1. /
  2. Security Response/
  3. Adware.NeededWare

Adware.NeededWare

Updated:
February 13, 2007 11:39:10 AM
Type:
Adware
Publisher:
NeededWare.com
Risk Impact:
Medium
File Names:
Random
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Adware.NeedWare is installed, it performs the following actions:
  1. Creates the following copy of itself:

    %System%/[Random filename].exe

  2. Adds the value:
    "[Random filename]"="[Random filename].exe"

    to the registry key:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

    so that the adware is run every time Windows starts.

  3. Adds the values:

    "ID"="[Random CLSID]"
    "LastAdShownDate"="[Initially blank]"
    "LastAppInstalled"="[Initially blank]"
    "LastUpdateCheck"="[Initially blank]"
    "Version"="[Adware version number]"

    to the registry key:

    HKEY_LOCAL_MACHINE\Software\wserv\

    These registry keys are used to track the activities of the adware, and their values are passed back to the adware server, www.neededware.com.

  4. Makes a HTTP query back to the adware server for ads to display and updates to download.
    The adware may also download other software.


Summary| Technical Details| Removal

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report
Symantec DeepSight Screensaver