Installation
Adware:Win32/InvisibleBrowser is usually installed on your PC at the same time as other software. We have seen the following installer file names used by this program:
-
Chrome_Setup.exe
-
Flash_Player_Pro_Setup.exe
-
Flash_Player_Pro_Update_Setup.exe
-
flash1-tr-60614.exe
-
Flash-3-Update5232014.exe
-
flashplayerpro-setup.exe
-
FreeFlash.exe
-
fupm-adk-v2.exe
-
iTunes-Setup.exe
-
Java_Updater_Setup.exe
-
java1-adk-52714.exe
-
Java-2-Update5232014.exe
-
JavaUpdateTR.exe
The installation program might look like the following:
After the installation, the installer might tell you it has successfully installed an update, however it has actually installed another component onto your PC.
We have seen this program installed in the following locations:
It modifies the following registry entry so that it runs each time you start your PC:
In subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sets value: "<value>"
With data: "<path to malware>"
Where <value> is a random word. Examples of this registry entry include:
In subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sets value: "Win32 CVS Monitor"
With data: "C:\Program Files\Software Guardian\cvsmon32.exe"
In subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sets value: "Windows Client Manager"
With data: "C:\Program Files\Flash Update\winclient32.exe"
In subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sets value: "Windows FUPM Service Manager"
With data: "C:\Program Files\Premium Software\systerm32.exe"
In subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sets value: "Win32 BCS Monitor"
With data: "C:\Program Files\SystemShield Pro\bcsmon32.exe"
In subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sets value: "Windows System Monitor "
With data: "C:\Program Files\VLC Media Player Installer\system32.exe"
It might also create similar registry entries at the following locations:
-
HKEY_CURRENT_USER\Software\AutoPopper
-
HKEY_CURRENT_USER\Software\UpdateFiles
-
HKEY_CURRENT_USER\Software\UpdateSoft
Behavior
Monitors your online activity
This program can monitor the following web browsers:
-
Chrome
-
Firefox
-
IE
-
Netscape
It collects all accessed URLs and sends this information to its servers via HTTP. We have seen it access the following URLs:
-
a.turboclk.com/a.php?key=<key>&url=<url>
-
a.turboclk.com/ac.php?key=<key>&comp=true&k=<url>
Where <key> is a random value and <url> is the URL accessed from the Web browser address bar.
Displays advertisements
We have seen this program showing unattributed ads that might look like those shown below:
