Remove Altnet.h - Spyware Removal Information

More than 1309737 spyware signatures and growing

Spywarelib Search

Search in:

Spywares

Files

Md5

Registry

Adware.Altnet.h Analysis Report

Threat Submitted On: 5/10/2007 4:01:52 PM

Threat Analysed On: 5/10/2007 9:01:52 PM

Threat Updated On: 11/8/2009 3:34:51 PM

Type : Adware

Symptoms of Altnet.h

Displays porn/abusive content or intrusive third-party advertisements.
Shows deceptive or false warning.
Generates advertisement even when the program is not running
Synchronously installs other bundled program.
The program can places unwanted adverts on computer screen.

Removal Recommended (Click here to remove automatically)

Removal Recommended

Information

Alias : AdWare.Win32.Altnet.h

Md5 Hash : [318abf9a624e9c8efa85b048dd9d9eeb]

File Size : (336898 bytes)

Technical Details

Here are the Technical findings of our analysis team after analyzing this malware in detail :-

Creates the following infected Files on user's System

Note:

Delete the following Files to remove Infection

File: settings.cab
Path : %workingdir%
Md5Hash :5ac2bf23823f3787c23dc673f9ea8f88 ( 6853 bytes)

File: 873101.tmp
Path : %systemdrive%\temp
Md5Hash :5ac2bf23823f3787c23dc673f9ea8f88 ( 6853 bytes)

File: cab23e9.tmp
Path : %temp%
Md5Hash :3d6ed78b807719115a703fa75932da69 ( bytes)

File: cab8568.tmp
Path : %temp%
Md5Hash :3d6ed78b807719115a703fa75932da69 ( bytes)

File: tar12.tmp
Path : %temp%
Md5Hash :8b3dd9d1d18cbdfded50640b268dc390 ( bytes)

File: [randomname].exe
Path : %workingdir%

	Md5Hash :


		1020888f39ba5b962552aef71e791f2d ( 336922 bytes)


		21a8f5dcff9ec37d3fa817626a084a55 ( 336918 bytes)


		318abf9a624e9c8efa85b048dd9d9eeb ( 336898 bytes)


		3a7e8e33a0cda90fce0d94aa65bd8a1a ( 336914 bytes)


		4bff77af0b1f6a1596befa7d34fa561b ( 307871 bytes)


		4d951ab4f1a408992536a474a3276b7f ( 336912 bytes)


		5b229cf1c98d90d59967f72f0610dd74 ( 336911 bytes)


		748f3fe35e10169c78fea50cc14edf41 ( 336900 bytes)


		78c7cbd76e344e07684fd62f39e06f79 ( 336924 bytes)


		9c49f4eec4ef6099c9afefde0a3fa4a1 ( 336919 bytes)


		a1682bde919ab5b0f705d42ca6364040 ( 336917 bytes)


		a5d5e2e40d4dabe027276111dc6c5c93 ( 336920 bytes)


		a60c1c843118f8c2eb4a8b2675842916 ( 336916 bytes)


		b5cfb8d7e5a2ca5644fd749987f99dce ( 336981 bytes)


		b655f72e65a59342eec407a616051be1 ( 336921 bytes)


		c9e76594589930b6b8a3adcb8f3c177a ( 336915 bytes)


		f86c05d04023f51234f2de45ab54c21e ( 336913 bytes)

File: [randomname].exe.manifest
Path : %workingdir%
Md5Hash :7f2f93f9906ca460d770548e7b10cd3a ( 729 bytes)

Also creates the following files on user's System which are also created by Genuine Software :-

Note:

These file(s) can be kept as they are also created by genuine Software.

File : cab14.tmp
Path : %systemdrive%\temp
Md5Hash :929a5e89a230108104166166d1f65ab5 ( bytes)

File : cab16.tmp
Path : %systemdrive%\temp
Md5Hash :4cb2fa1548ca154c43b43af27d98c8cf ( bytes)

File : cab17.tmp
Path : %systemdrive%\temp
Md5Hash :4cb2fa1548ca154c43b43af27d98c8cf ( bytes)

File : cab1b.tmp
Path : %systemdrive%\temp
Md5Hash :4cb2fa1548ca154c43b43af27d98c8cf ( bytes)

File : cab27ab.tmp
Path : %systemdrive%\temp
Md5Hash :3d6ed78b807719115a703fa75932da69 ( bytes)

