Once executed, Adware.SP2Update performs the following actions:
- Copies itself to %Windir%\sp2update.exe.
Note: %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
- Adds the value:
"sp2update" = "%Windir%\sp2update.exe"
to the registry subkey:
so that it runs every time Windows starts.
- Monitors keywords entered into Internet Explorer windows and URLs visited. This information is then sent to the remote server [http://]www.sp2msupdateresearch.com/[REMOVED]
- Downloads and displays advertisements from [http://]www.bannersandpopups.com/[REMOVED]