Your browser is obsolete!

The page may not load correctly.

Free trial
Dr.Web for Android

Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support

Send a message

Your tickets

Profile

Back to news

Doctor Web discovers Trojan installing unwanted software and unremovable ads

December 16, 2016

Malicious programs designed to covertly install other applications are quite popular with virus makers. There exist on the Web a large number of so-called affiliate programs that help cybercriminals profit off of software downloads. One such downloader Trojan, Trojan.Ticno.1537, was examined by Doctor Web specialists in December 2016.

Trojan.Ticno.1537 is downloaded onto a computer by another malware program. Once launched, the Trojan searches for the virtual environment and debugging tools by checking the names of the running processes and the corresponding branches of the Windows system registry. In addition, Trojan.Ticno.1537 verifies the Product ID, user and computer names, the number of nested folders in Program Files, the name of the BIOS producer, and it discerns whether the running processes, perl.exe or python.exe, are present. If the scanning process is successful, the Trojan launches the Explorer and terminates its operation.

If the Trojan does not find anything suspicious, it saves the file 1.zip on the disk.

#drweb

The picture above shows a non-standard Microsoft Windows “save” dialog box: in the bottom-left corner, you can see the link “Additional settings”. When the link is clicked, Trojan.Ticno.1537 displays the list of programs it is ready to install on the computer:

#drweb

If the user clicks “Save”, Trojan.Ticno.1537 downloads and installs these programs.

Among the applications Trojan.Ticno.1537 installs on the victim’s computer are the browser Amigo and the program HomeSearch@Mail.ru (developed by Mail.Ru) and the Trojans Trojan.ChromePatch.1, Trojan.Ticno.1548, Trojan.BPlug.1590, Trojan.Triosir.718, Trojan.Clickmein.1, and Adware.Plugin.1400.

The above-mentioned Trojan.ChromePatch.1 is an adware program that is distributed via the application TrayCalendar, which was created in 2002. The program and the Trojan are packed in a single installation package.

#drweb

While TrayCalendar is being copied to the disk, the Trojan saves and installs an extension for Google Chrome. The most notable feature of Trojan.ChromePatch.1 is that it infects the Chrome resource file—resources.pak. Cybercriminals have been using this method since at least spring 2015 to force the display of advertisements even after the Trojan has been removed from a computer. The size of this file remains unchanged during the infection process because Trojan.ChromePatch.1 searches it for strings containing comments and replaces them with its code. Trojan.ChromePatch.1 is designed to show advertisements in the Chrome browser.

Dr.Web Anti-virus successfully detects and removes all the Trojans mentioned above. Therefore, they do not pose any threat to our users.

More about this Trojan

Tell us what you think

You will be awarded one Dr.Webling per comment. To ask Doctor Web’s site administration about a news item, enter @admin at the beginning of your comment. If your question is for the author of one of the comments, put @ before their names.


Other comments

The Russian developer of Dr.Web anti-viruses

Doctor Web has been developing anti-virus software since 1992

Dr.Web is trusted by users around the world in 200+ countries

The company has delivered an anti-virus as a service since 2007

24/7 tech support

© Doctor Web
2003 — 2017

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125040