Updated: May 23, 2007 4:03:43 PM
Type: Adware
Risk Impact: Medium
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
When the program executes, it creates the following files:
- %System%\hjvyqd.dll
- %System%\wtzlank.dll
Next, it creates the following registry entry so that it executes whenever Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"wtzlank.dll" = "%System%\rundll32.exe %System%\wtzlank.dll,qttwuwc"
It also creates the following registry subkeys:
HKEY_ALL_USERS\Software\AdwareDisableKey3
HKEY_LOCAL_MACHINE\SOFTWARE\AdwareDisableKey3
HKEY_CLASSES_ROOT\CLSID\{4C73246C-B917-D8FD-CF5B-025CDD411BE8}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4C73246C-B917-D8FD-CF5B-025CDD411BE8}
The program then periodically displays advertisements on the computer.
Technorati
Digg
Delicious
Reddit
StumbleUpon
Facebook
Yahoo
Twitter
Faves
Newsvine
