jaycee
2005-10-25, 14:09
First, sorry for the cross post, I just realized that there was a dedicated forum for this ...
--------------------
Hi,
Here is a new adware, that is not yet detected by spybot...
A guess it's from xxx.ad-w-a-r-e.com
it runs in randomly time, the following path
"C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE" hxxx://wxx.ad-w-a-r-e.com/cgi-bin/PopupV3?ID={9364E9EC-BFF4-77E5-47C9-BE1559C316B5}&type=normal&mSkip=1&rnd=20448
which opens a popup with such url : hxxp://www.searc-h.com/normal/yyy53.html
Creates randomly file in windows\system32
(currently: dnwave.dll, kt0ml7d11.dll, lvp4097qe.dll, h2l2lc3o1f.dll...)
Size about 234.751 to 235.858
Add a registry entry in winlogin with (NetCache or Shell) as key and one of the dll as value.
- When I try to delete it (registry entry), it's back in 1 or 2 sec.
- When I add the ad-w-a-r-e.com to hosts file, entry in file is deleted after 1 or 2 sec.
- Safe mode doesn't work, still loaded.
- regmon/filemon from systinternals don't work anymore since that crap is installed.
- Last SBot update doesn't detect it... (although it discover tsr something that has been installed in the same time as this ad-w-a-r-e...).
Any help would be welcome...
Thanks,
Jean-Christophe
Urls disabled
--------------------
Hi,
Here is a new adware, that is not yet detected by spybot...
A guess it's from xxx.ad-w-a-r-e.com
it runs in randomly time, the following path
"C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE" hxxx://wxx.ad-w-a-r-e.com/cgi-bin/PopupV3?ID={9364E9EC-BFF4-77E5-47C9-BE1559C316B5}&type=normal&mSkip=1&rnd=20448
which opens a popup with such url : hxxp://www.searc-h.com/normal/yyy53.html
Creates randomly file in windows\system32
(currently: dnwave.dll, kt0ml7d11.dll, lvp4097qe.dll, h2l2lc3o1f.dll...)
Size about 234.751 to 235.858
Add a registry entry in winlogin with (NetCache or Shell) as key and one of the dll as value.
- When I try to delete it (registry entry), it's back in 1 or 2 sec.
- When I add the ad-w-a-r-e.com to hosts file, entry in file is deleted after 1 or 2 sec.
- Safe mode doesn't work, still loaded.
- regmon/filemon from systinternals don't work anymore since that crap is installed.
- Last SBot update doesn't detect it... (although it discover tsr something that has been installed in the same time as this ad-w-a-r-e...).
Any help would be welcome...
Thanks,
Jean-Christophe
Urls disabled