Adware.Winpup

Updated: February 13, 2007 11:34:15 AM

Type: Adware

Risk Impact: High

File Names: Winpup.exe,Winpup32.exe,pup.exe

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Adware.Winpup is executed, it performs the following actions:

Copies itself as one or more of the following files:

%System%\[Random file name].exe
%System%\Winpup.exe
%System%\Winpup32.exe

Note: %System% is a variable. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
Adds the value:

"[Random file name]"="%System%\[Random file name].exe

to the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Generates large amounts of pop-up advertisements.
May also download an executable file from the Web, which may be an update of itself.

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}