TR/Click.Adpower-3 - Trojan

See also

Full description

Alias:	CLAMAV Trojan.Clicker.Adpower-3
Type:	Trojan
Size:	49.152 bytes
Origin:
Date:	03-29-2005
Damage:
VDF Version:	6.30.00.54
Danger:	Low
Distribution:	Low

General DescriptionAffected Platforms:
* Windows 95
* Windows 98
* Windows ME
* Windows NT
* Windows 2000
* Windows XP
* Windows Server 2003

SymptomsDamage routine
- Creates entries in the Windows Registry

Technical DetailsIf the trojan TR/Click.Adpower.n is executed, it copies the following files:

- <%Sysdir%>\finland_ver10.ocx
- <%Sysdir%>\objsafe.tlb

and creates the following entries in the Windows Registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CL SID\{81B9C506-46D3-4667-9018-3D6575CBC046}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CL SID\{81B9C506-46D3-4667-9018-3D6575CBC046}\Implemented Categories

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CL SID\{81B9C506-46D3-4667-9018-3D6575CBC046}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}
@=""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CL SID\{81B9C506-46D3-4667-9018-3D6575CBC046}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}
@=""

HKEY_CLASSES_ROOT\Licenses
@="Licensing: Copying the keys may be a violation of established copyrights."

HKEY_CLASSES_ROOT\Licenses\4F86BADF-9F 77-11d1-B1B7-0000F8753F5D
@="iplpwpnippopupiivjrioppisjsjlpiiokuj"

HKEY_CLASSES_ROOT\Licenses\CEDD4F80-B4 3C-11cf-837C-00AA00573EDE
@=hex(2):67,00,78,00,77,00,61,00,65,00,7a,00,75,00,63 ,00,66,00,79,00,71,00,70,\
00,77,00,6a,00,67,00,71,00,62,00,63,00,6d,00,74,00,73 ,00,6e,00,63,00,75,00,\
68,00,77,00,73,00,6e,00,79,00,68,00,69,00,6f,00,68,00 ,77,00,78,00,7a,00,00,\
00

HKEY_CLASSES_ROOT\Licenses\ED4B87C4-9F 76-11d1-8BF7-0000F8754DA1
@="knlggnmntgggrninthpgmnngrhqhnnjnslsh"

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back