1. /
  2. Security Response/
  3. Adware.TopMoxie

Adware.TopMoxie

Updated:
February 13, 2007 11:36:16 AM
Type:
Adware
Publisher:
Top Moxie Inc
Risk Impact:
Medium
File Names:
Couponsandoffers.exe Main.class WebSavingsfromEbates.exe
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP


The Adware.TopMoxie installer does the following:
  1. Creates one of the following folders:
    • %ProgramFiles%\Couponsandoffers
    • %Program Files%\WebSavingsFromEbates

      Note:
    • %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
    • Adware.TopMoxie also creates a number of files and subfolders in that folder.

  2. Adds either the value:

    "couponsandoffers" = "wjview /cp:p "C:\Program Files\couponsandoffers\
    System\Code" Main lp: "C:\Program Files\couponsandoffers"


    or

    "WebSavingsFromEbates" = "javaw -cp "C:\Program Files\WebSavingsFromEbates\System\Code" main pl: "C:\Program Files\WebSavingsfromEbates"

    to the registry key:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

    so that the risk runs every time Windows starts.

  3. Executes the Main.class module.

    Note: The Main.class module will remain memory-resident, monitoring Web usage and displaying advertisements based on keyword matches.

  4. May update itself, by downloading and replacing the original installed software with Adware.MoeMoney


Summary| Technical Details| Removal

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report, Volume 17
Symantec DeepSight Screensaver