When Adware.Atlcontrol is installed, it performs the following actions:
- Creates the following files:
- atlcontrole.exe
- atlcontrol.dll
- Downloads a configuration file from the hitkorea.co.kr site. This file contains configuration information for the adware including changing the start page and which specific adserver to use.
- Creates the registry key
HKEY_CURRENT_USER\Software\atlcontrol
where it stores configuration information about the current install.
- May add the value:
"atlcontrol" = "[PATH TO ADWARE]\atlcontrole.exe"
to the registry subkeys
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
so that the risk runs every time Windows starts.
- May redirect search requests and change the Internet Explorer start page depending on the response received in Step 2 above.
