1. /
  2. Security Response/
  3. Adware.Webmisc

Adware.Webmisc

Updated:
February 13, 2007 11:47:08 AM
Type:
Adware
Risk Impact:
Medium
File Names:
webmisc.dll
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Adware.Webmisc is executed, it performs the following actions:
  1. Creates the following files

    • %System%\INSTALL.LOG
    • %Windir%\system\UNWISE.EXE
    • %Windir%\system\UNWISE.INI
    • %System%\UnregAssist.exe
    • %System%\WebMisc.dat
    • %System%\WebMisc.dll

      Note:
    • %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
    • %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

  2. Creates the following registry subkeys:

    HKEY_CLASSES_ROOT\CLSID\{3CD4296F-6CC3-11D9-B888-000C299AA719}
    HKEY_CLASSES_ROOT\Interface\{15B7D7D7-6E14-4743-8E8E-68ED98BA64EA}
    HKEY_CLASSES_ROOT\TypeLib\{DC16901C-964F-447E-9AC5-4B323CFB2214}
    HKEY_CLASSES_ROOT\WebMisc.WebMiscItem
    HKEY_CLASSES_ROOT\WebMisc.WebMiscItem.1
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CD4296F-6CC3-11D9-B888-000C299AA719}
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZDA Plug-in
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext
    \Stats\{3CD4296F-6CC3-11D9-B888-000C299AA719}

  3. Monitors Internet Explorer and displays advertisements when specific URLs are visited. These URLs are stored in the file webmisc.dat


Summary| Technical Details| Removal

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report