Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\UninstallMonitor.job
Malicious functions:
Executes the following:
- '%TEMP%\RarSFX0\checker.exe' 600 -INNO
- '%TEMP%\RarSFX0\uninstaller.exe' -AUSCAN
- '%TEMP%\RarSFX0\uninstaller.exe'
Modifies file system:
Creates the following files:
- %TEMP%\RarSFX0\loading_bar.avi
- %TEMP%\RarSFX0\loading_ajax.gif
- %TEMP%\RarSFX0\Monitor.ESN.lng
- %TEMP%\RarSFX0\mon_run.exe
- %TEMP%\RarSFX0\innoupd.exe
- %TEMP%\RarSFX0\InnoSolAUPUOs.exe
- %TEMP%\RarSFX0\loading.gif
- %TEMP%\RarSFX0\LoaderRunOnce.exe
- %TEMP%\RarSFX0\Monitor.PTB.lng
- %TEMP%\RarSFX0\Monitor.ntv.lng
- %TEMP%\RarSFX0\red_star.bmp
- %TEMP%\RarSFX0\Monitor.SVE.lng
- %TEMP%\RarSFX0\Monitor.FIN.lng
- %TEMP%\RarSFX0\Monitor.exe
- %TEMP%\RarSFX0\Monitor.JPN.lng
- %TEMP%\RarSFX0\Monitor.FRA.lng
- %TEMP%\RarSFX0\bw_star.bmp
- %TEMP%\RarSFX0\advanced_uninstaller_pro.chm
- %TEMP%\RarSFX0\entries1.dat
- %TEMP%\RarSFX0\checker.exe
- %TEMP%\RarSFX0\ServicesProfiles\ProfilesXP_SP2\sp2_Pro.AUP
- %TEMP%\RarSFX0\ServicesProfiles\ProfilesXP_SP2\sp2_Power User.AUP
- %TEMP%\RarSFX0\adv_lib.exe
- %TEMP%\RarSFX0\ServicesProfiles\ProfilesXP_SP2\sp2_SAFE.AUP
- %TEMP%\RarSFX0\HealthCheck.ntv.lng
- %TEMP%\RarSFX0\healthcheck.exe
- %TEMP%\RarSFX0\HealthCheck.SVE.lng
- %TEMP%\RarSFX0\HealthCheck.PTB.lng
- %TEMP%\RarSFX0\explorer.exe
- %TEMP%\RarSFX0\entries2.dat
- %TEMP%\RarSFX0\HealthCheck.ESN.lng
- %TEMP%\RarSFX0\green_star.bmp
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\7b96414ebcc14f2eb0c5c91dc1eab3a6.dat
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\1ec3ff0e63884c082dc1846e4ee1518c.ico
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\2db30adfad495ff9aa986f9d178b5cf1.dat
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\7b96414ebcc14f2eb0c5c91dc1eab3a6.ico
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\46bbf37b7cdeb41e09059c2aea721961.dat
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\c747045314b57dc6ddc35b5f1219a196.ico
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\1ec3ff0e63884c082dc1846e4ee1518c.dat
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\46bbf37b7cdeb41e09059c2aea721961.ico
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\01d1f8cf2b1339dee2149008ad1108e2.dat
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\c7d64258f4bbe73fc3d3d2129e1c3044.ico
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\list.dat
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\01d1f8cf2b1339dee2149008ad1108e2.ico
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\0c7518c6b1b03be438a8623bcc71e617.dat
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\2db30adfad495ff9aa986f9d178b5cf1.ico
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\c7d64258f4bbe73fc3d3d2129e1c3044.dat
