Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\Scheduled Update for Ask Toolbar.job
Modifies file system:
Creates the following files:
- %TEMP%\FirefoxCustomize\AskInstallChecker-1.5.0.0.exe
- %WINDIR%\Installer\MSI13.tmp
- %TEMP%\{86D4B82A-ABED-442A-BE86-96357B70F4FE}\RunIE.exe
- %TEMP%\{86D4B82A-ABED-442A-BE86-96357B70F4FE}\askpopup.exe
- %TEMP%\{86D4B82A-ABED-442A-BE86-96357B70F4FE}\AskPartnerCobrandingTool.exe
- %WINDIR%\Installer\MSI14.tmp
- %WINDIR%\Installer\MSI15.tmp
- %WINDIR%\Installer\MSI16.tmp
- %WINDIR%\Installer\2770d.ipi
- %WINDIR%\Installer\MSI17.tmp
- %WINDIR%\Installer\MSI18.tmp
- %TEMP%\~19.tmp
- C:\Config.Msi\2770e.rbs
- %WINDIR%\Installer\MSI1B.tmp
- %WINDIR%\Installer\2770a.msi
- %WINDIR%\Installer\2770b.mst
- %ProgramFiles%\Ask.com\config.xml
- %ProgramFiles%\Ask.com\mupcfg.xml
- %WINDIR%\Installer\MSI1F.tmp
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\getTbProperties[1].jsp
- %ProgramFiles%\Ask.com\fv_1e.ico
- %TEMP%\AskSearch\partnercobranding.dat
- %WINDIR%\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}\1033.MST
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\0x0816.ini
- %WINDIR%\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}\ARPPRODUCTICON.exe
- %WINDIR%\Installer\MSI1C.tmp
- %ProgramFiles%\Ask.com\SaUpdate.exe
- %ProgramFiles%\Ask.com\UpdateTask.exe
- %ProgramFiles%\Ask.com\TaskScheduler.exe
- %ProgramFiles%\Ask.com\favicon.ico
- %ProgramFiles%\Ask.com\cobrand.ico
- %ProgramFiles%\Ask.com\GenericAskToolbar.dll
- %TEMP%\ASKSUTBLOG
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\Ask Toolbar.msi
- %TEMP%\_is12.tmp
- %TEMP%\install_log.log
- %TEMP%\NEW2.tmp.exe
- %TEMP%\_is3.tmp
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\Setup.INI
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\_ISMSIDEL.INI
- %TEMP%\_is4.tmp
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\0x0407.ini
- %TEMP%\_is5.tmp
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\0x0409.ini
- %TEMP%\_is6.tmp
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\0x040a.ini
- %TEMP%\_is7.tmp
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\0x040c.ini
- %TEMP%\_is8.tmp
- %TEMP%\FirefoxCustomize\askToolbarInstaller-1.9.1.0.exe
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\0x0410.ini
- %TEMP%\_is11..dll
- %TEMP%\_is9.tmp
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\0x0413.ini
- %TEMP%\_isA.tmp
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\0x0415.ini
- %TEMP%\_isB.tmp
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\0x0419.ini
- %WINDIR%\Installer\2770f.msi
- %TEMP%\_isC.tmp
- %WINDIR%\Installer\MSI20.tmp
- %TEMP%\~D.tmp
- %TEMP%\_isF.tmp
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\1033.MST
- %TEMP%\_is10.tmp
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\Windows Installer 3.0 for Windows XP and later (x86).prq
- %TEMP%\_isE.tmp
- %WINDIR%\Installer\MSI21.tmp
Deletes the following files:
- %TEMP%\_is3.tmp
- %WINDIR%\Installer\MSI1F.tmp
- %TEMP%\{86D4B82A-ABED-442A-BE86-96357B70F4FE}\AskPartnerCobrandingTool.exe
- %TEMP%\{86D4B82A-ABED-442A-BE86-96357B70F4FE}\askpopup.exe
