Authors: YAG KOHHA (email@example.com), Lame
Title: Backdoor in RelevantKnowledge adware (What are we fighting for?)
Vendor: TMRG, Inc.
RelevantKnowledge is an adware distributed with different shareware
projects, e.g. Artisian Burner.
RelevantKnowledge was found to contain backdoor proxy component
rlvknlg.exe (Marketscore OSSProxy), which is configured to allow
incoming network connections on TCP/8254, probably acts as open proxy
and also performs keylogging and monitoring for active windows content.
Component can not be disabled by user.
Details (by YAG KOHHA, Lame):
Recently I download freeware CD burner software to create some absolutely legal copies
from ISO image. Of cause where is adware in installer which promise to "boost your
internet Connection" and "free coupons".
After I finished my works I uninstall burner and adware via add/remove programs and reboot
the computer. After reboot I check Windows Firewall rules. In exception tab I found
RelevantKnowledge application. I map'ed my host and found strange HTTP server on port 8254
which answers as OSSProxy. I check netstat and found that this port used by
%windir%\system32\rlvknlg.exe process which also referred in
Software\Mircosoft\Windows\CurrentVersion\Run\ key. I check this file and found that this
programs hooks keyboard, mouse, current window and post info to the
http://www.relevantknowledge.com/upgraderesult.aspx site via locally installed proxy. I
check this site and found that "privacy procedures are regularly audited and certified by
the nationally-recognized firm, Ernst & Young, who assure that we conform with the
international trust services and privacy principles developed and managed by the American
Institute of Certified Public Accountants"
So guys, may be I miss something. If I see software which doesn't get removed via Add/Remove
Programs, breaks my firewall settings, hook my keyboard and mouse, and has remote
management capabilities, I call it Remote Access Trojan. What should I do to be "conform
with the international trust Services" and Ernst & Young say: "This is good code, Joe,
well done!" when I write new all-in-one client for my botnet? Or this is part of anti
piracy program? And MPAA want to know which films I burn on DVD? Or this is Uncle Sam's
hand? I don't understand.
YAG KOHHA, Lame
File with binary and disassembly can be found here:
Archive password is "backdoor".