Adware.OpenCandy.164

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'DAEMON Tools Pro Agent' = '"%ProgramFiles%\DAEMON Tools Pro\DTAgent.exe" -autorun'

Modifies file system

Creates the following files

%TEMP%\aut88a9.tmp
%CommonProgramFiles(x86)%\~bdczsyi.ibo
%TEMP%\nsya077.tmp
%TEMP%\nsta0f5.tmp\lang\bgr.dll
%TEMP%\nsta0f5.tmp\lang\bih.dll
%TEMP%\nsta0f5.tmp\lang\chs.dll
%TEMP%\nsta0f5.tmp\lang\cht.dll
%TEMP%\nsta0f5.tmp\lang\csy.dll
%TEMP%\nsta0f5.tmp\lang\deu.dll
%TEMP%\nsta0f5.tmp\lang\enu.dll
%TEMP%\nsta0f5.tmp\lang\esn.dll
%TEMP%\nsta0f5.tmp\lang\fin.dll
%TEMP%\nsta0f5.tmp\lang\fra.dll
%TEMP%\nsta0f5.tmp\lang\heb.dll
%TEMP%\nsta0f5.tmp\lang\hun.dll
%TEMP%\nsta0f5.tmp\lang\ind.dll
%TEMP%\nsta0f5.tmp\lang\ita.dll
%TEMP%\nsta0f5.tmp\lang\jpn.dll
%TEMP%\nsta0f5.tmp\lang\plk.dll
%TEMP%\nsta0f5.tmp\lang\ptb.dll
%TEMP%\nsta0f5.tmp\lang\rus.dll
%TEMP%\nsta0f5.tmp\lang\srl.dll
%TEMP%\nsta0f5.tmp\lang\sve.dll
%TEMP%\nsta0f5.tmp\lang\trk.dll
%TEMP%\nsta0f5.tmp\lang\ukr.dll
%TEMP%\nsta0f5.tmp\system.dll
%TEMP%\nsta0f5.tmp\reinstpage.ini
%TEMP%\nsta0f5.tmp\regpagetype.ini
%TEMP%\nsta0f5.tmp\regpagetypelite.ini
%TEMP%\nsta0f5.tmp\regpagepaidinfo.ini
%TEMP%\nsta0f5.tmp\regpageemail.ini
%TEMP%\nsta0f5.tmp\regpagetrialinfo.ini
%TEMP%\nsta0f5.tmp\license.rtf
%TEMP%\nsta0f5.tmp\sptdintf.dll
%TEMP%\nsta0f5.tmp\dtsetuphelper.exe
%TEMP%\nsta0f5.tmp\setuphelper.exe
%TEMP%\nsta0f5.tmp\license.bmp
%TEMP%\nsta0f5.tmp\daemonwizard.bmp
%TEMP%\nsta0f5.tmp\waitpage.ini
%TEMP%\nsta0f5.tmp\setupwaitpage.bmp
%TEMP%\nsta0f5.tmp\setuphlp.dll
%ALLUSERSPROFILE%\daemon tools pro\dtpro.dat
%ProgramFiles%\daemon tools pro\dtagent.exe
%ProgramFiles%\daemon tools pro\dtpro.exe
%ProgramFiles%\daemon tools pro\engine.dll
%ProgramFiles%\daemon tools pro\dtcommonres.dll
%ProgramFiles%\daemon tools pro\sptdinst-x64.exe
%ProgramFiles%\daemon tools pro\dthelper.exe
%ProgramFiles%\daemon tools pro\imgengine.dll
%ProgramFiles%\daemon tools pro\discsoftbusservice.exe
%ProgramFiles%\daemon tools pro\sptdintf.dll
%ProgramFiles%\daemon tools pro\dtimgeditor.exe
%ProgramFiles%\daemon tools pro\extractor.exe
%ProgramFiles%\daemon tools pro\dtshellhlp.exe
%ProgramFiles%\daemon tools pro\profiles.ini
%ProgramFiles%\daemon tools pro\plugins\grabbers\gendisc.dll
%ProgramFiles%\daemon tools pro\plugins\grabbers\safedisc.dll
%ProgramFiles%\daemon tools pro\plugins\grabbers\gendpm.dll
%ProgramFiles%\daemon tools pro\plugins\grabbers\gensub.dll
%ProgramFiles%\daemon tools pro\plugins\grabbers\tages.dll
%ProgramFiles%\daemon tools pro\dtgadget64.dll
%ProgramFiles%\daemon tools pro\dtpro.gadget