File : cab2f.tmp
Path : %systemdrive%\temp
Md5Hash :4cb2fa1548ca154c43b43af27d98c8cf ( bytes)

File : cab3971.tmp
Path : %systemdrive%\temp
Md5Hash :3d6ed78b807719115a703fa75932da69 ( bytes)

File : cab3fe5.tmp
Path : %systemdrive%\temp
Md5Hash :3d6ed78b807719115a703fa75932da69 ( bytes)

File : cab438.tmp
Path : %systemdrive%\temp
Md5Hash :3d6ed78b807719115a703fa75932da69 ( bytes)

File : cab4499.tmp
Path : %systemdrive%\temp
Md5Hash :3d6ed78b807719115a703fa75932da69 ( bytes)

File : cab6d48.tmp
Path : %systemdrive%\temp
Md5Hash :3d6ed78b807719115a703fa75932da69 ( bytes)

File : cab834c.tmp
Path : %systemdrive%\temp
Md5Hash :3d6ed78b807719115a703fa75932da69 ( bytes)

File : cabacf3.tmp
Path : %systemdrive%\temp
Md5Hash :3d6ed78b807719115a703fa75932da69 ( bytes)

File : cabb87f.tmp
Path : %systemdrive%\temp
Md5Hash :3d6ed78b807719115a703fa75932da69 ( bytes)

File : cabba9d.tmp
Path : %systemdrive%\temp
Md5Hash :3d6ed78b807719115a703fa75932da69 ( bytes)

File : cabc.tmp
Path : %systemdrive%\temp
Md5Hash :929a5e89a230108104166166d1f65ab5 ( bytes)

File : cabd.tmp
Path : %systemdrive%\temp
Md5Hash :929a5e89a230108104166166d1f65ab5 ( bytes)

File : cabebc4.tmp
Path : %systemdrive%\temp
Md5Hash :3d6ed78b807719115a703fa75932da69 ( bytes)

File : cabf.tmp
Path : %systemdrive%\temp
Md5Hash :929a5e89a230108104166166d1f65ab5 ( bytes)

File : settings.dat
Path : %systemdrive%\temp
Md5Hash :3d6ed78b807719115a703fa75932da69 ( bytes)

File : tar11.tmp
Path : %systemdrive%\temp
Md5Hash :d01d66ea18b9cb92d6b55e4dd41be607 ( bytes)

File : tar16.tmp
Path : %systemdrive%\temp
Md5Hash :d01d66ea18b9cb92d6b55e4dd41be607 ( bytes)

File : tar18.tmp
Path : %systemdrive%\temp
Md5Hash :9b6459674661d29502976218bcd8b2b8 ( bytes)

File : tar19.tmp
Path : %systemdrive%\temp
Md5Hash :9b6459674661d29502976218bcd8b2b8 ( bytes)

File : tar1d.tmp
Path : %systemdrive%\temp
Md5Hash :9b6459674661d29502976218bcd8b2b8 ( bytes)

File : tar32.tmp
Path : %systemdrive%\temp
Md5Hash :9b6459674661d29502976218bcd8b2b8 ( bytes)

File : tare.tmp
Path : %systemdrive%\temp
Md5Hash :d01d66ea18b9cb92d6b55e4dd41be607 ( bytes)

File : tarf.tmp
Path : %systemdrive%\temp
Md5Hash :d01d66ea18b9cb92d6b55e4dd41be607 ( bytes)

File : cab10.tmp
Path : %temp%
Md5Hash :47edc8cc785cbbfaa38741906a55af05 ( bytes)

File : 2bf68f4714092295550497dd56f57004
Path : %userprofile%\application data\microsoft\cryptneturlcache\content

	Md5Hash :


		41a867e5239dbc5866d40ab082a0a54d ( 18 bytes)


		83712bba68762ba5689bae4d6cfb6a58 ( 18 bytes)

File : 486cc6afd08942336c61fcd401c4a1d1
Path : %userprofile%\application data\microsoft\cryptneturlcache\content

	Md5Hash :


		2f954e25aaf045e1cb806888f2dd63ea ( 44696 bytes)


		4d762844adf023e5bf52a4ab06b63ad8 ( 51352 bytes)


		ee2a4a7a3e6538af2a9ee92e5b12ea09 ( 52857 bytes)

File : 74bfd122c0875ec75dbe5c6db4c59019
Path : %userprofile%\application data\microsoft\cryptneturlcache\content

