Adware.ClickAlchemy

This Browser Helper Object attempts to download files from predetermined Web sites. The files are adware, although it is possible that malicious programs could also be downloaded. The publisher of the software determines the exact files and locations.

When Adware.ClickAlchemy is installed, it does the following:

1. Accesses a Web site (the URL is configurable) at predetermined intervals.
   
   
2. Downloads information on what URL to access in the next interval.
   
   
3. Downloads executables that have been added or updated since the last download. The configuration file names and cookies associated with the download are all configurable.
   
   
4. Creates the value:
   
   "Alchem" = "Alchem.exe"  
   
   in the registry key:
   
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
   
   so that the software runs when Windows is started.
   
   
5. Creates the following files:
   
   
   • Alchem.inf
   • Alchem.ini

Summary