Adware.7000n

Updated: February 13, 2007 11:43:06 AM

Type: Adware

Publisher: 7000n.com

Risk Impact: Medium

File Names: %system%\twain_16.dll

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

Adware.7000n is distributed as an executable file. When Adware.7000n is executed, it will perform the following actions:

Creates the following file:

%System%\twain_16.dll

Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
Adds the following registry keys:

HKEY_CLASSES_ROOT\Twain_16.iebho.1 HKEY_CLASSES_ROOT\Twain_16.iebho HKEY_CLASSES_ROOT\CLSID\{AE21A223-C4CA-43D7-9764-4FC6DF529F4D} HKEY_CLASSES_ROOT\TypeLib\{F05FC250-632C-424C-83D8-64640B6BED21} HKEY_CLASSES_ROOT\Interface\{6F9D44B8-E418-49C1-885C-1015DDDBFFC4}so that Adware.7000n is registered.
Adds the value:

"(Default)" = "ie assist"

to the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE21A223-C4CA-43D7-9764-4FC6DF529F4D}so that the Adware.7000n is executed every time Internet Explorer is started.
Redirects Internet Explorer to www.7000n.com, a portal site in China, regardless of the Home page setting of Internet Explorer.

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}