Adware:Win32/BHO.G is detection for an adware application installed as a Web browser helper object (BHO) as a component of
Adware:Win32/SmartAdsSolutions. The adware displays advertisements based on Web surfing habits.
Installation
Adware:Win32/BHO.G is installed by Adware:Win32/SmartAdsSolutions as the following files:
- %temp%\nslf.tmp\cnclb.dll
- <system folder>\kukomlfi.dll
Note - <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP and Vista is C:\Windows\System32.
The registry is modified to run the installed BHO components when the Web browser is launched.
HKLM\SOFTWARE\Classes\adHlpr.adHlpr.1.0
HKLM\SOFTWARE\Classes\adHlpr.adHlpr
In the wild, we have observed the following registry modifications to run the BHO components:
Adds value: "{3C7FE4B2-7917-4B27-B594-6EB424F3D527}"
In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
Adds value: "{42722F46-E922-4DFA-BA96-5F8FD0CB7C51}"
In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
Adds value: "(default)"
With data: "smartads browser enhancer kukomlfi"
To subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{42722F46-E922-4DFA-BA96-5F8FD0CB7C51}
Adds value: "(default)"
With data: "adhlpr object"
To subkey: HKLM\SOFTWARE\Classes\adHlpr.adHlpr.1.0
Adds value: "(default)"
With data: "{7be99c54-a75a-491f-b684-fd5e8e990e98}"
To subkey: HKLM\SOFTWARE\Classes\adHlpr.adHlpr.1.0\CLSID
Adds value: "(default)"
With data: "adhlpr object"
To subkey: HKLM\SOFTWARE\Classes\adHlpr.adHlpr
Adds value: "(default)"
With data: "{7be99c54-a75a-491f-b684-fd5e8e990e98}"
To subkey: HKLM\SOFTWARE\Classes\adHlpr.adHlpr\CLSID
Adds value: "(default)"
With data: "adhlpr.adhlpr.1.0"
To subkey: HKLM\SOFTWARE\Classes\adHlpr.adHlpr\CurVer
Adds value: "(default)"
With data: "adhlpr object"
To subkey: HKLM\SOFTWARE\Classes\CLSID\{7BE99C54-A75A-491F-B684-FD5E8E990E98}
Adds value: "(default)"
With data: "adhlpr.adhlpr.1.0"
To subkey: HKLM\SOFTWARE\Classes\CLSID\{7BE99C54-A75A-491F-B684-FD5E8E990E98}\ProgID
Adds value: "(default)"
With data: "adhlpr.adhlpr"
To subkey: HKLM\SOFTWARE\Classes\CLSID\{7BE99C54-A75A-491F-B684-FD5E8E990E98}\VersionIndependentProgID
Adds value: "(default)"
With data: "<system folder>\kukomlfi.dll"
To subkey: HKLM\SOFTWARE\Classes\CLSID\{7BE99C54-A75A-491F-B684-FD5E8E990E98}\InprocServer32
Adds value: "(default)"
With data: "{a9722a0d-365f-47d2-b70b-37d046316d99}"
To subkey: HKLM\SOFTWARE\Classes\CLSID\{7BE99C54-A75A-491F-B684-FD5E8E990E98}\TypeLib
Adds value: "(default)"
With data: "<system folder>\kukomlfi.dll"
To subkey: HKLM\SOFTWARE\Classes\CLSID\{42722F46-E922-4DFA-BA96-5F8FD0CB7C51}\InprocServer32
Adds value: "(default)"
With data: "adhlpr.adhlpr.1.0"
To subkey: HKLM\SOFTWARE\Classes\CLSID\{42722F46-E922-4DFA-BA96-5F8FD0CB7C51}\ProgID
Adds value: "(default)"
With data: "{a9722a0d-365f-47d2-b70b-37d046316d99}"
To subkey: HKLM\SOFTWARE\Classes\CLSID\{42722F46-E922-4DFA-BA96-5F8FD0CB7C51}\TypeLib
Adds value: "(default)"
With data: "adhlpr.adhlpr"
To subkey: HKLM\SOFTWARE\Classes\CLSID\{42722F46-E922-4DFA-BA96-5F8FD0CB7C51}\VersionIndependentProgID
Adds value: "(default)"
With data: "adhlpr object"
To subkey: HKLM\SOFTWARE\Classes\CLSID\{42722F46-E922-4DFA-BA96-5F8FD0CB7C51}
Adds value:”afltId"
With data: "orgnl"
To subkey: HKLM\SOFTWARE\Classes\AppID\{A9722A0D-365F-47D2-B70B-37D046316D99}\instl\Data
Additional Information
Adware:Win32/SmartAdsSolutions may add an entry named "Smart-Ads-Solutions" in the list of installed Windows applications, visible in "Control Panel\Programs\Programs and Features". This entry is also visible in registry modifications made by the adware installer.
Adds value: “DisplayName"
With data: "smartads browser enhancer"
To subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Smart-Ads-Solutions
Adds value: "InstallDir"
With data: "%program_files%\smart-ads-solutions\smartads\1.5.2.0"
To subkey: HKLM\SOFTWARE\Smart-Ads-Solutions\SmartAds\Instl
Analysis by Wei Li
