PUA.Win32.DriveCleaner.AA

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application drops the following files:

• • %User Temp%\is-{5 random characters}.tmp\{filename}.tmp
• • %User Temp%\is-{5 random characters}.tmp\_isetup\_shfoldr.dll
• • %User Temp%\is-{5 random characters}.tmp\isskin.dll
• • %User Temp%\is-{5 random characters}.tmp\Office2007.cjstyles
• • %Program Files%\GSA Cleandrive\unins000.dat
• • %Program Files%\GSA Cleandrive\is-{5 random characters}.tmp
• • %Program Files%\GSA Cleandrive\is-{5 random characters}.tmp
• • %Program Files%\GSA Cleandrive\is-{5 random characters}.tmp
• • %Program Files%\GSA Cleandrive\is-{5 random characters}.tmp
• • %Program Files%\GSA Cleandrive\is-{5 random characters}.tmp
• • %Program Files%\GSA Cleandrive\is-{5 random characters}.tmp
• • %Common Programs%\GSA Cleandrive\GSA Cleandrive.lnk
• • %Common Programs%\GSA Cleandrive\ReadMe.lnk
• • %Common Programs%\GSA Cleandrive\Cleandrive on the Web.lnk
• • %Common Programs%\GSA Cleandrive\Feedback on the Web.lnk
• • %Common Programs%\GSA Cleandrive\Order on the Web.lnk
• • %Common Programs%\GSA Cleandrive\Uninstall Cleandrive.lnk
• • %Desktop%\GSA Cleandrive.lnk
• • %Application Data%\Microsoft\Internet Explorer\Quick Launch\GSA Cleandrive.lnk
• • %Program Files%\GSA Cleandrive\cleandrive.url
• • %Program Files%\GSA Cleandrive\feedback.url
• • %Program Files%\GSA Cleandrive\order.url
• • %Program Files%\GSA Cleandrive\unins000.msg
• • %Program Files%\GSA Cleandrive\unins000.dat

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Common Programs% is the folder that contains common program groups for all users, which is usually C:\Documents and Settings\All Users\Start Menu\Programs on Windows 2000, XP, and Server 2003, or C:\ProgramData\Microsoft\Windows\Start Menu\Programs on Windows Vista, 7, and 8.. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• • %User Temp%\is-{5 random characters}.tmp\{filename}.tmp
• • "netsh.exe" advfirewall firewall add rule name="GSA Cleandrive" dir=out action=allow program="%Program Files%\GSA Cleandrive\CleanDrive.exe" description="GSA Cleandrive" enable=yes;

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other System Modifications

This Potentially Unwanted Application deletes the following files:

• • %User Temp%\is-{5 random characters}.tmp\_isetup\_shfoldr.dll
• • %User Temp%\is-{5 random characters}.tmp\isskin.dll
• • %User Temp%\is-{5 random characters}.tmp\Office2007.cjstyles
• • %User Temp%\is-{5 random characters}.tmp\{filename}.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It deletes the following folders:

• • %User Temp%\is-{5 random characters}.tmp
• • %User Temp%\is-{5 random characters}.tmp
• • %User Temp%\is-{5 random characters}.tmp\_isetup

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session{Numbers}
Owner = {Hex Values}

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session{Numbers}
SessionHash = {Hex Values}

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session{Numbers}
Sequence = 1

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session{Numbers}
RegFiles{Numbers} = %Program Files%\GSA Cleandrive\CleanDrive.exe

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session{Numbers}
RegFilesHash = {Hex Values}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
Inno Setup: Setup Version = 5.5.5 (a)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
Inno Setup: App Path = %Program Files%\GSA Cleandrive

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
InstallLocation = %Program Files%\GSA Cleandrive\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
Inno Setup: Icon Group = GSA Cleandrive

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
Inno Setup: User = {Username}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
Inno Setup: Selected Tasks = desktopicon,quicklaunchicon

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
Inno Setup: Deselected Tasks =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
Inno Setup: Language = en

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
DisplayName = GSA Cleandrive v3.47

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
UninstallString = "%Program Files%\GSA Cleandrive\unins000.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
QuietUninstallString = "%Program Files%\GSA Cleandrive\unins000.exe" /SILENT

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
DisplayVersion = 3.47

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
Publisher = GSA Software

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
URLInfoAbout = http://www.{BLOCKED}line.de

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
HelpTelephone = +{BLOCKED}006224

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
HelpLink = http://cleandrive.{BLOCKED}line.de/

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
URLUpdateInfo = http://cleandrive.{BLOCKED}line.de/

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
Contact = http://www.{BLOCKED}line.de

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
Comments = © 2015 GSA Software - http://www.{BLOCKED}line.de

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
NoModify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
NoRepair = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
InstallDate = {execution date}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
MajorVersion = 3

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
MinorVersion = 47

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1
EstimatedSize = 10403

It adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session{Numbers}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GSA Cleandrive_is1

Adware Routine

This Potentially Unwanted Application deletes the following registry keys that were created during execution:

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session{Numbers}
RegFilesHash =

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session{Numbers}
RegFiles{Numbers} =

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session{Numbers}
Sequence = 22842368

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session{Numbers}
SessionHash =

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session{Numbers}
Owner =

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session{Numbers}