What is this?

C

contender

Guest
#1
Ive only seen this lately... Kerio has been detecting it when I run IE.

c:\WINDOWS\system32\mostat.exe

What is mostat?
 

SPeedY_B

I may actually be insane.
#2
Description

An IE browser helper object that detects visits to known sites and redirects them through a third-party server in order to take the affiliate fees. WurldMedia even steals the fees from other webmasters when you use their own links.
Variants

WurldMedia/bpboh: first variant released with early Preview Releases. You have this variant if there is a file called "bpboh.dll" in your Windows directory. Presumbly the name should have been 'bpbho' (Buyers' Port Browser Helper Object), but someone made a typo. There will also be a 'rdxrNNNN.de' file containing an encoded target list. (NNNN is some numbers, looks like a date.)

WurldMedia/mbho: installs 'mbho.dll' and the 'rdxr' data file in the System directory instead of the Windows directory. Installer is not so stealthy and includes an option to prompt the user before redirecting a merchant site. However, if "enable" (the default option) is chosen on any of these prompts, it will be silent again forever.

WurldMedia/MSCStat: in this variant you get an 'MSCStat.exe' system tray program in the System directory, with an 'msc(numbers).de' file and 'ad(numbers).de.xml' as well as the files from the mbho variant. WurldMedia/MSCStat2: the MSCStat.exe file is renamed MSCStat2, and there is finally an entry in Add/Remove Programs, which disables the software (though it leaves behind the files and some registry entries).

WurldMedia/MShop, WurldMedia/MPohs and WurldMedia/MDef have new IDs and filenames: m030106shop.dll, m030206pohs.dll and mdefshop.dll, respectively.

WurldMedia/Mo and WurldMedia/Moaa. The BHO is renamed mo030414s.dll or moaa030425s.dll and has new ID; the mscstat process is renamed mostat.exe and there is a configuration program called moconfig.exe.

WurldMedia/TChk is bundled with the Mo and Moaa variants. It checks for the existance of the WurldMedia BHO, and, if it finds it missing, contacts its controlling server xnef.com. At the time of writing this server is not responding, but it is suspected that if it were working it would direct TChk to reinstall the software. WurldMedia/TChk tries to escape detection by using a completely random filename and ID.
Also known as

Morpheus Shopping Club, WURLD Shopping Community, BuyersPort.
Distribution

Bundled with Morpheus.
What it does
Advertising

No.
Privacy violation

Yes. WurldMedia will be informed of visits to any of their targeted sites with referring site information and user-tracking through a unique ID built into the software.
Security issues

Yes, for MSCStat and later. These versions can connect to its controlling servers when IE is first run to download a new version of themselves, allowing arbitrary code to be executed.
Stability problems

The redirect mechanism used by this software breaks the web browser's 'back' button in some variants.
Removal

Later variants of WurldMedia add a "Shopping Community" entry to the Control Panel's Add/Remove Programs option, which should remove the software. (Though it will try quite hard to persuade you not to.)

Spybot S&D can detect and remove variants up to WurldMedia/MDef. Ad-Aware can detect and remove variants up to WurldMedia/MShop.
Manual removal
TChk variant

If you have WurldMedia/TChk, you must remove it before trying to remove any other variant you have. To do this you will have to open the registry (click 'Start', choose 'Run', enter 'regedit') and open the key HKEY_CLASSES_ROOT\Tchk.TChkBHO\CLSID. On the right, the '(Default)' value should hold a class ID, a long string of hexadecimal digits in groups separated with dashes. Note down this ID then delete the entire Tchk.TChkBHO key, as well as Tchk.TChkBHO.1.

Open the key HKEY_CLASSES_ROOT\CLSID and find the subkey with the same name as the class ID you noted. Click the 'InprocServer32' subkey and note down the filename given in the '(Default)' entry. Then delete the key with the class ID for its name. Also delete the entry of the same name from the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects.

When you next restart the machine, you should be able to delete the file with the name you noted down.
Other variants

Before you can delete the DLL, you will need to deregister it. Open a DOS command prompt window (from Start->Programs->Accessories) and enter (for the bpboh variant):

cd "%WinDir%\System"
regsvr32 /u ..\bpboh.dll

Or, for Mbho, MSCStat or MSCStat2 variants:

cd "%WinDir%\System"
regsvr32 /u mbho.dll

Or, for the MShop variant:

cd "%WinDir%\System"
regsvr32 /u m030106shop.dll

Or, for the MPohs variant:

cd "%WinDir%\System"
regsvr32 /u m030206pohs.dll

Or, for the MDef variant:

cd "%WinDir%\System"
regsvr32 /u mdefshop.dll

Or, for the Mo variant:

cd "%WinDir%\System"
regsvr32 /u mo030414s.dll

Or, for the Moaa variant:

cd "%WinDir%\System"
regsvr32 /u moaa030425s.dll

After restarting the computer, you should be able to delete the DLL from the System folder (inside the Windows folder, called 'System32' under Windows NT/2000/XP or 'System' under Windows 95/98/Me). In the Bpboh variant it is in the Windows folder instead.

In the Bpboh, Mbho, MSCStat and MSCStat2 variants, you can also delete the 'rdxrNNNNNN' file in the same directory (the extension will be '.dat' for the bpboh variant, or '.de' for the other variants; NNNNNN is a date-like six-digit number).

If you have the MSCStat variant you should delete 'MSCStat.exe', 'adNNNNNN.de.xml' and 'mscNNNNNN.de'. If you have MSCStat2 or later variants, you can remove 'MSCStat2.exe'.

In you have Mo or Moaa variants, you should delete 'mostat.exe', 'moconfig.exe' and 'moz02NNNNNN.de'.

Finally, there is also a key called 'morp' (Mo, Moaa variants) or 'rdxr' (older variants) in the registry key HKEY_LOCAL_MACHINE\Software in the registry which you can delete to clean up if you like.
From > http://www.doxdesk.com/parasite/WurldMedia.html
 

SPeedY_B

I may actually be insane.
#6
Yup, either follow the manual removal instructions or get one of these apps ..
"Spybot S&D can detect and remove variants up to WurldMedia/MDef. Ad-Aware can detect and remove variants up to WurldMedia/MShop."
 

Members online

No members online now.

Latest profile posts

Perris Calderon wrote on Electronic Punk's profile.
Ep, glad to see you come back and tidy up...did want to ask a one day favor, I want to enhance my resume , was hoping you could make me administrator for a day, if so, take me right off since I won't be here to do anything, and don't know the slightest about the board, but it would be nice putting "served administrator osnn", if can do, THANKS

Been running around Quora lately, luv it there https://tinyurl.com/ycpxl
Electronic Punk wrote on Perris Calderon's profile.
All good still mate?
Hello, is there anybody in there? Just nod if you can hear me ...
Xie
What a long strange trip it's been. =)

Forum statistics

Threads
61,974
Messages
673,307
Members
89,016
Latest member
Poseeut