Adware.TopMoxie

Updated: February 13, 2007 11:36:16 AM

Type: Adware

Publisher: Top Moxie Inc

Risk Impact: Medium

File Names: Couponsandoffers.exe Main.class WebSavingsfromEbates.exe

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

The Adware.TopMoxie installer does the following:

Creates one of the following folders:
- %ProgramFiles%\Couponsandoffers
- %Program Files%\WebSavingsFromEbates
  
  Note:
- %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
- Adware.TopMoxie also creates a number of files and subfolders in that folder.
Adds either the value:

"couponsandoffers" = "wjview /cp:p "C:\Program Files\couponsandoffers\ System\Code" Main lp: "C:\Program Files\couponsandoffers"

or

"WebSavingsFromEbates" = "javaw -cp "C:\Program Files\WebSavingsFromEbates\System\Code" main pl: "C:\Program Files\WebSavingsfromEbates"

to the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

so that the risk runs every time Windows starts.
Executes the Main.class module.

Note: The Main.class module will remain memory-resident, monitoring Web usage and displaying advertisements based on keyword matches.
May update itself, by downloading and replacing the original installed software with Adware.MoeMoney

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}