surfya dialer

November 11, 2006 on 4:35 pm | In Malware analysis | 1 Comment

Originally posted Aug 17 2005, 09:03 PM

ActiveX dialer. When installed it makes these:

[ Changes to filesystem ]

[ Changes to registry ]
* Creates key “HKLM\Software\IEACCESS”.
* Sets value “title”=”” in key “HKLM\Software\IEACCESS”.
* Creates key “HKLM\Software\IEACCESS\restore”.
* Creates key “HKLM\Software\IEACCESS\restore\Start Page”.
* Sets value “value”=”about:blank” in key “HKLM\Software\IEACCESS\restore\Start Page”.
* Sets value “key”=”Software\Microsoft\Internet Explorer\Main” in key “HKLM\Software\IEACCESS\restore\Start Page”.
* Sets value “hkey”=”” in key “HKLM\Software\IEACCESS\restore\Start Page”.
* Modifies value “Start Page”=”” in key “HKCU\Software\Microsoft\Internet Explorer\Main”.
* Creates key “HKLM\Software\IEACCESS\restore\DefaultInternet”.
* Creates key “HKLM\Software\IEACCESS\restore\InternetProfile”.
* Sets value “value”=”MyProfile” in key “HKLM\Software\IEACCESS\restore\InternetProfile”.
* Sets value “key”=”RemoteAccess” in key “HKLM\Software\IEACCESS\restore\InternetProfile”.
* Sets value “hkey”=”” in key “HKLM\Software\IEACCESS\restore\InternetProfile”.
* Creates key “HKLM\Software\IEACCESS\restore\EnableAutodial”.
* Sets value “value”=”” in key “HKLM\Software\IEACCESS\restore\EnableAutodial”.
* Sets value “key”=”Software\Microsoft\Windows\CurrentVersion\Internet Settings” in key “HKLM\Software\IEACCESS\restore\EnableAutodial”.
* Sets value “hkey”=”” in key “HKLM\Software\IEACCESS\restore\EnableAutodial”.
* Creates value “IEACCESS”=”C:\WINDOWS\SYSTEM\SAMPLE.EXE -N” in key “HKLM\Software\Microsoft\Windows\CurrentVersion\Run”.

[ Changes to system settings ]
* Enumerates RAS connections.
* Set dialer properties to dial () 08718731247.

Entries in log
O4 – HKLM\..\Run: [IEACCESS] C:\WINDOWS\System32\surfya.exe -N
O16 – DPF: {30CE93AE-4987-483C-9ABE-F2BD5301AB70} –…surfya.exe

This looks like a mix of the old IEAccess dialers from eGroup and the Derbiz Hijacker I blogged about earlier:

1 Comment »

RSS feed for comments on this post. TrackBack URI

  1. Originally posted Aug 20 2005, 01:30 PM

    To make it easy to remove this dialer you can use this method.

    Download and unzip [url=]Brute Force Uninstaller[/url]

    Copy the text in the CODE box below into notepad and save it as surfya.bfu

    [code]ProcessKillIfContainsText \*.exe|EnableAutodial|0
    FileDelete %SYSDIR%\temp532.exe
    FileDelete %SYSDIR%\surfya.exe
    FileDelete %DESKTOP%\
    FileDelete %STARTMENU%\
    FileDelete %STARTMENU%\Uninstall
    RegSetDwordValue HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings|EnableAutodial|0
    RegSetDwordValue HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings|EnableAutodial|0
    RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|IEACCESS
    RegSetStringValue HKCU\Software\Microsoft\Internet Explorer\Main|Start Page|
    RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{30CE93AE-4987-483C-9ABE-F2BD5301AB70}
    RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{30CE93AE-4987-483C-9ABE-F2BD5301AB70}|Compatibility Flags|1024
    SystemRun RASPHONE.EXE|-r|0[/code]

    Then run BFU by doubleclicking BFU.exe and show the program where you saved surfya.bfu
    Then click Execute.
    All you have to do now is change your Startpage back to what you want in IE under Tools > Internet Options > on the General tab (unless you like my site so much you want to keep it 😛 )

    Comment by metallica — November 11, 2006 #

Leave a comment

XHTML: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

Powered by WordPress with Pool theme design by Borja Fernandez.
Entries and comments feeds. Valid XHTML and CSS. ^Top^