Updated: February 13, 2007 11:39:10 AM
Type: Adware
Publisher: NeededWare.com
Risk Impact: Medium
File Names: Random
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
When Adware.NeedWare is installed, it performs the following actions:
- Creates the following copy of itself:
%System%/[Random filename].exe
- Adds the value:
"[Random filename]"="[Random filename].exe"
to the registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
so that the adware is run every time Windows starts.
- Adds the values:
"ID"="[Random CLSID]"
"LastAdShownDate"="[Initially blank]"
"LastAppInstalled"="[Initially blank]"
"LastUpdateCheck"="[Initially blank]"
"Version"="[Adware version number]"
to the registry key:
HKEY_LOCAL_MACHINE\Software\wserv\
These registry keys are used to track the activities of the adware, and their values are passed back to the adware server, www.neededware.com.
- Makes a HTTP query back to the adware server for ads to display and updates to download.
The adware may also download other software.
Technorati
Digg
Delicious
Reddit
StumbleUpon
Yahoo Buzz
Twitter
Facebook
Newsvine
