1. /
  2. Security Response/
  3. Adware.Topantispyware

Adware.Topantispyware

Updated:
February 13, 2007 11:42:45 AM
Type:
Adware
Risk Impact:
High
File Names:
srpcsrv32.dll runsrv32.dll txfdb32.dll r.exe hookdump.exe
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

Once executed, Adware.Topantispyware performs the following actions:

  1. Downloads a file from the iqsearch.cc domain and executes it.

  2. May copy itself as one of the following:

    • %Windir%\System32\spoolsrv32.exe.
    • %System%\hookdump.exe

      Notes:
    • %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
    • %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

  3. May add the values:

    "Svr32 spool service" = "%Windir%\System32\spoolsrv32.exe"
    "Srv32 spool service" = "%Windir%\System32\runsrv32.exe"


    to the registry subkeys:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

    so that the adware runs every time Windows starts.

  4. May add the value:

    "Intel system tool" = "%System%\hookdump.exe"

    to the registry subkey:

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

    so that the adware runs every time Windows starts.

  5. May add the value:

    "Pattern" =  ""

    to the registry subkey:

    HKEY_CURRENT_USER\Control Panel\Desktop

  6. May add the value:

    "com.ms.applet.enable.install" = "true"

    to the registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Java VM\System Properties

  7. May create the following files:

    • %Windir%\System32\srpcsrv32.dll
    • %Windir%\System32\runsrv32.dll
    • %Windir%\System32\txfdb32.dll
    • %Windir%\Web\desktop.html
    • %Windir%\screen.html
    • %SystemDrive%\r.exe
    • %Windir%\System32\spoolsrv32.exe
    • %Windir%\System32\runsrv32.exe

      Note: %SystemDrive% is a variable that refers to the drive on which Windows is installed. By default, this is drive C.

  8. Creates the registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\AntivirusGold

  9. Modifies values in the registry subkey:

    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1

    so that the desktop wallpaper is changed.

  10. Sets %Windir%\Web\desktop.html as the desktop wallpaper.



    Desktop Wallpaper contains the following text:

    Warning! You're in danger.


Summary| Technical Details| Removal

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report
Symantec DeepSight Screensaver