%ProgramFiles%\daemon tools pro\installgadget.exe
%ProgramFiles%\daemon tools pro\dtshl32.dll
%ProgramFiles%\daemon tools pro\dtshl64.dll
%ProgramFiles%\daemon tools pro\dtshl.propdesc
%ProgramFiles%\daemon tools pro\uninst.exe
%ProgramFiles%\daemon tools pro\lang\bgr.dll
%ProgramFiles%\daemon tools pro\lang\bih.dll
%ProgramFiles%\daemon tools pro\lang\chs.dll
%ProgramFiles%\daemon tools pro\lang\cht.dll
%ProgramFiles%\daemon tools pro\lang\csy.dll
%ProgramFiles%\daemon tools pro\lang\deu.dll
%ProgramFiles%\daemon tools pro\lang\enu.dll
%ProgramFiles%\daemon tools pro\lang\esn.dll
%ProgramFiles%\daemon tools pro\lang\fin.dll
%ProgramFiles%\daemon tools pro\lang\fra.dll
%ProgramFiles%\daemon tools pro\lang\heb.dll
%ProgramFiles%\daemon tools pro\lang\hun.dll
%ProgramFiles%\daemon tools pro\lang\ind.dll
%ProgramFiles%\daemon tools pro\lang\ita.dll
%ProgramFiles%\daemon tools pro\lang\jpn.dll
%ProgramFiles%\daemon tools pro\lang\plk.dll
%ProgramFiles%\daemon tools pro\lang\ptb.dll
%ProgramFiles%\daemon tools pro\lang\rus.dll
%ProgramFiles%\daemon tools pro\lang\srl.dll
%ProgramFiles%\daemon tools pro\lang\sve.dll
%ProgramFiles%\daemon tools pro\lang\trk.dll
%ProgramFiles%\daemon tools pro\lang\ukr.dll
C:\users\public\desktop\daemon tools pro.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\daemon tools pro\daemon tools pro.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\daemon tools pro\image editor.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\daemon tools pro\online help.url
%ProgramFiles%\daemon tools pro\dtproscsibus.sys
%ProgramFiles%\daemon tools pro\dtproscsibus.inf
%ProgramFiles%\daemon tools pro\dtproscsibus.cat
%TEMP%\{604f0d49-2c87-ae4b-a8bd-9d7806563c29}\set658c.tmp
%TEMP%\{604f0d49-2c87-ae4b-a8bd-9d7806563c29}\set65fa.tmp
%TEMP%\{604f0d49-2c87-ae4b-a8bd-9d7806563c29}\set661a.tmp

Sets the 'hidden' attribute to the following files

%CommonProgramFiles(x86)%\~bdczsyi.ibo

Moves the following files

from %TEMP%\{604f0d49-2c87-ae4b-a8bd-9d7806563c29}\set658c.tmp to %TEMP%\{604f0d49-2c87-ae4b-a8bd-9d7806563c29}\dtproscsibus.cat
from %TEMP%\{604f0d49-2c87-ae4b-a8bd-9d7806563c29}\set65fa.tmp to %TEMP%\{604f0d49-2c87-ae4b-a8bd-9d7806563c29}\dtproscsibus.inf
from %TEMP%\{604f0d49-2c87-ae4b-a8bd-9d7806563c29}\set661a.tmp to %TEMP%\{604f0d49-2c87-ae4b-a8bd-9d7806563c29}\dtproscsibus.sys

Network activity

Connects to

'go#####a###ytics.com':80

TCP

HTTP GET requests

http://www.go#####a###ytics.com/collect?v=###################################################################################################################################

UDP