- %TEMP%\{86D4B82A-ABED-442A-BE86-96357B70F4FE}\RunIE.exe
- %WINDIR%\Installer\MSI20.tmp
- %WINDIR%\Installer\MSI21.tmp
- %WINDIR%\Installer\2770b.mst
- %WINDIR%\Installer\2770a.msi
- %WINDIR%\Installer\2770d.ipi
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\0x0407.ini
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\0x040a.ini
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\_ISMSIDEL.INI
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\0x040c.ini
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\0x0410.ini
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\0x0413.ini
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\0x0415.ini
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\0x0419.ini
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\0x0816.ini
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\1033.MST
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\Ask Toolbar.msi
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\Setup.INI
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\Windows Installer 3.0 for Windows XP and later (x86).prq
- %TEMP%\~19.tmp
- %TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\0x0409.ini
- %ProgramFiles%\Ask.com\TaskScheduler.exe
- %TEMP%\~D.tmp
- %TEMP%\_is4.tmp
- %TEMP%\_is5.tmp
- %TEMP%\_is6.tmp
- %TEMP%\_is7.tmp
- %TEMP%\_is8.tmp
- %TEMP%\_is9.tmp
- %TEMP%\_isA.tmp
- %TEMP%\_isB.tmp
- %TEMP%\_isC.tmp
- %TEMP%\_isE.tmp
- %TEMP%\_isF.tmp
- %WINDIR%\Installer\MSI17.tmp
- %TEMP%\_is10.tmp
- %TEMP%\_is11..dll
- %TEMP%\_is12.tmp
- %WINDIR%\Installer\MSI13.tmp
- %WINDIR%\Installer\MSI14.tmp
- %WINDIR%\Installer\MSI15.tmp
- %WINDIR%\Installer\MSI16.tmp
- %WINDIR%\Installer\MSI18.tmp
- %WINDIR%\Installer\MSI1B.tmp
- %WINDIR%\Installer\MSI1C.tmp
- C:\Config.Msi\2770e.rbs
- %TEMP%\NEW2.tmp.exe
Network activity:
Connects to:
- 'we####rch.ask.com':80
- 'im#.###analytics.com':80
TCP:
HTTP GET requests:
- http://we####rch.ask.com/preinstall?cl##########################################################################################
- http://im#.###analytics.com/images/nocache/apn/tr.gif?ev#########################################
- http://we####rch.ask.com/interim/askbardis/getTbProperties.jsp?tb#####
UDP:
- DNS ASK we####rch.ask.com
- DNS ASK im#.###analytics.com
Miscellaneous:
Creates and executes the following:
- '%TEMP%\FirefoxCustomize\AskInstallChecker-1.5.0.0.exe' TMN
- '%TEMP%\FirefoxCustomize\askToolbarInstaller-1.9.1.0.exe' /tbr toolbar=TMN
- '%TEMP%\NEW2.tmp.exe' /s /v"PARTNER=TMN TBR=YES SA=1 HPR=0 /qn"
- '%WINDIR%\Installer\MSI15.tmp'
- '%TEMP%\{86D4B82A-ABED-442A-BE86-96357B70F4FE}\AskPartnerCobrandingTool.exe' TMN
- '%ProgramFiles%\Ask.com\TaskScheduler.exe' %ProgramFiles%\Ask.com\UpdateTask.exe
Executes the following:
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\Ask Toolbar.msi" /L*vx %TEMP%\ASKSUTBLOG PARTNER=TMN TBR=YES SA=1 HPR=0 /qn TRANSFORMS="%TEMP%\{A4F013AB-0DE5-4CE1-A959-88EFA4B2F274}\1033.MST...
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding 27D957B13CCE9953A48927B23281C7B6
- '<SYSTEM32>\msiexec.exe' -Embedding 275E008174B237646A805CFC4E43850E M Global\MSI0000
