Adware.Yok.27

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'yok.exe' = '%PROGRAM_FILES%\yok\yok.exe'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{F869BB38-FFEF-4589-B986-610B7AD0ADA2}] 'Exec' = 'http://www.yok.com'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\TYKeeper] 'Start' = '00000000'

Malicious functions:

Creates and executes the following:

'%PROGRAM_FILES%\yok\yok.exe'

Injects code into

the following system processes:

%WINDIR%\Explorer.EXE

Hooks the following functions in System Service Descriptor Table (SSDT):

NtRestoreKey, handler: TYKeeper.sys
NtQueryValueKey, handler: TYKeeper.sys
NtTerminateProcess, handler: TYKeeper.sys
NtSetValueKey, handler: TYKeeper.sys
NtOpenSection, handler: TYKeeper.sys
NtDeleteValueKey, handler: TYKeeper.sys
NtDeleteKey, handler: TYKeeper.sys
NtEnumerateValueKey, handler: TYKeeper.sys
NtEnumerateKey, handler: TYKeeper.sys

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\yok\tykeeper.dll
%PROGRAM_FILES%\yok\versionx.dll
%PROGRAM_FILES%\yok\adblock.dll
%TEMP%\tmp4.CAB
%PROGRAM_FILES%\yok\TYKeeper\TYKeeper.sys
%TEMP%\tmp5.CAB
%PROGRAM_FILES%\yok\TYKeeper\TYKeeper.vxd
%PROGRAM_FILES%\yok\relband.dll
%PROGRAM_FILES%\yok\yok.exe
%PROGRAM_FILES%\yok\image\zhongsou.bmp
%PROGRAM_FILES%\yok\image\yisou.bmp
%PROGRAM_FILES%\yok\yok.dll
%PROGRAM_FILES%\yok\toolbar.dll
%PROGRAM_FILES%\yok\setting.dll
%PROGRAM_FILES%\yok\autolive.dll
%TEMP%\tmp6.CAB
%PROGRAM_FILES%\yok\YOK1.ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\yok1[1].ini
%TEMP%\tmp8.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\yok2[1].ini
%PROGRAM_FILES%\yok\YOK3.ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\yok3[1].ini
%PROGRAM_FILES%\yok\YOK2.ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ins[1].php
<SYSTEM32>\TYRule01.dat
<DRIVERS>\TYKeeper.sys
%PROGRAM_FILES%\yok\TYKeeper\TYRule01.dat
%PROGRAM_FILES%\yok\protect.dll
%PROGRAM_FILES%\yok\uninst.exe
<SYSTEM32>\TYRule02.dat
%TEMP%\tmp7.CAB
%PROGRAM_FILES%\yok\image\tools.bmp
%PROGRAM_FILES%\yok\image\books.bmp
%PROGRAM_FILES%\yok\image\baidu.bmp
%PROGRAM_FILES%\yok\image\adblockn.bmp
%PROGRAM_FILES%\yok\image\business.bmp
%PROGRAM_FILES%\yok\image\forums.bmp
%PROGRAM_FILES%\yok\image\flash.bmp
%PROGRAM_FILES%\yok\image\favorites.bmp
%PROGRAM_FILES%\yok\image\adblockd.bmp
%PROGRAM_FILES%\yok\YOK.ico
%TEMP%\yok\PROTECT.dll
%TEMP%\nso2.tmp
%PROGRAM_FILES%\yok\yoksch.htm
%PROGRAM_FILES%\yok\image\HighLight.bmp
%PROGRAM_FILES%\yok\search.ini
%PROGRAM_FILES%\yok\barcfg.ini
%PROGRAM_FILES%\yok\image\games.bmp
%PROGRAM_FILES%\yok\image\shopping.bmp
%PROGRAM_FILES%\yok\image\search.bmp
%PROGRAM_FILES%\yok\image\pictures.bmp
%PROGRAM_FILES%\yok\image\softwares.bmp
%PROGRAM_FILES%\yok\image\tool.bmp
%PROGRAM_FILES%\yok\image\stories.bmp
%PROGRAM_FILES%\yok\image\sogou.bmp
%PROGRAM_FILES%\yok\image\news.bmp
%PROGRAM_FILES%\yok\image\logo_hot.bmp
%PROGRAM_FILES%\yok\image\iask.bmp
%PROGRAM_FILES%\yok\image\google.bmp
%PROGRAM_FILES%\yok\image\map.bmp
%PROGRAM_FILES%\yok\image\music.bmp
%PROGRAM_FILES%\yok\image\movies.bmp
%PROGRAM_FILES%\yok\image\more.bmp

Deletes the following files:

%PROGRAM_FILES%\yok\TYKeeper\TYRule01.dat
%TEMP%\tmp8.tmp
%PROGRAM_FILES%\yok\TYKeeper\TYKeeper.vxd
%PROGRAM_FILES%\yok\TYKeeper\TYKeeper.sys

Network activity:

Connects to:

'dl.#ok.com':80
're##.yok.com':80
'localhost':1035

TCP:

HTTP GET requests:

dl.#ok.com/yok/yok2.ini?m=#########################################
dl.#ok.com/yok/yok3.ini?m=#########################################
re##.yok.com/ins.php?p=########################################################################################################################
dl.#ok.com/yok/yok1.ini?m=#########################################

UDP: