The "DesktopSmiley, Not A Spyware" ToolBar

The "Not A Phishing Worm" really got me interested as it sent special Christmas messages so I decided to dig in just a bit. So as discovered, after the user supplies his MSN credentials, his friends get a link to the "Not A Phishing" website and a lot of tricky links leading to DesktopSmiley.com to download their toolbar. Which they say is "Not Spyware".

So we got a non-phishing worm downloading a non-spyware program, let's see its non-evil actions :)
The first thing I did was downloading the installer, which asks no questions and shows no EULA. It is also digitally signed by "DoubleD Advertising Limited", well that's really funny, we have got to give them that :)

So I ran it in a VM:






That is quite original! "A non-virtualized hardware system is required", of course anybody technical gets how lame this lie is :)
why would an IE toolbar "require" a "non-virtualized hardware", why would it even bother to check if it's running under a virtualized environment unless it has some illegal actions to hide?!

Well i am defiantly not going to execute it on my machine :)
Maby i will test is some other day on a real machine with Restore-IT/Ghost

In the meantime, let's take look at some of the things that it does:
It copies some IE settings from HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ to HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ except for (AutoDetect and UNCAsIntranet which exist there and get modified):
ProxyBypass:1 (default 1)
IntranetName:1 (default 1)
MigrateProxy:1 (default 1)
AutoDetect:1 (default 0)
UNCAsIntranet:1 (default 0)
ProxyEnable:0 (default 0)

It sure looks like someone is going to assign a proxy for us :)

The setup process command-line:
"C:\Documents and Settings\Insider\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\stbup.exe" /new /src=user

the "/src=user" really sounds like there are cases which the user did not initiated the installation :) it could be used for self-update though.

Lets examine some of the the strings in the memory of this "DoubleD" software:
Software\SimonTatham\PuTTY\Sessions
Software\SimonTatham\PuTTY\SshHostKeys
Software\SimonTatham\PuTTY
\PUTTY.RND
Well, i don't want to point a blaming finger but it seems this "legitimate smiley IE toolbar" is very interested in getting some access to our saved PuTTY SSH hosts...quite innocent

There are a lot of weird stuff this spyware does, like starting a local proxy which explains how they steal data from IE and makes this self-updating software a cool way to make a non-botnet botnet :)
It also implements an SSH client and almost every famous encryption algorithm (rinjdeal, AES, des, 3des, blowfish) looks like it does local MITM attacks to SSH login software.

So get root and Smile away with it :)