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\0c7518c6b1b03be438a8623bcc71e617.ico
- %TEMP%\RarSFX0\uninstaller.FRA.lng
- %TEMP%\RarSFX0\uninstaller.FIN.lng
- %TEMP%\RarSFX0\uninstaller.ntv.lng
- %TEMP%\RarSFX0\uninstaller.JPN.lng
- %TEMP%\RarSFX0\stop_aup.exe
- %TEMP%\RarSFX0\sqlite3.dll
- %TEMP%\RarSFX0\uninstaller.exe
- %TEMP%\RarSFX0\uninstaller.ESN.lng
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\5343d75d3e3864514800add26a22225e.dat
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\b91568aa67c0a9ac888db5b372240cc5.ico
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\c747045314b57dc6ddc35b5f1219a196.dat
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\5343d75d3e3864514800add26a22225e.ico
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\45dd757a4d8f47e1612f633cfeb24fe2.dat
- %TEMP%\RarSFX0\uninstaller.PTB.lng
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\b91568aa67c0a9ac888db5b372240cc5.dat
- <LS_APPDATA>\Innovative solutions\Advanced Uninstaller PRO\45dd757a4d8f47e1612f633cfeb24fe2.ico
- %TEMP%\RarSFX0\ServicesProfiles\ProfilesXP_SP2\sp2_Home.AUP
- %TEMP%\RarSFX0\Reports\monitor\monitored_template_5.htm
- %TEMP%\RarSFX0\Reports\monitor\monitored_template_4.htm
- %TEMP%\RarSFX0\Reports\monitor\one_table_two_rows_template.htm
- %TEMP%\RarSFX0\Reports\monitor\one_table_template.htm
- %TEMP%\RarSFX0\Reports\monitor\monitored_template_1.htm
- %TEMP%\RarSFX0\Reports\monitor\monitored_template.htm
- %TEMP%\RarSFX0\Reports\monitor\monitored_template_3.htm
- %TEMP%\RarSFX0\Reports\monitor\monitored_template_2.htm
- %TEMP%\RarSFX0\Reports\services\custom_image_OLD.jpg
- %TEMP%\RarSFX0\Reports\services\custom_image.jpg
- %TEMP%\RarSFX0\Reports\services\sigla2.png
- %TEMP%\RarSFX0\Reports\services\installed_services_template.htm
- %TEMP%\RarSFX0\Reports\monitor\sigla2.png
- %TEMP%\RarSFX0\Reports\monitor\registry.gif
- %TEMP%\RarSFX0\Reports\monitor\suslinie.png
- %TEMP%\RarSFX0\Reports\monitor\susdr.png
- %TEMP%\RarSFX0\Reports\fonts\custom_image.jpg
- %TEMP%\RarSFX0\Readme\license.rtf
- %TEMP%\RarSFX0\Reports\fonts\installed_fonts_template.htm
- %TEMP%\RarSFX0\Reports\fonts\custom_image_OLD.jpg
- %TEMP%\RarSFX0\uninstaller.SVE.lng
- %TEMP%\RarSFX0\Read Me.url
- %TEMP%\RarSFX0\Readme\description.rtf
- %TEMP%\RarSFX0\wtkpro.DLL
- %TEMP%\RarSFX0\Reports\monitor\disk.gif
- %TEMP%\RarSFX0\Reports\monitor\custom_image_OLD.jpg
- %TEMP%\RarSFX0\Reports\monitor\monitored_report.htm
- %TEMP%\RarSFX0\Reports\monitor\ini.gif
- %TEMP%\RarSFX0\Reports\fonts\susdr.png
- %TEMP%\RarSFX0\Reports\fonts\sigla2.png
- %TEMP%\RarSFX0\Reports\monitor\custom_image.jpg
- %TEMP%\RarSFX0\Reports\fonts\suslinie.png
- %TEMP%\RarSFX0\ServicesProfiles\ProfilesVista\vista_Bare Bones.AUP
