ADWARE_BLAZE

Download the latest scan engine

TypeAdware

In the wild: No

Destructive: No

Language: English

Systems affected: Windows 98, ME, NT, 2000, XP, Server 2003

Encrypted: No

Overall risk rating:

Low

Reported detections:

Low

System  impact:

High

Information exposure:

Medium
 

Description:

Adware is software that displays advertising banners on Web browsers such as Internet Explorer and Mozilla. While not categorized as malware, many users consider adware invasive. Adware programs often create unwanted effects on a system, such as annoying popup ads and, in some instances, the degradation in either network connection or system performance.

Adware programs are typically installed as separate programs that are bundled with certain free software. Many users inadvertently agree to installing adware by accepting the End User License Agreement (EULA) on the free software.

Adware are also often installed in tandem with spyware programs. Both programs feed off of each other's functionalities - spyware programs profile users' Internet behavior, while adware programs display targeted ads that correspond to the gathered user profiles.



TECHNICAL DETAILS



Initial samples received on:  Aug 11, 2004

File type: PE

Memory resident: Yes  

File size: Varies

Related toTROJ_BLAZEFIND.A

Details:

Arrival Details

This grayware may be downloaded from remote site(s) by other malware.

It may be dropped by the following malware:

It may be downloaded unknowingly by a user when visiting malicious Web site(s).

Installation

This grayware creates the following folder(s):

  • %Program Files%\URLBlaze
  • %Program Files%\WindowsSA

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

It drops the following file(s)/component(s):

  • %Program Files%\URLBlaze\URLBlaze.exe - also detected as ADWARE_BLAZE
  • %Program Files%\WindowsSA\libcurl.dll
  • %Program Files%\WindowsSA\omniband.dll
  • %Program Files%\WindowsSA\omniprivacy.khtml
  • %Program Files%\WindowsSA\omniscient.exe
  • %Program Files%\WindowsSA\omniscienthook.dll
  • %System%\axuninstall.exe
  • %System%\wsaupdater.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Techniques

This grayware creates the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Windows SA = "Program Files%\WindowsSA\omniscient.exe"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\
{CE7C3CF0-4B15-11D1-ABED-709549C10000}

This grayware creates the following registry key(s)/entry(ies):

HKEY_CLASSES_ROOT\CLSID\
{CE7C3CF0-4B15-11D1-ABED-709549C10000}

HKEY_CLASSES_ROOT\CLSID\
{EF480A61-A953-4D55-B800-94312BA21052}

HKEY_CLASSES_ROOT\IEHlprObj.IEHlprObj

HKEY_CLASSES_ROOT\IEHlprObj.IEHlprObj.1

HKEY_CLASSES_ROOT\Interface\
{91412B8D-7187-4A88-931D-90C11DA4EBDA}

HKEY_CLASSES_ROOT\Interface\
{CE7C3CEF-4B15-11D1-ABED-709549C10000}

HKEY_CLASSES_ROOT\TypeLib\
{9ACC8AD7-B633-4939-BF3E-52C203539ED0}

HKEY_CLASSES_ROOT\TypeLib\
{CE7C3CE2-4B15-11D1-ABED-709549C10000}

HKEY_CLASSES_ROOT\UBRun.UBTest

HKEY_CLASSES_ROOT\UBRun.UBTest.1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall\URLBlaze

HKEY_LOCAL_MACHINE\SOFTWARE\Ran Geva




SOLUTION


Minimum scan engine version needed: 8.300

Download the latest scan engine


Important note: The "Minimum scan engine" refers to the earliest Trend Micro scan engine version guaranteed to detect this threat. However, Trend Micro strongly recommends that you update to the latest version in order to get comprehensive protection. Download the latest scan engine here.

Solution:

For Windows ME and XP users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

 Step 1: Remove malware files related to ADWARE_BLAZE  

 Step 2: Restart in Safe Mode  [learn how]

 Step 3:  Delete this registry value  [learn how]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
    Windows\CurrentVersion\Run
    • Windows SA = "Program Files%\WindowsSA\omniscient.exe"

 Step 4:  Delete these registry keys [learn how]

  • In HKEY_CLASSES_ROOT\CLSID
    • {CE7C3CF0-4B15-11D1-ABED-709549C10000}
    • {EF480A61-A953-4D55-B800-94312BA21052}
  • In HKEY_CLASSES_ROOT
    • IEHlprObj.IEHlprObj
    • IEHlprObj.IEHlprObj.1
  • In HKEY_CLASSES_ROOT\Interface
    • {91412B8D-7187-4A88-931D-90C11DA4EBDA}
    • {CE7C3CEF-4B15-11D1-ABED-709549C10000}
  • In HKEY_CLASSES_ROOT\TypeLib
    • {9ACC8AD7-B633-4939-BF3E-52C203539ED0}
    • {CE7C3CE2-4B15-11D1-ABED-709549C10000}
  • In HKEY_CLASSES_ROOT
    • UBRun.UBTest
    • UBRun.UBTest.1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
    Windows\CurrentVersion\Explorer\
    Browser Helper Objects
    • {CE7C3CF0-4B15-11D1-ABED-709549C10000}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
    Windows\CurrentVersion\Uninstall
    • URLBlaze
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • Ran Geva

 Step 5: Search and delete these files  [learn how]

*Note: There may be some component files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.

  • %Program Files%\WindowsSA\libcurl.dll
  • %Program Files%\WindowsSA\omniband.dll
  • %Program Files%\WindowsSA\omniprivacy.khtml
  • %Program Files%\WindowsSA\omniscient.exe
  • %Program Files%\WindowsSA\omniscienthook.dll
  • %System%\axuninstall.exe
  • %System%\wsaupdater.exe

 Step 6: Search and delete these folders [learn how]

  • %Program Files%\URLBlaze
  • %Program Files%\WindowsSA

 Step 7: Restart your computer 

 Step 8: Scan your computer with your Trend Micro product to delete files detected as ADWARE_BLAZE

*Note: If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.