When Adware.NeedWare is installed, it performs the following actions:
- Creates the following copy of itself:
%System%/[Random filename].exe
- Adds the value:
"[Random filename]"="[Random filename].exe"
to the registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
so that the adware is run every time Windows starts.
- Adds the values:
"ID"="[Random CLSID]"
"LastAdShownDate"="[Initially blank]"
"LastAppInstalled"="[Initially blank]"
"LastUpdateCheck"="[Initially blank]"
"Version"="[Adware version number]"
to the registry key:
HKEY_LOCAL_MACHINE\Software\wserv\
These registry keys are used to track the activities of the adware, and their values are passed back to the adware server, www.neededware.com.
- Makes a HTTP query back to the adware server for ads to display and updates to download.
The adware may also download other software.
