Virus Detail

Description

Back to top

Method of Infection

When executed, Qoologic trojans drop an executable file to the %Windows% or %System% directories using a filename generated from the hard disk serial number of the affected system.

The trojan then modifies the registry to execute this file at each Windows start. This modification varies slightly according to variant.

For example Qoologic.A makes the following modification:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Narrator = "%Windows%\<random filename>.exe"

while more recent variants use 'KavSvc' as a value name (for example):

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\KavSvc = "%Windows%\<random filename>.exe"

Note: '%System%' and '%Windows%' are variable locations. The malware determines the location of these folders by querying the operating system. The default installation location for the System directory for Windows 2000 and NT is C:\Winnt\System32; for 95,98 and ME is C:\Windows\System; and for XP is C:\Windows\System32.The default installation location for the Windows directory for Windows 2000 and NT is C:\Winnt; for 95,98 and ME is C:\Windows; and for XP is C:\Windows.

These trojans also drop 2 DLLs which use the same method of filename generation as mentioned above for the executable.

One of these DLLs keeps itself registered as a service process that is used to initialize and maintain the activity of the second DLL which contains the core functionality of Qoologic.

Some variants also make a copy of the inital dropper in the
"%Documents and Settings%\All Users\Start Menu\Programs\Startup" directory.

Note: %Documents and Settings% is a variable location and refers to the current user's Documents and Settings folder. The malware determines the location of the current Documents and Settings folder by querying the operating system. A typical location for this folder would be: C:\Documents and Settings.

Back to top

Payload

Stealth

Qoologic trojans are able to hide processes/files/registry values from other programs.

Backdoor Functionality

Qoologic downloads an XML configuration file from a remote server that may contain a number of different commands, including:

• Clear all pop-ups
• Set foreground window
• Remove programs/windows from the taskbar
• Create full-screen pop-ups
• Generate an exception (i.e. - crash a program)
• Monitor its own hooks
• Execute tasks from a remote server
• Create pop-ups
• Dump debug data to a remote server
• Display a fake uninstalled message dialog
• Update itself
• Show a pop-up message
• Monitor mouse clicks and keystrokes
• Modify the user's registry

Note: Pop-ups are served from a remote web server

Qoologic variants have been associated with the following list of IP addresses/URLs:

updates.qoologic.com
u.clkoptimizer.com
66.63.167.77
69.93.10.214
dl.web-nexus.net
216.144.225.108
216.144.225.99
209.66.67.134
69.59.186.63

Hijacks/Redirects Internet Browsing

Qoologic hijacks (redirects) both Internet Explorer windows and those of any other browser which is based on Mozilla code (e.g. - Opera, Mozilla, Firefox, Netscape, etc).

Note: Early variants of this family achieved this by adding themselves as a BHO (browser helper object) as well, but later variants only hijack the browser processes directly.

Qoologic contains a list of URLs that are excepted from hijacking/redirecting. Variants A to F do not modify the following when they are located in the user's browser's address bar:

about:blank
ad.doubleclick.net
ad.trafficmp.com
adfarm.mediaplex.com
ads.addynamix.com
ads.bidclix.com
ads.clickagents.com
ads.delfinproject.com
ads1.revenue.net
adserv.internetfuel.com
advert.runescape.com
aim-charts.pf.aol.com
akapp.whenu.com
allaboutsearching.com
amch.questionmarket.com
ar.atwola.com
as.adwave.com
as.casalemedia.com
ayb.lop.com
bannerfarm.ace.advertising.com
banners.pennyweb.com
bannerserver.gator.com
by.optimost.com
c.qckjmp.com
Cannot find server
cdn-aimtoday.aol.com
cdn-cf.aol.com
cfg.mywebsearch.com
clickit.go2net.com
count.exitexchange.com
counters.honesty.com
ctl.twain-tech.com
delfinproject.com
download.abetterinternet.com
download.smileycentral.com
e.rn11.com
focusin.ads.targetnet.com
games.yahoo.com
hotmail.com
hotmail.msn.com
insider.msg.yahoo.com
jbns2.cydoor.com
jicmedia.cjt1.net
jmnad1.com
jnictech.cjt1.net
join1.winhundred.com
kill-pop-ups.com
license.hotbar.com
look2me.com
m2.doubleclick.net
m3.doubleclick.net
mail.yahoo.com
master.mx-targeting.com
media.fastclick.net
messenger.msn.com
mm.delfinproject.com
newupdates.lzio.com
odysseusmarketing.com
oz.valueclick.com
paypopup.com
pgq.yahoo.com
pops.browseraid.com
popuppers.com
popuptraffic.com
qksrv.net
radio.launch.yahoo.com
rightmedia.net
sandboxer.com
search200.com
searcheffect.com
servedby.adscpm.com
servedby.advertising.com
smileycentral.com
sr.adwave.com
sr.websearch.com
stopzilla.com
top-banners.com
topicks.com
tv.180solutions.com
us.update.companion.yahoo.com
v4.windowsupdate.microsoft.com
view.atdmt.com
weatherbug.com
web.icq.com
webpdp.gator.com
windowsupdate.microsoft.com
wisapidata.weatherbug.com
ww2.weatherbug.com
www4.yesadvertising.com
xadso.offeroptimizer.com
xadsq.offeroptimizer.com
xlime.offeroptimizer.com
xzoomy.com
zone.msn.com

Analysis by Paul Taylor

Back to top