1. Symantec/
  2. Security Response/
  3. Adware.Eziin


February 13, 2007 11:46:34 AM
Risk Impact:
File Names:
ezionup.exe clienttimer.exe system_ct.exe system_tp.exe
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

When Adware.Eziin is installed, it performs the following actions:

  1. Creates the following files:

    • %System%\clienttimer.exe
    • %System%\libmySQL.dll
    • %System%\PopClient.exe
    • %System%\system_ct.exe
    • %System%\system_pp.exe
    • %System%\system_tp.exe

      Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

  2. Creates the following registry keys:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\ezion

  3. Adds the values:

    "Hwp" = "%System%\system_wc.exe"
    "WIN32WN" = "%System%\system_wc.exe"
    "WIN32io" = "%System%\clienttimer.exe"
    "WIN32DS" = "%System%\clienttimer.exe"  

    to the registry subkey:


    so that the risk runs every time Windows starts.

  4. Adds the value:

    "Recever_Security" = "eziin.com"

    to the registry subkey:

    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security

  5. Modifies the value:

    "Start Page" = "eziin.com"

    in the registry subkey:

    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

    so that the default Internet Explorer home page changes to "eziin.com".

Summary| Technical Details| Removal

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
2016 Internet Security Threat Report, Volume 21
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube