AdWare.Win32.Gamevance.hfti

Technical Details
Payload
Removal instructions

Technical Details

Adware designed to redirect user searches to other web resources. It is a Windows application (PE-EXE file). 1135840 bytes. Written in C++.

Installation

The trojan is installed as an add-in for the following browsers:

Internet Explorer
Google Chrome
Mozilla Firefox

After launching, the trojan carries out the following actions:

• to control the uniqueness of its process within the system, it creates a unique identifier under the name:

  pp_installer_mtx

• If the system has created a window named "grsclass" and class name "gamerockstar" or if the system registry contains the following keys:

  [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{21608B66-026F-4DCB-9244-0DACA328DCED}]
  [HKCR\CLSID\{21608B66-026F-4DCB-9244-0DACA328DCED}\InprocServer32]
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{109E520F-B6D1-492b-BA66-8E3AA6923055}]
  [HKCU\Software\Classes\CLSID\{109E520F-B6D1-492b-BA66-8E3AA6923055}\InprocServer32]
  [HKCR\CLSID\{109E520F-B6D1-492b-BA66-8E3AA6923055}\InprocServer32]
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{098B1077-D8E5-4974-B5D7-A044B88740E6}]
  [HKCU\Software\Classes\CLSID\{098B1077-D8E5-4974-B5D7-A044B88740E6}\InprocServer32]
  [HKCR\CLSID\{098B1077-D8E5-4974-B5D7-A044B88740E6}\InprocServer32]
  

  then the trojan shuts down, displaying the following message:

  Play Pickle
  You already have required software for playing games.

  While the intruder resource:

  http://pages.pl***ckle.com/aj/inst.php

  is sent the following message:

  SKIPPED
  Another client installed
  

• The trojan shuts down if the OS platform of the infected computer is not Win32 NT. In this case, the intruder resource is sent the following message:

  FAILED
  INVALID_OS
  

• It extracts a set of components saved in the following directories from its body:

  %Program Files%\Play Pickle
  %APPDATA%\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@pl***ckle.com
  

• It creates a set of system registry keys in the following branches:

  [HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PlayPickle]
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AEB04B5E-C981-47a9-B847-33EE4C92F6B9}]
  [HKCR\CLSID\{AEB04B5E-C981-47a9-B847-33EE4C92F6B9}]
  [HKCR\CLSID\{AEB04B5E-C981-47a9-B847-33EE4C92F6B9}\InprocServer32]
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
  

• If the system is running the process "chrome.exe", the trojan restarts this process.
• During installation, the trojan may install the following applications on the infected computer:

  Desktop Weather
  Bing Toolbar
  Ask Toolbar
  Dogpile Toolbar
  Shop To Win 8
  

  loading the files for their installation from the following links:

  http://download.pl***ckle.com/weather/installer.exe
  http://download.pl***ckle.com/asktoolbar/ApnIC11130.dll
  http://dl.pp.f***dn.com/pp/download/asktoolbar/ApnIC11130.dll
  http://download.pl***ckle.com/asktoolbar/ApnToolbarInstaller11130.exe
  http://dl.pp.f***dn.com/pp/download/asktoolbar/ApnToolbarInstaller11130.exe
  http://download.pl***ckle.com/asktoolbar/PPApnStub11130.exe
  http://dl.pp.f***dn.com/pp/download/asktoolbar/PPApnStub11130.exe
  http://dl.pp.f***dn.com/pp/download/dogpiletoolbar/Dogpile_Toolbar.exe
  http://download.pl***ckle.com/dogpiletoolbar/Dogpile_Toolbar.exe
  http://dl.pp.f***dn.com/pp/download/shoptowin/ShopToWin8_FF.exe
  http://download.pl***ckle.com/shoptowin/ShopToWin8_FF.exe
  http://dl.pp.f***dn.com/pp/download/shoptowin/ShopToWin8_IE.exe
  http://download.pl***ckle.com/shoptowin/ShopToWin8_IE.exe
  

  The downloaded files are saved in the current user's temporary file directory "%Temp%" under the relevant names.

  After a successful download, the files are launched for execution.

• During installation, the trojan may also access the following links:

  http://pages.pl***ckle.com/aj/inst.php
  http://pages.pl***ckle.com/aj/bund.php
  http://pages.pl***ckle.com/aj/ty.php
  

Payload

The trojan can track, collect, and redirect user search queries. In response to a user search, a list of links is produced, obtained from the following servers:

cf.pl***ckle.com
play***le.net
play***kle.com

Removal instructions

If your computer has not been protected with anti-virus software and has been infected with malware, you will need to take the following actions to delete this:

1. Close the following browsers:

   Internet Explorer
   Google Chrome
   Mozilla Firefox
   

2. Delete the original trojan file (its location on the infected computer will depend on how it got onto the computer).
3. Delete the system registry keys created by the trojan in the following branches (how to work with the registry?):

   [HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PlayPickle]
   [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AEB04B5E-C981-47a9-B847-33EE4C92F6B9}]
   [HKCR\CLSID\{AEB04B5E-C981-47a9-B847-33EE4C92F6B9}]
   [HKCR\CLSID\{AEB04B5E-C981-47a9-B847-33EE4C92F6B9}\InprocServer32]
   [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   

4. Delete the directories and all of their contents:

   %Program Files%\Play Pickle
   %APPDATA%\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@pl***ckle.com
   

5. Clear the current user's temporary file directory "%Temp%".
6. Clear the Temporary Internet Files directory which may contain infected files (How to delete infected files in the Temporary Internet Files folder?).
7. Run a full Kaspersky Antivirus scan of the computer with updated antivirus databases (download trial version).

MD5: 2A94F593D06C6DCA741AC6C71E90E8EA
SHA1: 54D24FD3D471C899AAD607208B9DCF21998FBE51