- %TEMP%\RarSFX0\ServicesProfiles\ProfilesVista\default.AUP
- %TEMP%\RarSFX0\ServicesProfiles\ProfilesVista\vista_SAFE.AUP
- %TEMP%\RarSFX0\ServicesProfiles\ProfilesVista\vista_Power User.AUP
- %TEMP%\RarSFX0\ServicesProfiles\Profiles2000\2000_SAFE.AUP
- %TEMP%\RarSFX0\ServicesProfiles\Profiles2000\2000_Pro.AUP
- %TEMP%\RarSFX0\ServicesProfiles\Profiles2000\2000_Super Tweak.AUP
- %TEMP%\RarSFX0\ServicesProfiles\Profiles2000\2000_Server.AUP
- %TEMP%\RarSFX0\ServicesProfiles\ProfilesXP\xp_Super Tweak.AUP
- %TEMP%\RarSFX0\ServicesProfiles\ProfilesXP\xp_Safe.AUP
- %TEMP%\RarSFX0\ServicesProfiles\ProfilesXP_SP2\sp2_Bare Bones.AUP
- %TEMP%\RarSFX0\ServicesProfiles\ProfilesXP_SP2\default.AUP
- %TEMP%\RarSFX0\ServicesProfiles\ProfilesXP\xp_HomeXP.AUP
- %TEMP%\RarSFX0\ServicesProfiles\ProfilesXP\xp_gameri.AUP
- %TEMP%\RarSFX0\ServicesProfiles\ProfilesXP\xp_ProXP.AUP
- %TEMP%\RarSFX0\ServicesProfiles\ProfilesXP\xp_Internet Gateway.AUP
- %TEMP%\RarSFX0\Reports\startup\sigla2.png
- %TEMP%\RarSFX0\Reports\startup\installed_startup_template.htm
- %TEMP%\RarSFX0\Reports\startup\suslinie.png
- %TEMP%\RarSFX0\Reports\startup\susdr.png
- %TEMP%\RarSFX0\Reports\services\suslinie.png
- %TEMP%\RarSFX0\Reports\services\susdr.png
- %TEMP%\RarSFX0\Reports\startup\custom_image_OLD.jpg
- %TEMP%\RarSFX0\Reports\startup\custom_image.jpg
- %TEMP%\RarSFX0\Reports\uninstaller\suslinie.png
- %TEMP%\RarSFX0\Reports\uninstaller\susdr.png
- %TEMP%\RarSFX0\ServicesProfiles\Profiles2000\2000_Internet Gateway.AUP
- %TEMP%\RarSFX0\ServicesProfiles\Profiles2000\2000_Gaming System.AUP
- %TEMP%\RarSFX0\Reports\uninstaller\custom_image_OLD.jpg
- %TEMP%\RarSFX0\Reports\uninstaller\custom_image.jpg
- %TEMP%\RarSFX0\Reports\uninstaller\sigla2.png
- %TEMP%\RarSFX0\Reports\uninstaller\installed_programs_template.htm
Network activity:
Connects to:
- 'www.ad#####duninstaller.com':80
- '74.##5.232.51':80
- 'bi##.#ikimedia.org':80
- 'www.go#####analytics.com':80
- 'in###iles.com':80
- 'www.in####tive-sol.com':80
TCP:
HTTP GET requests:
- http:///geoiplookup via bi##.#ikimedia.org
- http://www.ad#####duninstaller.com/app-info/config/v5/?ve##############################
- http:///jsapi via 74.##5.232.51
- http:///soft/uninstaller/_update_aup.xml via in###iles.com
- http://www.in####tive-sol.com/in_app_offer/aup/offer.xml
HTTP POST requests:
- http://www.ad#####duninstaller.com/app-info/get-comments.php
- http://www.go#####analytics.com/collect
UDP:
- DNS ASK www.ad#####duninstaller.com
- DNS ASK www.google.com
- DNS ASK bi##.#ikimedia.org
- DNS ASK www.go#####analytics.com
- DNS ASK in###iles.com
- DNS ASK www.in####tive-sol.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'TForm2' WindowName: 'Uninstaller Monitor'
- ClassName: 'TfNeoSetupMain' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