	Md5Hash :


		221f9d5204d5007f86a4544cd808fed5 ( 428314 bytes)


		264fb79d59bff1be3dec606ac23ccf12 ( 433037 bytes)


		c1af56aa24e3f26c6e1569bfa192aba3 ( 391044 bytes)

File : 94308059b57b3142e455b38a6eb92015
Path : %userprofile%\application data\microsoft\cryptneturlcache\content

	Md5Hash :


		47edc8cc785cbbfaa38741906a55af05 ( 26441 bytes)


		4cb2fa1548ca154c43b43af27d98c8cf ( 25660 bytes)

File : 2bf68f4714092295550497dd56f57004
Path : %userprofile%\application data\microsoft\cryptneturlcache\metadata

	Md5Hash :


		19ffe6bd1b3125a5b5f1d82f3db9a8f9 ( 216 bytes)


		32d37026c0b677638d7b2e9701cf99cd ( 216 bytes)


		368c528718e41b76dc5a40de9513e494 ( 216 bytes)


		57159a280345e854f23dd43ecee01170 ( 216 bytes)


		61bf10fc51d014ce0fdaf6353fba015a ( 216 bytes)


		653f5787833c9c5f47d9fc851201372d ( 216 bytes)


		8c5035436c1261a56b3bcab8e6255d79 ( 216 bytes)


		ce31c9b6f7af93c7a03a332d23a7bf51 ( 216 bytes)


		dcb4da06caed5c594f4594f802f3726c ( 216 bytes)


		df597e65bcf90df2cf766696834570e1 ( 216 bytes)


		e0f85dfabc23758e25fc3f92b02f2f6b ( 216 bytes)


		faff4de3852874f53994f0d2ba67d113 ( 216 bytes)

File : 486cc6afd08942336c61fcd401c4a1d1
Path : %userprofile%\application data\microsoft\cryptneturlcache\metadata

	Md5Hash :


		1b027465a500f8709000a42363419a3c ( 120 bytes)


		31e54b16942d348d130280b863c6fcea ( 120 bytes)


		4e33848d5f598722fe50f6c100f9bacb ( 120 bytes)


		5176ad51b49826ae9c6ea1979bc5be8b ( 120 bytes)


		67666016bc1e0118323284336831056e ( 120 bytes)


		6bb4e398283c3411d2eaa9c73d01e0e7 ( 120 bytes)


		748bd68a418097c47a904e64bf535a0e ( 120 bytes)


		a6a0e7b6eff46199a7169419771d0f0a ( 120 bytes)


		a72abea3c2bba7db90efccecc01ddf64 ( 120 bytes)


		b05c4484f6c43aea9912ef90e4705e55 ( 120 bytes)


		b51475e0d1579965aeedf9259862dda5 ( 120 bytes)


		d35b3d2ca3ed3555ae5991cf62335a75 ( 120 bytes)


		e0b5d2660b67d534eedecbacafe15fe9 ( 120 bytes)

File : 74bfd122c0875ec75dbe5c6db4c59019
Path : %userprofile%\application data\microsoft\cryptneturlcache\metadata

	Md5Hash :


		130d7e5ad08759dffbab34d722c83c9e ( 124 bytes)


		4999f95a8d00bb31837b0ca23486b5a8 ( 124 bytes)


		5267932b4a3b127533066dd565a895ab ( 124 bytes)


		52aa154bc22e7c4aba74ac1bbc66886a ( 124 bytes)


		7c3a535e43f2fee7a229b0206c078848 ( 124 bytes)


		7d778302f3fc442c10cdb263cdbca440 ( 124 bytes)


		945af9ec06c016f37b8174dcde408b77 ( 124 bytes)


		bbc23acf9fb27106b907e605a3c51205 ( 124 bytes)


		cc7e5e86272677610d6bd3c8331affa7 ( 124 bytes)


		de5e94f138d3ba15e63c91946061be97 ( 124 bytes)


		e7a2b16f19e30b9047584152a637f5b1 ( 124 bytes)


		ec625651443f73b9ff78370e945943ae ( 124 bytes)


		f12cee2894bf9a37db6a7d86677251b2 ( 124 bytes)

File : 94308059b57b3142e455b38a6eb92015
Path : %userprofile%\application data\microsoft\cryptneturlcache\metadata

	Md5Hash :


