1. /
  2. Security Response/
  3. Adware.QoolAid

Adware.QoolAid

Updated:
February 13, 2007 11:38:00 AM
Type:
Adware
Publisher:
qoologic.com
Risk Impact:
High
File Names:
wtmp.exe sccmgr.exe [6 RANDOM CHARACTERS].exe [5 RANDOM CHARACTERS].dat [7 RANDOM CHARACTERS].
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Adware.QoolAid is run, it does the following:
  1. Drops the following files:

    • %Temp%\wtmp.exe
    • %System%\sccmgr.exe
    • %System%\[6 RANDOM CHARACTERS].exe
    • %System%\[5 RANDOM CHARACTERS].dat
    • %System%\[7 RANDOM CHARACTERS].dll
    • %System%\[5 RANDOM CHARACTERS].dll
    • %System%\[7 RANDOM CHARACTERS].exe


      Notes:
    • %Temp% is a variable. The adware locates the temporary folder. By default, this is C:\Windows\TEMP (Windows 95/98/Me/XP) or C:\WINNT\Temp (Windows NT/2000).
    • %System% is a variable. The adware locates the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

  2. Add the value:

    "winsync" = "%System%\[6 RANDOM CHARACTERS].exe"

    to the registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

    so that the risk runs every time Windows starts.

  3. Displays advertisements when you are browsing the Internet.


Summary| Technical Details| Removal

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report