Adware.ArcadeWeb

[cosik_ktosik]

Symantec ostrzega przed szkodnikiem Adware.ArcadeWeb co wyświetla w okienku reklamy gier.


Program ten tworzy pliki:

Kod: Zaznacz cały

    * %UserProfile%\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@arcadeweb.com\Chrome\awtextlinks.jar
    * %UserProfile%\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@arcadeweb.com\chrome.manifest
    * %UserProfile%\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@arcadeweb.com\components\arcadewebfirefox.dll
    * %UserProfile%\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@arcadeweb.com\components\arcadewebfirefox.xpt
    * %UserProfile%\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@arcadeweb.com\components\arcadewebfirefox2.dll
    * %UserProfile%\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@arcadeweb.com\install.rdf
    * %UserProfile%\Application Data\Mozilla\Firefox\Profiles\bcfh5tat.default\extensions\textlinks@arcadeweb.com\Chrome\awtextlinks.jar
    * %UserProfile%\Application Data\Mozilla\Firefox\Profiles\bcfh5tat.default\extensions\textlinks@arcadeweb.com\chrome.manifest
    * %UserProfile%\Application Data\Mozilla\Firefox\Profiles\bcfh5tat.default\extensions\textlinks@arcadeweb.com\components\arcadewebfirefox.dll
    * %UserProfile%\Application Data\Mozilla\Firefox\Profiles\bcfh5tat.default\extensions\textlinks@arcadeweb.com\components\arcadewebfirefox.xpt
    * %UserProfile%\Application Data\Mozilla\Firefox\Profiles\bcfh5tat.default\extensions\textlinks@arcadeweb.com\components\arcadewebfirefox2.dll
    * %UserProfile%\Application Data\Mozilla\Firefox\Profiles\bcfh5tat.default\extensions\textlinks@arcadeweb.com\install.rdf
    * %UserProfile%\My Documents\My Pictures\arcade_web_screen1.bmp
    * %UserProfile%\My Documents\My Pictures\arcade_web_screen2.bmp
    * %UserProfile%\My Documents\My Pictures\arcade_web_screen3.bmp
    * %UserProfile%\Recent\arcade_web_screen1.bmp.lnk
    * %UserProfile%\Recent\arcade_web_screen2.bmp.lnk
    * %UserProfile%\Recent\arcade_web_screen3.bmp.lnk
    * %UserProfile%\Recent\My Pictures.lnk
    * %ProgramFiles%\ArcadeWeb\arcadeweb32.dll
    * %ProgramFiles%\ArcadeWeb\awun.exe

Dodaje się do autostartu systemu:

Kod: Zaznacz cały

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"AW TrayIcon" = "RunDll32.exe "C:\Program Files\ArcadeWeb\arcadeweb32.dll", RunTrayIcon"

A następnie dodaje w rejestrze:

Kod: Zaznacz cały

    * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ExplorerPlugin.DLL\"AppID" = "{94C3E25B-C973-4A17-B80D-207BD978DB23}"
    * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ExplorerPlugin.Extension\CurVer\"" = "ExplorerPlugin.Extension.1"
    * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ExplorerPlugin.Extension\CLSID\"" = "{78919608-B066-4B5A-B248-38E12A783E05}"
    * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ExplorerPlugin.Extension\"" = "ArcadeWeb Class"
    * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ExplorerPlugin.Extension.1\CLSID\"" = "{78919608-B066-4B5A-B248-38E12A783E05}"
    * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ExplorerPlugin.Extension.1\"" = "ArcadeWeb Class"
    * HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78919608-B066-4B5A-B248-38E12A783E05}\Arcadeweb\"NoExplorer" = "1"
    * HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Arcadeweb\"DisplayName" = "ArcadeWeb"
    * HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Arcadeweb\"UninstallString" = "%ProgramFiles%\ArcadeWeb\awun.exe"
    * HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Arcadeweb\"DisplayIcon" = "%ProgramFiles%\ArcadeWeb\awun.exe"

    * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{94C3E25B-C973-4A17-B80D-207BD978DB23}
    * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{78919608-B066-4B5A-B248-38E12A783E05}
    * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5F280841-8023-4BE6-9A4F-184D3E79A785}
    * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B69460A1-2DBB-4980-8F30-44231D69AEFA}
    * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A670E878-A272-443D-BD19-ED0A9BFD3FD8}\1.0

Działa w ten sposób, że w przeglądarce podczas serfowania znajduje na stronach słowa kluczowe, po czym podświetla je aby stały się linkiem. Po najechaniu pokazuje się reklama: