ADW_DOUBLED

Muestra mensajes emergentes con publicidad.

Instalación

Infiltra los archivos siguientes:

• %Program Files%\DoubleD\Desktop Smiley Toolbar\{malware version number}\stb0.dll - also detected as ADW_DOUBLED
• %Program Files%\DoubleD\Desktop Smiley Toolbar\{malware version number}\stbAol.dll - also detected as ADW_DOUBLED
• %Program Files%\DoubleD\Desktop Smiley Toolbar\{malware version number}\stbapp.dll - also detected as ADW_DOUBLED
• %Program Files%\DoubleD\Desktop Smiley Toolbar\{malware version number}\stbapp.exe - also detected as ADW_DOUBLED
• %Program Files%\DoubleD\Desktop Smiley Toolbar\{malware version number}\stbappHelper.exe - also detected as ADW_DOUBLED
• %Program Files%\DoubleD\Desktop Smiley Toolbar\{malware version number}\stbasst.exe - also detected as ADW_DOUBLED
• %Program Files%\DoubleD\Desktop Smiley Toolbar\{malware version number}\stbdl.exe - also detected as ADW_DOUBLED
• %Program Files%\DoubleD\Desktop Smiley Toolbar\{malware version number}\stbIE.dll - also detected as ADW_DOUBLED
• %Program Files%\DoubleD\Desktop Smiley Toolbar\{malware version number}\stbMsn.dll - also detected as ADW_DOUBLED
• %Program Files%\DoubleD\Desktop Smiley Toolbar\{malware version number}\stbOL.dll - also detected as ADW_DOUBLED
• %Program Files%\DoubleD\Desktop Smiley Toolbar\{malware version number}\stbOLEX.dll - also detected as ADW_DOUBLED
• %Program Files%\DoubleD\Desktop Smiley Toolbar\{malware version number}\stbsvc.exe - also detected as ADW_DOUBLED
• %Program Files%\DoubleD\Desktop Smiley Toolbar\{malware version number}\stbYahoo8.dll - also detected as ADW_DOUBLED
• %Program Files%\DoubleD\Desktop Smiley Toolbar\{malware version number}\stbYahoo9.dll - also detected as ADW_DOUBLED

(Nota: %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).

Técnica de inicio automático

Agrega las siguientes entradas de registro para permitir su ejecución automática cada vez que se inicia el sistema:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
SmileyApp = "%Program Files%\DoubleD\Desktop Smiley Toolbar\{malware version number}\stbapp.exe"

Se registra como BHO para garantizar su ejecución automática cada vez que se utilice Internet Explorer mediante la introducción de las siguientes claves de registro:

HKEY_CLASSES_ROOT\CLSID\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}

HKEY_CLASSES_ROOT\Interface\{95B92D92-8B7D-4A19-A3F1-43113B4DBCAF}

HKEY_CLASSES_ROOT\TypeLib\{5297E905-1DFB-4A9C-9871-A4F95FD58945}

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\MenuExt\&Funband Search

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}

Agrega las siguientes entradas de registro para permitir su propia instalación como objeto de ayuda del explorador (BHO):

HKEY_CLASSES_ROOT\CLSID\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\
InprocServer32
(Default) = "%Program Files%\DoubleD\Desktop Smiley Toolbar\{malware version number}\stb0.dll"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\MenuExt\&Funband Search
(Default) = "res://%Program Files%\DoubleD\Desktop Smiley Toolbar\{malware version number}\stb0.dll/MENUSEARCH.HTM"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Internet Explorer\Toolbar
Desktop Smiley Toolbar = "%Program Files%\DoubleD\Desktop Smiley Toolbar\{malware version number}\stb0.dll"

Rutina de adware

Muestra mensajes emergentes con publicidad.