Adware.PortalScan

Updated: February 13, 2007 11:35:24 AM

Type: Adware

Risk Impact: High

File Names: mwsvm.exe slmss.exe.

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

When Adware.PortalScan runs, it performs the following actions:

Checks for pop-up killer software packages and disables them.
Adds the value:

"absr" = "[PATH TO FILE NAME]"

to the registry subkey:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

so that the adware runs when Windows starts.
May add the value:

"slmss" = "[PATH TO FILE NAME]"

to the registry subkey:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

so that the adware runs when Windows starts.
May add some of the following registry subkeys:

HKEY_LOCAL_MACHINE%\SOFTWARE\slmss HKEY_LOCAL_MACHINE%\SOFTWARE\absr HKEY_CLASSES_ROOT%\CLSID\{3E7145B1-EA07-42CE-9299-11DF39FF54BD} HKEY_CLASSES_ROOT%\CLSID\{34EF5B1C-52CB-400b-8B7C-F787018B3826} HKEY_CLASSES_ROOT%\Interface\{E9D8697E-BEA9-4170-84F3-509AD2A11951} HKEY_CLASSES_ROOT%\TypeLib\{3CD9D85E-1FF2-4BF7-A113-6669B8D1E676} HKEY_CLASSES_ROOT%\URLLauncher.URLLauncherControl HKEY_CLASSES_ROOT%\URLLauncher.URLLauncherControl.1 HKEY_CLASSES_ROOT%\AdRotator.Application
Uses Microsoft's AdRotator package to survey predefined, legitimate, portal Web sites, and then opens them within pop-up windows.

Notes:
- The software does not drop files and does not install itself.
- Some Backdoor Trojan programs also use the registry key value, "absr." Adware.PortalScan is not a backdoor Trojan, although its download capability is similar.

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}