My Bitdefender
  • 0 Shopping Cart

SHARE
THIS ON

Facebook Twitter Google Plus

Adware.ZAS

MEDIUM
LOW
approx 39000 bytes

Symptoms

Presence of one of the following popups:

 

“Your Antivirus protection is LOW! Click to install TrustedAntivirus. Complete protection for user pc against malicious viruses, worms and Trojan horses. Repairs infected files Package includes firewall, antispyware and anti-popup protection.”

“Your system has errors! Use System Error Fixer to fix it, delete unnecessary files, prevent data loss, and keep hard drive neat. Click to install”

“Adult and forbidden materials found on your PC! Install PC Privacy Tool. This program deletes every sign of prohibited materials. It eliminates every implicating file on user PC and protects user privacy.”

“Your protection level is LOW! Install SpyGuardPro! this utility detects and removes adware, spyware and Trojans. It also protects your system in real-time mode and prevents online intrusions”

“Warning! Your security level is low.Your computer might be infected. You could suffer data loss, erratic PC behavior, PC freezes and crashes!. Click to install AntiSpywareControl to scan your PC”

“Warning! Porn material found on your PC. Your computer has tracks of all adult sites you had visited! It can violate your privacy and could compromise your career and your marriage. Click to install AdvancedCleaner to remove illegal materials.”


Removal instructions:

Please let BitDefender disinfect your files.

Analyzed By

Mihai Razvan Benchea, virus researcher

Technical Description:

When executed, the program registers a class (“REMINDER”), copies itself to the startup folder and modifies the following registry values:

    hKLM\software\Microsoft\Windows\Current Version\Policies\System\EnableLUA: 0

    hKLM\software\Microsoft\Windows\Current Version\Policies\System\ConsentPromptBehaviorAdminn: 0

    HKCU\Software\Microsoft\Windows\Current Version\Explorer\Advanced\EnableBallonTips: 1

Creates the following values:

    HKCU\Software\Microsoft\Windows\current version\Run\WinHost Management: %system%\winchost.exe

   HKLM\System\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%system%\winchost.exe : *Enabled:Winchost

HKLM\System\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\winchost.exe :

*Enabled:Winchost

After that it start two timers: one that initially activates at 60 seconds and one that will activate at 3 hours

The second timer just resets the first one to 60 seconds and displays a Message Box with the text interval.

The activation period for the first timer varies from 60 second to 900 seconds

When the first timer activates, the adware will display one of the following messages to the user :

“Your Antivirus protection is LOW! Click to install TrustedAntivirus. Complete protection for user pc against malicious viruses, worms and Trojan horses. Repairs infected files Package includes firewall, antispyware and anti-popup protection.”

“Your system has errors! Use System Error Fixer to fix it, delete unnecessary files, prevent data loss, and keep hard drive neat. Click to install”

“Adult and forbidden materials found on your PC! Install PC Privacy Tool. This program deletes every sign of prohibited materials. It eliminates every implicating file on user PC and protects user privacy.”

“Your protection level is LOW! Install SpyGuardPro! this utility detects and removes adware, spyware and Trojans. It also protects your system in real-time mode and prevents online intrusions”

“Warning! Your security level is low.Your computer might be infected. You could suffer data loss, erratic PC behavior, PC freezes and crashes!. Click to install AntiSpywareControl to scan your PC”

“Warning! Porn material found on your PC. Your computer has tracks of all adult sites you had visited! It can violate your privacy and could compromise your career and your marriage. Click to install AdvancedCleaner to remove illegal materials.”

It also tries to open and close the CD-Rom door and download a highly spread virus(Trojan.Zlob). When the user clicks the message the adware will download and install a rogoue program that will from one of the links listed below:

http://go[hidden].com/MTg4Nzk=/2/5536/baloon/

http://clean. [hidden]/MTg2NTk=/2/5536/baloon/

http://privacy.pcpr[hidden]/MTg1NDM=/2/5536/baloon/

http://protect.spy[hidden]/MTk5MTk=/2/5536/baloon/

http://protect.antispywa[hidden]/MzI0NA==/2/412/ed=1/ex=1/baloon/

http://protect.advance[hidden]m/MjYyNg==/2/412/ed=1/ex=1/baloon/

http://go[hidden]/MTk4Njg=/2/5536/ax=1/ed=1/ex=1/baloonexit/

http://clean.systemer[hidden]/MTgyMDY=/2/5536/ed=1/ex=1/h=10/baloonexit/

http://privacy.pcpri[hidden]/MTgwMDg=/2/5536/ed=1/ex=1/h=10/baloonexit/

http://protect.spy[hidden]/MTg1NDI=/2/5536/ax=1/ed=1/ex=1/baloonexit/

http://protect.anti[hidden]/MjM3MQ==/2/412/ed=1/ex=1/baloonexit/

http://protect.advanced[hidden]/MjM2OQ==/2/412/ed=1/ex=1/baloonexit/

http://red[hidden]/download/redcodec4230.exe

http://89.188. [hidden]/dwn.php?file=wmvcodec2.03&type=e&aid=200412&v=v7&e=1