_Page_URL" = "about:blank"
    "StartPage" = "about:blank"
    "Defaut_Search_URL" = "res://%Windir%\mshp.dll/sp.html#37049"
    "Search Page" = "res://%Windir%\mshp.dll/sp.html#37049"
    "Search Bar" = "res://%Windir%\mshp.dll/sp.html#37049"


    in the registry key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main

    to modify the Internet Explorer start page and search pages.

  11. Modifies or creates the values:

    "Use Search Asst" = "no"
    "Start Page" = "about:blank"
    "Search Page" = "res://%Windir%\mshp.dll/sp.html#37049"
    "Search Bar" = "res://%Windir%\mshp.dll/sp.html#37049"


    in the registry key:

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main

    to modify the Internet Explorer start page and search pages.

  12. Modifies or creates the value:

    "SearchAssistant" = "res://%Windir%\mshp.dll/sp.html#37049"

    in the registry key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search

    to modify the Internet Explorer search pages.


Summary| Technical Details| Removal

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report
Symantec DeepSight Screensaver