Once executed, Adware.Tbon performs the following actions:
- Creates the following files:
- %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
- %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
- Creates the following registry subkeys:
- Adds the value:
"tbon" = "[PATH TO ADWARE] /r"
to the registry subkey:
so that it runs every time the user logs in.
- Monitors URLs visited in Web browsers and sends the information to a Web site on the btgrab.com domain.
- Displays advertisements based on the URLs visited.