F-Secure
Tools
Adware:W32/LinkOptimizer
| Name : | Adware:W32/LinkOptimizer |
| Detection Names : |
Adware.Win32.LinkOptimizer |
| Aliases : |
Trojan:Win32/Stresid.gen (Microsoft) Trojan.Linkoptimizer (Symantec) |
| Category: | Spyware |
| Type: | Adware |
| Type: | Trojan-Spy, Rootkit, Trojan-Downloader |
| Platform: | W32 |
Summary
This program delivers advertising content to the user. It is usually annoying but harmless, unless it is combined with spyware or trackware.
Details
Network Connections
Attempts to connect to:
• http://gcwave.com/fg.php
• http://www.flashkin.net/bs.php
• http://www.flashkin.net/wl.php
• http://www.flashkin.net/sh.php
• http://www.flashkin.net/wlink.php
• http://www.flashkin.net/ws.php
• http://www.flashkin.net/gc.php
• http://washerner.com
• http://chongchua.com/
• http://livingcert.com
• http://fogcu.com
Stealth Features
Installs these hooks:
• ws2_32.dll!getaddrinfo
• advapi32.dll!RegSetValueW
• advapi32.dll!CreateProcessWithLogonW
• advapi32.dll!GetFileSecurityA
• advapi32.dll!SetFileSecurityA
• advapi32.dll!RegSetValueA
• kernel32.dll!GetBinaryTypeW
• kernel32.dll!OpenFile
• kernel32.dll!MoveFileWithProgressW
• kernel32.dll!ExitProcess
• kernel32.dll!FindFirstFileW
• kernel32.dll!LoadLibraryW
• kernel32.dll!GetProcAddress
• ntdll.dll!LdrUnloadDll
• ntdll.dll!LdrLoadDll
• ntdll.dll!NtWriteVirtualMemory
• ntdll.dll!NtVdmControl
• ntdll.dll!NtReadVirtualMemory
• ntdll.dll!NtQuerySystemInformation
• ntdll.dll!NtQueryInformationFile
• ntdll.dll!NtQueryDirectoryFile
• advapi32.dll!RegSetValueW
• advapi32.dll!CreateProcessWithLogonW
• advapi32.dll!GetFileSecurityA
• advapi32.dll!SetFileSecurityA
• advapi32.dll!RegSetValueA
• kernel32.dll!GetBinaryTypeW
• kernel32.dll!OpenFile
• kernel32.dll!MoveFileWithProgressW
• kernel32.dll!ExitProcess
• kernel32.dll!FindFirstFileW
• kernel32.dll!LoadLibraryW
• kernel32.dll!GetProcAddress
• ntdll.dll!LdrUnloadDll
• ntdll.dll!LdrLoadDll
• ntdll.dll!NtWriteVirtualMemory
• ntdll.dll!NtVdmControl
• ntdll.dll!NtReadVirtualMemory
• ntdll.dll!NtQuerySystemInformation
• ntdll.dll!NtQueryInformationFile
• ntdll.dll!NtQueryDirectoryFile
Additional Details
Adware:W32/LinkOptimizer is an adware application with active rootkit technology.
Installation
This adware tries to use social engineering to convince the user to download and execute it by imitating one of the following file names:
The files using the COM extension can actually be executed exactly the same as EXE, CMD, SCR and other Windows executable formats; despite the COM extension, the file is actually the downloader that will download LinkOptimizer adware and its rootkit component.
Once the downloader is executed, it will download and drop the following files:
LinkOptimizer adds itself to the registry as a browser helper object (BHO) to maintain control of Internet Explorer instances.
Activity
While the browser is running, LinkOptimizer displays pop-up windows at random intervals.
It also hijacks the default search page and attempts to connect to various hard-coded sites in order to download and execute files.
Registry
Adware.LinkOptimizer is installed as a BHO by adding the following registry subkey:
Adware is loaded to the following registry subkey:
The DLL file and the registry key are hidden by the rookit.
The program also overwrites the default URLSearchHooks on HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks in order to hijack Internet Explorer address bar searches:
Stealth
More recently, LinkOptimizer has been bundled with a powerful rootkit named Gromozon. Gromozon's main purpose is to hide its own presence (and the LinkOptimzer component's) using numerous techniques such as:
As part of its stealth functionality, the rootkit installs a range of hooks (see above).
Installation
This adware tries to use social engineering to convince the user to download and execute it by imitating one of the following file names:
• www.google.com
• www.auto.com
• www.free.com
• www.super.com
• www.pictures.com
The files using the COM extension can actually be executed exactly the same as EXE, CMD, SCR and other Windows executable formats; despite the COM extension, the file is actually the downloader that will download LinkOptimizer adware and its rootkit component.
Once the downloader is executed, it will download and drop the following files:
• C:\Windows\[5 random characters]1.dll
• C:\Windows\Temp\[Random name]1.exe
LinkOptimizer adds itself to the registry as a browser helper object (BHO) to maintain control of Internet Explorer instances.
Activity
While the browser is running, LinkOptimizer displays pop-up windows at random intervals.
It also hijacks the default search page and attempts to connect to various hard-coded sites in order to download and execute files.
Registry
Adware.LinkOptimizer is installed as a BHO by adding the following registry subkey:
• [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\[random CLSID]]
Adware is loaded to the following registry subkey:
• [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs" = "C:\Windows\[5 random characters]1.dll"
"AppInit_DLLs" = "C:\Windows\[5 random characters]1.dll"
The DLL file and the registry key are hidden by the rookit.
The program also overwrites the default URLSearchHooks on HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks in order to hijack Internet Explorer address bar searches:
• [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks]
{CFBFAE00-17A6-11D0-99CB-00C04FD64497}=
{CFBFAE00-17A6-11D0-99CB-00C04FD64497}=
Stealth
More recently, LinkOptimizer has been bundled with a powerful rootkit named Gromozon. Gromozon's main purpose is to hide its own presence (and the LinkOptimzer component's) using numerous techniques such as:
• Special user accounts
• Undocumented NTFS features
• Blocking anti-rootkit programs
• Windows API hooking
• Removing the user's administrator rights
As part of its stealth functionality, the rootkit installs a range of hooks (see above).