Mr. Angry Pants

Our good old friend, NSIS Media, comes back for a second ride. As you know, the first ride is always free. It’s good for business. Nothing like a good promotion to draw new customers. But when you come over for a second ride, it won’t be cheap.

Right after I finished writing the last post, I was greeted with a nice pop-up suggesting I should get a green card. I was quite surprised I was infected with NSIS Media, because I only opened the installers on a Virtual PC. After a little meditation, mainly to cool myself, but also to dig in my memories, I recalled I opened one of the installers to take a screenshot. Foolishly, I assumed it’d only install this malware along with the program itself. How deep was my mistake to think they’d actually be that nice. The malware installed itself even before the first wizard page showed up. All doubt was removed. This software is pure evil.

I’ve taken several routes to bring this internet atrocity to an end. So far, the most fruitful route was based on a friend’s advice. I contacted Software Freedom Law Center to get their help sending a cease and desist letter to NSIS Media. In the process, I found out a lot interesting facts about NSIS Media. Like Openwares, they are located in Vanuatu, a Melanesian island which is, of course, outside of the USA. This means a cease and desist won’t affect them and so further research is required. This also raises the intresting question of NSIS Media’s owner. Both companies are based in Vanuatu and are hosted with aplus.net. As clearly stated in Openwares’ RSS and many other places, Openwares is owned by Opensoft Corporation which is making the web more interesting since 2001. It won’t be too far fetched to assume NSIS Media is also a part of this corporation, if not at least its best partner.

This corporate deserves a lot of credit. It has ripped off many open source programs and has plauged the web with Cydoor and NSIS Media malwares. A very paritial list follows.

  • Openwares – distributing malware infected packages on download.com.
  • Turbo TorrentG3 Torrent rip off containing NSIS Media, but claiming to be adware free.
  • FoxieCCleaner rip off, Firefox look alike designed to fool people into thinking it’s the new Firefox everyone is talking about. There have also been reports of it packing NSIS Media, but I cannot confirm that. They claim to be based in Israel, however they are hosted on aplus.net, are linked from every Opensoft website and have Opensoft listed in their license as a contractor.

    U.S. Government Information Use, duplication, or disclosure by the U.S. Government of the computer and software documentation in this package shall be subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.277-7013 (Oct 1988) and FAR 52.227-19 (Jun 1987). The Contractor is Opensoft Corporation, Vanuatu.

  • MP3 Shield – another Opensoft venture which is currently offline. Probably packed with NSIS Media as well and most probably a rip off.
  • Startup Mechanic – calims to protect your PC but installs NSIS Media.

Now that we’ve gotten to know them, lets dig in and see how NSIS Media works. As I’ve previously said, NSIS Media “enhanced” installations include two DLL files installed into the system folder. The names vary, but the goal is always the same. The first, written using MSVC, leeches on just about every process in the system and loads the second. It is also responsible of installation and removal, according to strings that show up in it. The weird thing about this file is its PDB path which is always under c:Cydoor_shell_project. Cydoor are reportedly out of this evil business, so I don’t quite know what to make of this. All DLL files have timestamps dating back to 2001, so it might be an old Cydoor DLL used to wrap NSIS Media. On the other hand, Opensoft claims to have established on 2001, but I doubt they still use the same DLL files.

The second DLL is far more interesting. It’s built using VB6 and contains an HTML page with the title Advertisment (typo in source) as resource. But there are no references to the C:Program FilesCommon FilesNSIS directory, nsis.jar, HKLMSoftwareNSISMedia or NSIS Media at all. The third DLL, miraculously installed into Common FilesNSIS along with an uninstaller contains no code. It only contains a resource named IID_NSIS which holds an unknown GUID. The uninstaller, as you might have guessed, doesn’t do much. It creates a new value called OptOut in HKLMSoftwareNSISMedia, unregisters the third DLL and finally deletes it along with the uninstaller. It also deletes a shell hook, according to the GUID found in the clsid value under its registry key.

So where does all the evil come from? I started digging in the second DLL, the VB6 DLL, looking for a URL. I found one string that raised my suspicion – @CDOQSAO:=ARB:ACPF:FQE@:QCE@=DSCBFR@. It was stored in Unicode and used in what seemed to be a key function in the code. However, it was not a URL. Notice how the colors repeat themselves and how many characters are in each block they separate. It’s a GUID. The distance between a colon and a hyphen is 13. Subtract 13 from each character and you get 367BDF4B-04E5-46C9-9D83-D68307F659E3. One Google search later and you see you’ve hit the jackpot. That GUID belongs to NSIS Media.

So I have a GUID, but what’s that good for? Lets try decoding the entire file and see if more shows up. That struck oil. In the decoded files, I found URLs, advertisement categories, registry paths, file paths, HTML and even JavaScript. There was also a list what seems to be potential hostile programs including Ewido, Grisoft, NOD32, Norman, Symantec, Panda and even Cydoor. Another list contained wildcards matching common advertisement servers like DoubleClick, probably so their ads can be replaced with NSIS Media ads.

But the most interesting list was the URL list. One URL in particular had most to tell. Its response contained my country code and another URL for a file located on msserv.net, another one of Opensoft’s websites. The name of the website and the content it tries to serve suggests it tries to make users believe it’s non other than Windows Update. Windows Update’s URL, by the way, is also listed in the second DLL. But it’s the file that’s hosted on msserv.com that I enjoyed the most. http://www.msserv.net/src/b3.bin is an installer, better described as an updater, containing two new NSIS Media DLL files. The two DLL files seem to share the same common pattern of the regular NSIS Media DLL files, but appear to be of a newer version, at least by examining the file sizes. Going to the original URL again, you get another installer name. I quickly saw the pattern is [ab][1-9].bin and downloaded them all.

