Please help! Vicious little piece of ware

Originally posted by radeonx I got a downloader of seriall when my friend came over so i was wondering whats wrong. i did everything you guys said but none of those exist i got it from the autocad  keygen

Which simply indicates that you caught a different piece of malware and should have opened a new thread instead of reviving an old one.

You may still do so and do not forget to describe the relevant symptons, else an analysis will be pretty tough to do.

Oh yes, autoruns logfile, hijackthis logfile and/or rootkitrevealer logfile might prove helpful.

Karl

Edited by Karlchen - 02 December 2006 at 12:37pm

Thanks that did the trick I could not get rid of the trojan, when using no-adware or nortons why is that !

ah-ha!!!! Don't know how you spotted that but good work! Everyone has been missing that...

Now it is looking clear that this is a trojan gateway named DollarRevenue or one of it's variants! Also considered a dropper (I use the word gateway) and a web page I'm looking at says the victim should expect constant infections of the following:

• Adware-DCToolbar
• Adware-DFC
• Adware-DigInk
• Adware-Isearch
• Adware-Look2Me
• Adware-SurfSideKick.dr
• Adware-Zeno
• Downloader-ACV
• NDotNet
• Uploader-R
  

They say be on the lookout for drsmartload.exe also! and it also can infect through system restore! (that info from mcafee)

More sites:
http://194.187.45.55/
http://www.onli-ne.com/app/ADDR/
http://content.dollarrevenue.com/
c:\drsmart\load1.exe
http://promo.dollarrevenue.com/webmasterexe/drsmartload618a.exe
http://promo.dollarrevenue. com/webmasterexe/drsmartload117a.exe
http://promo.dollarrevenue. com/webmasterexe/drsmartload44a.exe
http://promo.dollarrevenue.com/webmasterexe/drsmartload229a.exe
and many more found in googer

Judging by the URL's I would say the purpose is that webmasters are suppose to sign up as advertising affiliates and place this file on their web server (or hotlink it) and then the victim should see endless advertisements served  by dolarrevenue.com and for each one the, the affiliate probably gets like a penny so if you get 100 full screen popup ads, that's like 1 dollar profit for the webmaster!!!

oh boy, some of things people do all in the name of ad revenue! (they're probably breaking a few state and federal laws in there aswell)

http://www.seriall.com/download/operation_flashpoint_keygen. exe

it's the first link that comes up if you search the site for operation flashpoint!

Characteristics
- Renamed file... Web sites commonly do this, the name is similar to files found on megagames.com but they tend to use all upper case names!

- Small file... Claims that it is a keygen and the file size supports that claim!

- EXE file... Very suspicious here! Most web sites pack downloads into zips! Even if they are renamed! They can then use automated utilities to add their own TAG to the DIZ and that sort of stuff

- No docs... Bad sign! Such files normally come with an NFO or DIZ file (again inside of a zip) declaring what it is and who made it...

- No icon... Unussual, not heard of these days! The game scene groups are proud of their work with trainers, keygens, etc, and although it would be normal for a DOS file not to have an icon, I've not seen those used since the 90's and this is a full blown windows GUI application!

- ShellExecuteExa... I did not decompile the file but I poked around at the insides a little and I believe it uses this shell32.dll function to launch CMD.EXE or RUNDLL32.EXE (not sure which) and then do what, I dunno... but there is no function of a key generator that would need to shell execute stuff!

Details
operation_flashpoint_keygen.exe
Windows PE
13042 Bytes
B7D657C3 CRC32
E768B53FCFB5752DE21A2181956EA7AE MD5
3C61E8CB3299E6EA1BDB71A2051BD463D38F2BB4 SHA1
Exports: NONE
Imports: SHELL32.DLL
SUSPECT: Mess up my computer style trojan!

Just for any one else who has a done a search for this demonware and couldn't find an answer like I have done.  Every search (anti-spyware and anti-virus) that I could get my hands on, could not find this or fix it.  I probably wouldn't have bothered with a post, except Osnail  posted about how to fix it and tells you to delete a system file.... winetn32.dll is a legit dll file.  The 3 that are posted above: ncompat.tlb, ld*.tmp, and dfrgsrv.exe are not.  Delete them and they will grow back, remove the folder 1024 and it will come back... However....

1.  Reboot in safe mode.
2.  Nuke those 3 files in the system32 directory
3.  Nuke the dir 1024 in system32
4.  run Regedit and search for dfgsrv.exe
5.  Nuke any keys referencing it.
6.  Reboot and enjoy.

The .tmp file wil start with ld and end with .tmp  the number involved with it depends on it's current iteration of establishing or trying to establish contact with the web.

winetn32.dll is just the windows file that starts running the file to attach itself to winlogon.exe.  (in normal mode) Once it attaches and runs itself, it will keep the other files from being deleted and recreate and modifications to the registry that it needs to keep itself alive.

Enjoy.