		087b8c1ab3b958008755a6c48f40d39c ( 216 bytes)


		08c2ca040d9429f6a4fbb8f602df3c0a ( 216 bytes)


		17167d305341ba94567ac43e4b3c2296 ( 216 bytes)


		1aebc64fe5a626cc626bc96b7ff1c17a ( 216 bytes)


		2f16d80a6ceba04125dda8593e99a9a0 ( 216 bytes)


		364298324c9739d6767b84e1c7b6a95b ( 216 bytes)


		48b87d1257a2c73ea4e96ba7817b3792 ( 216 bytes)


		5b81b27fad76df673167689b8b03cc09 ( 216 bytes)


		77c2151cfe4cbb8656b56c477017cdbd ( 216 bytes)


		b50cccbf573d476124c523f76edf149f ( 216 bytes)


		e821d7348be7f487f31413c126bd8f03 ( 216 bytes)

File : msimgsiz.dat
Path : %userprofile%\local settings\application data\microsoft\internet explorer
Md5Hash :58b111e2b15f7867c853dfab9686ed6d ( 16384 bytes)

File : desktop.ini
Path : %userprofile%\local settings\history
Md5Hash :d332ce83b166d5c244d22587ad75aac4 ( 113 bytes)

Creates the following infected Registry Keys on user's System

Note:

Delete these Registries to remove Infection

HKEY_LOCAL_MACHINE\Software\Altnet

HKEY_LOCAL_MACHINE\Software\Altnet\Dashboard\Settings

HKEY_LOCAL_MACHINE\Software\Altnet\Dashboard\Setup

The following Registry Values are added to the provided Registry Keys :-

Note:

Delete the added Values from the Key to remove Infection

Key:

HKEY_LOCAL_MACHINE\SOFTWARE\Altnet

|__ Value Added :

sharedfilesdir = "%programfiles%\altnet"

Key:

HKEY_LOCAL_MACHINE\Software\Altnet\Dashboard\Settings

|__ Value Added :

bandwidthcapstartday = "[reg_dword, value: 00000000]"

Key:

HKEY_LOCAL_MACHINE\SOFTWARE\Altnet\Dashboard\Settings

|__ Value Added :

capbandwidth = "[reg_dword, value: 00000000]"

Key:

HKEY_LOCAL_MACHINE\Software\Altnet\Dashboard\Settings

|__ Value Added :

downloadsthismonth = "0.000000"

Key:

HKEY_LOCAL_MACHINE\SOFTWARE\Altnet\Dashboard\Settings

|__ Value Added :

enablesharing = "[reg_dword, value: 00000001]"

Key:

HKEY_LOCAL_MACHINE\SOFTWARE\Altnet\Dashboard\Settings

|__ Value Added :

lastaskedupgrade = "[reg_dword, value: 013266c6]"

Key:

HKEY_LOCAL_MACHINE\SOFTWARE\Altnet\Dashboard\Settings

|__ Value Added :

maxbandwidth = "[reg_dword, value: 00000800]"

Key:

HKEY_LOCAL_MACHINE\Software\Altnet\Dashboard\Settings

|__ Value Added :

maxshare = "[reg_dword, value: 000008f4]"

Key:

HKEY_LOCAL_MACHINE\Software\Altnet\Dashboard\Settings

|__ Value Added :

maxshare = "[reg_dword, value: 000008f5]"

Key:

HKEY_LOCAL_MACHINE\SOFTWARE\Altnet\Dashboard\Settings

|__ Value Added :

maxshare = "[reg_dword, value: 000009ae]"

Key:

HKEY_LOCAL_MACHINE\Software\Altnet\Dashboard\Settings

|__ Value Added :

orgsharedfilesdir = "%programfiles%\altnet\points manager\temp internet shares"

Key:

HKEY_LOCAL_MACHINE\Software\Altnet\Dashboard\Settings

|__ Value Added :

shareanytime = "[reg_dword, value: 00000001]"

Key:

HKEY_LOCAL_MACHINE\SOFTWARE\Altnet\Dashboard\Settings

|__ Value Added :

shareoption = "[reg_dword, value: 00000000]"

Key:

HKEY_LOCAL_MACHINE\Software\Altnet\Dashboard\Settings

|__ Value Added :

shareweekends = "[reg_dword, value: 00000001]"

Key:

HKEY_LOCAL_MACHINE\SOFTWARE\Altnet\Dashboard\Settings

|__ Value Added :

timeafter = "[reg_dword, value: 00000013]"

