Adware.Eziin

Updated: February 13, 2007 11:46:34 AM

Type: Adware

Risk Impact: High

File Names: ezionup.exe clienttimer.exe system_ct.exe system_tp.exe

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

When Adware.Eziin is installed, it performs the following actions:

Creates the following files:
- %System%\clienttimer.exe
- %System%\libmySQL.dll
- %System%\PopClient.exe
- %System%\system_ct.exe
- %System%\system_pp.exe
- %System%\system_tp.exe
  
  Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
Creates the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\ezion HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DownloadManager
Adds the values:

"Hwp" = "%System%\system_wc.exe" "WIN32WN" = "%System%\system_wc.exe" "WIN32io" = "%System%\clienttimer.exe" "WIN32DS" = "%System%\clienttimer.exe"
to the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runso that the risk runs every time Windows starts.
Adds the value:

"Recever_Security" = "eziin.com"

to the registry subkey:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security
Modifies the value:

"Start Page" = "eziin.com"

in the registry subkey:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

so that the default Internet Explorer home page changes to "eziin.com".

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}