CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

Donation/Premium
spacer
Donations. Become Premium Today! Premium Icon
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
spacer spacer
 Forum FAQForum FAQ   SearchSearch   UsergroupsUsergroups   ProfileProfile   Login to check your private messagesLogin to check your private messages   LoginLogin   Your Favorite ForumsSelect FavForums 

Windows ServeAd

 
Post new topic   This topic is locked you cannot edit posts or make replies       All -> FavForums -> Startup Programs [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
Daemon

Security Expert
Microsoft MVP

Joined: Jan 22, 2004
Posts: 2520
Location: UK
MVP Premium Security Experts

PostPosted: Sun Dec 19, 2004 9:05 am    Post subject: Windows ServeAd
Reply with quote

O4 - HKLM\..\Run: [Windows ServeAd] C:\Program Files\Windows ServeAd\WinServAd.exe

Contains links to windupdates.com. Will be detected as not-a-virus:AdWare.WinAD.f by Kaspersky in the next extended bases update.

Sample available.
Back to top
View users profile Send private message
TonyKlein

Site Moderator
Microsoft MVP

Joined: Oct 15, 2002
Posts: 13120
Location: Netherlands
MIRT Moderators MVP Premium Security Experts

PostPosted: Sun Dec 19, 2004 9:39 am    Post subject:
Reply with quote

Thanks, in fact I just saw the topic, and already added it 5 minutes ago... Wink

They seem to be going for variety now...

(4671)WindUpdates X WinUpdt.exe BlazeFind "Windupdates" targeted advertizing
(4729)Windows SyncroAd X SyncroAd.exe BlazeFind "Windupdates" targeted advertizing
(5134)WindUpdates X (path to trojan) Added as a result of the AGENT.BF VIRUS!
(5976)Windows AdTools X WinAdTools.exe Windupdates adware variant
(6126)Windows AdControl X WinAdCtl.exe Windupdates adware variant
(6211)Windows TaskAd X Wintaskad.exe Windupdates adware variant
(6507)Windows AdService X WinAdServ.exe Windupdates adware variant
(6526)Windows ControlAd X WinCtlAd.exe Windupdates adware variant
(6603)Windows ServeAd X WinServAd.exe Windupdates adware variant


_________________
Tony image CLSID List
Back to top
View users profile Send private message
askSergey

Cadet
Cadet


Joined: Dec 21, 2004
Posts: 1
Location: USA
PostPosted: Tue Dec 21, 2004 3:53 pm    Post subject: Sample wanted
Reply with quote

Hey there!
Is there a way I can get a sample of this program? I'm looking for a cure on this for someone else and it makes more sence for me to "get infected" to find the real cure Shocked

Sergey
Back to top
View users profile Send private message
Display posts from previous:   
Post new topic   This topic is locked you cannot edit posts or make replies       All -> FavForums -> Startup Programs All times are GMT
Page 1 of 1

 
 You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
2002-2008 © Computer Cops LLC dba CastleCops®. All rights reserved.
Acceptable Use Policy. Use signifies your agreement.
164ppm 0.178s (0.037s)
Making cybercriminals unhappy since 2002*
In Memory of Trpm
spacer spacer