Key:

HKEY_LOCAL_MACHINE\Software\Altnet\Dashboard\Settings

|__ Value Added :

timebefore = "[reg_dword, value: 00000008]"

Key:

HKEY_LOCAL_MACHINE\Software\Altnet\Dashboard\Settings

|__ Value Added :

topleft = "[reg_dword, value: 00e70115]"

Key:

HKEY_LOCAL_MACHINE\SOFTWARE\Altnet\Dashboard\Settings

|__ Value Added :

topleft = "[reg_dword, value: 00ea00b1]"

Key:

HKEY_LOCAL_MACHINE\Software\Altnet\Dashboard\Settings

|__ Value Added :

trafficmonth = "[reg_dword, value: 00000006]"

Key:

HKEY_LOCAL_MACHINE\Software\Altnet\Dashboard\Settings

|__ Value Added :

trafficmonth = "[reg_dword, value: 00000008]"

Key:

HKEY_LOCAL_MACHINE\Software\Altnet\Dashboard\Settings

|__ Value Added :

trafficstartday = "[reg_dword, value: 0000000a]"

Key:

HKEY_LOCAL_MACHINE\Software\Altnet\Dashboard\Settings

|__ Value Added :

trafficstartday = "[reg_dword, value: 00000015]"

Key:

HKEY_LOCAL_MACHINE\Software\Altnet\Dashboard\Settings

|__ Value Added :

trafficthismonth = "0.00"

Key:

HKEY_LOCAL_MACHINE\Software\Altnet\Dashboard\Settings

|__ Value Added :

uploadsthismonth = "0.000000"

Key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

|__ Value Added :

altnetpointsmanager = ""

The following Registry Values are added to the provided Registry Keys which are also created by Genuine Software :-

Note:

These Values can be left as they are also created by legitimate Software :-

Key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Ratings

|__ Value Added :

filename0

Creates the following child process(s) on execution:

services.exe

Creates the Following MUTEX(s) on user's System:-

{84947959-c865-4ccf-b068-759f45ed181e}

raspbfile

msratingmutex

ctf.lbes.mutexdefaults-1-5-21-2150240066-4146203547-916303718-1010

ctf.compart.mutexdefaults-1-5-21-2150240066-4146203547-916303718-1010

ctf.asm.mutexdefaults-1-5-21-2150240066-4146203547-916303718-1010

ctf.layouts.mutexdefaults-1-5-21-2150240066-4146203547-916303718-1010

ctf.tmd.mutexdefaults-1-5-21-2150240066-4146203547-916303718-1010

Tries To Connect to The Following Urls:-

Http_Version :http/1.1

38.118.139.20/pointsmanager/settings.cab?20080326

Http_Version :http/1.1

199.7.54.190/thawtepremiumserverca.crl

Http_Version :http/1.1

199.7.54.190/thawtecodesigningca.crl

Http_Version :http/1.1

125.23.216.201/msdownload/update/v3/static/trustedr/en/authrootseq.txt

Http_Version :http/1.1

125.23.216.201/msdownload/update/v3/static/trustedr/en/authrootstl.cab

Copies the Following Files to Given Location :-

Copies :%systemdrive%\docume~1\antisp~1\locals~1\temp\cab8568.tmp

To : %systemdrive%\docume~1\antisp~1\locals~1\temp\settings.dat

Copies :%systemdrive%\docume~1\antisp~1\locals~1\temp\873101.tmp

To : %workingdir%\settings.cab

NOTE:

1. %workingdir% Refers to the current directory in which user is working.
2. %systemdrive% Refers to the windows System drive folder. By default it is 'C:\'
3. %temp% Refers to the windows temp folder. By default it is 'C:\Documents and Settings\[user]\Local Settings\Temp'
4. %userprofile% Refers to the windows current user's profile folder. By default it is 'C:\Documents and Settings\[user]'

Important: We strongly recommend that you backup the Registry before making any changes to it. Incorrect changes to the Registry can result in permanent data loss or corrupted Files. Modify the malicious\suspicious Subkeys only.

Click Here for more spywarelib.com recommended PC Security and Optimization Tools

To modify registry entries in Windows Operating System:
Follow Steps:
1. Click Start > Run
2. Type “regedit” : to open registry editor
3. Navigate to required registry Key from the Left Tree control and modify accordingly.