1. /
  2. Security Response/
  3. Adware.Ulubione

Adware.Ulubione

Updated:
February 13, 2007 11:43:09 AM
Type:
Adware
Risk Impact:
High
File Names:
sys[4 random characters].exe
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Adware.Ulubione is executed, it performs the following actions:
  1. Copies itself to %System%\sys[4 random characters].exe.

    Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

  2. Adds the value:

    "Ulubione" = "%system%\sys[4 random characters].exe"

    to the registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

    so that the adware runs every time Windows starts.

  3. Adds the values:

    "Start Page" = "www.maxxhosters.com/search.php"
    "Use FormSuggest" = "yes"

    to the registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main

    so that the adware redirects Internet Explorer start page.

  4. Adds the value:

    "Ask User" = "0"

    to the registry subkey:

    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms

  5. Modifies the value:

    "3" = "0"

    in the registry subkey:

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones

    to change Internet Explorer security settings.

  6. Adds a URL named Quick Search - The Search You Trust.url to the Internet Explorer Favorites of the currently logged on user.


Summary| Technical Details| Removal

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report
Symantec DeepSight Screensaver