Adware.TopAV

Updated: February 13, 2007 11:43:35 AM

Type: Adware

Publisher: topantivirus.biz

Risk Impact: High

File Names: svchosts.exe,svchosts.dll

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Adware.TopAV is executed, it performs the following actions:

Creates the file %System%\svchosts.dll

Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
Creates the file %Windir%\Web\desktop.html. This is a .html file that contains the fake virus alert message.

Note: %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
Adds the value:"{3F245C2A-1558-3CCA-04A8-7AA23B60E40F}" = "Reload Browse"to the registry subkey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \SharedTaskScheduler
Adds the value:"Wallpaper" = "%SystemRoot%\Web\desktop.html"to the registry subkey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General
Adds the values:"[default]" = "%System%\svchosts.dll" "ThreadingModel" = "Apartment"to the registry subkey:HKEY_CURRENT_USER\Software\Classes\CLSID \{3F245C2A-1558-3CCA-04A8-7AA23B60E40F}

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}