Adware.Topantispyware

Printer Friendly Page

Updated: February 13, 2007 11:42:45 AM

Type: Adware

Risk Impact: High

File Names: srpcsrv32.dll runsrv32.dll txfdb32.dll r.exe hookdump.exe

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

Once executed, Adware.Topantispyware performs the following actions:

Downloads a file from the iqsearch.cc domain and executes it.
May copy itself as one of the following:
- %Windir%\System32\spoolsrv32.exe.
- %System%\hookdump.exe
  
  Notes:
- %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
- %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
May add the values:

"Svr32 spool service" = "%Windir%\System32\spoolsrv32.exe" "Srv32 spool service" = "%Windir%\System32\runsrv32.exe"

to the registry subkeys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceso that the adware runs every time Windows starts.
May add the value:

"Intel system tool" = "%System%\hookdump.exe"

to the registry subkey:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

so that the adware runs every time Windows starts.
May add the value:

"Pattern" = ""

to the registry subkey:

HKEY_CURRENT_USER\Control Panel\Desktop
May add the value:

"com.ms.applet.enable.install" = "true"

to the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Java VM\System Properties
May create the following files:
- %Windir%\System32\srpcsrv32.dll
- %Windir%\System32\runsrv32.dll
- %Windir%\System32\txfdb32.dll
- %Windir%\Web\desktop.html
- %Windir%\screen.html
- %SystemDrive%\r.exe
- %Windir%\System32\spoolsrv32.exe
- %Windir%\System32\runsrv32.exe
  
  Note: %SystemDrive% is a variable that refers to the drive on which Windows is installed. By default, this is drive C.
Creates the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\AntivirusGold
Modifies values in the registry subkey:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1

so that the desktop wallpaper is changed.
Sets %Windir%\Web\desktop.html as the desktop wallpaper.

Desktop Wallpaper contains the following text:

Warning! You're in danger.

Removal

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}