PUA.Win32.SLIMWARE.AA

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be manually installed by a user.

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be manually installed by a user.

Installation

This Potentially Unwanted Application adds the following folders:

• %Program Files%\SlimCleaner Plus
• %Program Files%\SlimService

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), 7 (32-bit), and 8 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), 7 (64-bit), and 8 (64-bit).)

It drops the following files:

• %User Temp%\SWI{random}.tmp
• %User Temp%\Cab{random}.tmp
• %User Temp%\Tar{random}.tmp
• %User Temp%\SlimCleanerPlus_en-US_x86_Silent.exe
• %User Temp%\SIOUT{random}\SlimCleanerPlus_en-US_x86.msi
• %AppDataLocal%\Downloaded Installers\{GUID value}\setup.msi
• %Program Files%\SlimCleaner Plus\default.ui
• %Program Files%\SlimCleaner Plus\locales
• %Program Files%\SlimCleaner Plus\main.ui
• %Program Files%\SlimCleaner Plus\mdp.exe
• %Program Files%\SlimCleaner Plus\Open-Source Licenses.txt
• %Program Files%\SlimCleaner Plus\SlimCleanerPlus.exe
• %Program Files%\SlimCleaner Plus\UninstallStub.exe
• %Program Files%\SlimCleaner Plus\default.ui
• %Program Files%\SlimCleaner Plus\locales
• %Program Files%\SlimCleaner Plus\main.ui
• %Program Files%\SlimCleaner Plus\mdp.exe
• %Program Files%\SlimCleaner Plus\Open-Source Licenses.txt
• %Program Files%\SlimCleaner Plus\SlimCleanerPlus.exe
• %Program Files%\SlimCleaner Plus\UninstallStub.exe
• %Desktop\SlimCleaner Plus.lnk

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local on Windows Vista, 7, and 8.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), 7 (32-bit), and 8 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), 7 (64-bit), and 8 (64-bit).)

Autostart Technique

This Potentially Unwanted Application registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SlimService
Type = "0x00000010"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SlimService
Start = "0x00000002"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SlimService
ErrorControl = "0x00000001"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SlimService
ImagePath = "%Program Files%\SlimService\SlimServiceFactory.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SlimService
DisplayName = "SlimWare Utility Service Launcher"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SlimService
DependOnService = "{hex value}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SlimService
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SlimService
Description = "Services SlimWare Utilities applications and products."

Other System Modifications

This Potentially Unwanted Application adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\SlimWare Utilities Inc

HKEY_LOCAL_MACHINE\SOFTWARE\SlimWare Utilities Inc\
SlimCleaner Plus

HKEY_LOCAL_MACHINE\SOFTWARE\SlimWare Utilities Inc\
SlimCleaner Plus\InstallerData

HKEY_LOCAL_MACHINE\SOFTWARE\SlimWare Utilities Inc\
SlimCleaner Plus\Registration

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
SlimCleaner Plus

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\SlimWare Utilities Inc
MachineID = "{hex value}"

HKEY_LOCAL_MACHINE\SOFTWARE\SlimWare Utilities Inc\
SlimCleaner Plus\InstallerData
ul_stubid = "{GUID value}"

HKEY_LOCAL_MACHINE\SOFTWARE\SlimWare Utilities Inc\
SlimCleaner Plus\InstallerData
ul_track = "SCP{number}"

HKEY_LOCAL_MACHINE\SOFTWARE\SlimWare Utilities Inc\
SlimCleaner Plus\Registration
InstallationID = "{hex value}"

Other Details

This Potentially Unwanted Application connects to the following possibly malicious URL:

• http://trk.{BLOCKED}reutilities.com/ulc.php?ev=InstallerInvoked&platformOSVersion={version number}&ul_stubid={GUID value}&installer={installer info}&profuct=SW1&installerVersion=2.4.1&machineId={GUID value}&platformOS=Windows&ul_track=SCP077
• http://trk.{BLOCKED}reutilities.com/ulc.php?ev=InstallerFinished&platformOSVersion={version number}&ul_stubid={GUID value}&installer={installer info}&profuct=SW1&installerVersion=2.4.1&machineId={GUID value}&platformOS=Windows&ul_track=SCP077
• http://stc.{BLOCKED}reutilities.com/gettrack?product=SW1
• http://sf.{BLOCKED}d.com/{hex value}
• http://cdn.{BLOCKED}eaner.com/downloads/scplus/SlimCleanerPlus_en-US_x86_Silent.exe