1. /
  2. Security Response/
  3. Adware.TopAV

Adware.TopAV

Updated:
February 13, 2007 11:43:35 AM
Type:
Adware
Publisher:
topantivirus.biz
Risk Impact:
High
File Names:
svchosts.exe,svchosts.dll
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Adware.TopAV is executed, it performs the following actions:
  1. Creates the file %System%\svchosts.dll

    Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

  2. Creates the file %Windir%\Web\desktop.html. This is a .html file that contains the fake virus alert message.

    Note: %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
  3. Adds the value:

    "{3F245C2A-1558-3CCA-04A8-7AA23B60E40F}" = "Reload Browse"

    to the registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
    \SharedTaskScheduler

  4. Adds the value:

    "Wallpaper" = "%SystemRoot%\Web\desktop.html"

    to the registry subkey:

    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General

  5. Adds the values:

    "[default]" = "%System%\svchosts.dll"
    "ThreadingModel" = "Apartment"

    to the registry subkey:


    HKEY_CURRENT_USER\Software\Classes\CLSID
    \{3F245C2A-1558-3CCA-04A8-7AA23B60E40F}


Summary| Technical Details| Removal

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report
Symantec DeepSight Screensaver