Following is the complete list of NSIS Media’s new version DLL files along with their MD5 sum, for your malware removal needs. They are also available for download, but be careful with those.

04022272675cc56f1e68faa3fa2558b8 avtmskii.dll
0ff0930bb2ff743b212210471c725bc8 odbvgie.dll
15e63b822a0efede397ba9e7c8dbd02f usrwsh.dll
179164804cee71d62cd0f60d8f31735b kbdtdu2.dll
21e5ab0214714983584031e78c763aae wkcajax.dll
2c7b28b24cf717d8204b89a51a43c52d ftsash.dll
2dd9d642eb71eb541f51950c6ae0e5f5 nvritf.dll
2de5a9a086d0878abbd5259fe4f31787 rsvuaac.dll
2e3a6d1f71317faa094f2e7b427bb202 coltea.dll
2e7024c9f3dc91862e1b719d74e9f78f wshpwd32.dll
362b234f82ab4847ea14fcfe0bc07b33 nmmvti.dll
4322dbd9a120b0b6531a6d2c25bcbed3 mtxme2k.dll
5007f06b93defe72ff41c035cbaadc4a kbdrpo.dll
523a7424f94db5be34b33aecd2db32c5 nvredd.dll
59ecae29bdcccae85e8aff5718e55f2f dmubsi.dll
5aa56093a1e568c11a38264be0f4db7a wmiv3p.dll
5b850d909455d3062422f199c44445f2 mspksp2.dll
5fcbef5a137ee8ce3f5f615cb2e2d743 msjmme.dll
661f98df2ed0d7ba9997322248f01f46 ir4axb.dll
854b515f539f125fe4c9f4cdb01277f0 usrflx32.dll
8b4169f654be67be6f874a721c3919da avwmdm.dll
a27e788246ebb3fb59173594d314fd33 dsaoms.dll
a59bc64fb9f97934d20bccdbf346bce4 mswbst.dll
a8a1bb4bf6a67df2a2a24791b0605703 dspvfx.dll
a94db9a1ed0cfe9d807bec7407bef85a cfgsle.dll
aecc2a0fc2e9efa22f979f93ad3b5820 ieaean.dll
b1bbd68d3472ae8bb242f7fa6de00f76 ncxpri.dll
bd9cd45321c46cb7565553a1869ba19a wpdccmo.dll
c2e811707d1898d00a897802bea144ee atmkmsa.dll
c57b55771515280a8e93fabfea00928d adsusv32.dll
cac34a21c3957f118cff2fc4f43b555d lochsh32.dll
da4987053dc52f7ee9b1e70c62f7daa0 actsdr.dll
db69afb5e34af7aba15c2984bd582a31 mfctsa.dll
dd6ec5013c437ac0e86d17ab66e37854 audes2e.dll
e4b4747e461d39695722d07154dbdbb2 swpxa52u.dll
f3ee10c331a81188385e47e851ae3079 minsv32.dll

So what have we learned today?

  1. NSIS Media and Opensoft are pure evil.
  2. Cydoor might still be up to no good.
  3. kichik still doesn’t make 1000$ a day 😦

5 thoughts on “Mr. Angry Pants

  1. Ha Ha.
    You think people don’t want advertisement on their computer?! of course they do people need useless information any where they can get it!

    If you had no useless information to get rid of
    than you couldn’t decide what is useful.

    Btw

    Did you have to remove everything NSIS Media installed manually or do anti malware program’s pick it up automatically?

  2. I had to remove it manually. It wasn’t too hard due my prior research and all of the online reports. Anti-malware programs are slowly picking up more and more parts of it, but when I had to remove it, those I use picked up nothing.

  3. […] December 9th, 2006 by kichik I just found another list of DLL files used by NSIS Media. The script used in their updated installers first removes the old DLL files. It renames them to temporary names and deletes all of their registry keys. Along with the previous list, I believe this makes a complete list of all DLL files used by NSIS Media. bsdeff32.dll java52e.dll krnsvr32.dll mkdesk32.dll mkdesk32.dll mscron32.dll msidext.dll msrvdrv.dll msscsi.dll mssvide.dll msxmlu.dll mtxcdru.dll netstrap42.dll nvrssid.dll odbcpc32.dll oleac32.dll olescope.dll uuiedes.dll windexserv.dll winsdev.dll winsdrv.dll wmbmd.dll wmddsb.dll wmdmb32.dll wmidext.dll wmproxt.dll wmsql32.dll wmudrv.dll ~fdgar.tmp ~fdgdr.tmp ~fdger.tmp ~fdgfr.tmp ~fdgir.tmp ~fdgor.tmp ~fdgpr.tmp ~fdgqr.tmp ~fdgrr.tmp ~fdgsr.tmp ~fdgtr.tmp ~fdgur.tmp ~fdgwr.tmp ~fdgyr.tmp ~isdat.tmp ~isddt.tmp ~isdet.tmp ~isdft.tmp ~isdit.tmp ~isdot.tmp ~isdpt.tmp ~isdqt.tmp ~isdrt.tmp ~isdst.tmp ~isdtt.tmp ~isdut.tmp ~isdwt.tmp ~isdyt.tmp […]

  4. By deleting all the files and registry entires. But that’s done automatically by my NSIS Media Remover. See the Downloads page.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s