ADW_CYCLONGEMS
RDN/Generic PUP.x!bzj. (McAfee); Trojan.Gen (Symantec); Trojan.Win32.Generic!BT (Sunbelt)
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
Type de grayware:
Adware
Destructif:
Non
Chiffrement:
In the wild::
Oui
Overview
Détails techniques
Andere Systemänderungen
Fügt die folgenden Registrierungsschlüssel hinzu:
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\System
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Validation
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CC
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\DomainList
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Extra1
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\TriggerDomainList
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\TriggerExprList
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CurrentPackage\Urls\
Pending
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CurrentPackage\Urls\
Done
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CurrentPackage\Campaigns\
Pending
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CurrentPackage\Campaigns\
Done
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CommandListContainer
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\FailureControl
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\VersionNames
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Agent
Fügt die folgenden Registrierungseinträge hinzu:
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\System
RqT = "493e"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\System
ShHd = "0"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\System
CnQs = "0"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\System
MdQs = "1f4"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Validation
13 = "a9afef2451a946b401d0f0bd01cb94c1"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CC
dtj = "a"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CC
gdd = "1"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CC
lad = "{random values}"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CC
da = "1"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CC
dd = "1"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CC
cd = "1"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Validation
15 = "03df7559fbe5978608473d15021abce5"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Extra1
CheckBrowserWaitTime1 = "1388"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Extra1
CheckBrowserWaitTime2 = "271"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Extra1
RemoveAccents = "0"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Extra1
TimeToEventWaitTime = "36ee8"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Extra1
FullContext = "1"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Extra1
UseTriggers = "3"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Validation
14 = "d4fa55b34866359ebb794b2163b545c8"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
NotifOnWeb = "1"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
WebNotifHash = "&sn=4"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
ShowNotif = "1"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
FormWidth = "1e"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
FormHeight = "32"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
BackColor = "E5E4EB"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
FormBottomPadding = "5"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
FormRightPadding = "5"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
Title = "Publicidad ofrecida por Cyclon"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
TitleSize = "c"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
TitleColor = "302F2E"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
TitleLeftPadding = "a"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
TitleTopPadding = "14"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
MessageSize = "8"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
MessageColor = "302F2E"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
MessageLeftPadding = "8"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
MessageTopPadding = "8"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
ShowCloseButton = "1"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
ShowQuestionButton = "1"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
QuestionButtonURL = "http://www.{BLOCKED}-media.com"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
ShowOptionsButton = "0"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
ShowGrip = "0"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
CallDelay = "bb8"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
FormDelay = "753"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
AniInterval = "0"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
AniDuration = "0"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
ShowImage = "1"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
ImageLeftPadding = "8"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
ImageTopPadding = "12"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
Scroll = "0"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Validation
16 = "0286dc3f2ff05f60eb74a3dd090715fa"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
PingInterval = "0"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
LastPingLocalTime = "{random values}"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
BrowserDetectMode = "URL"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
UrlOperationMode = "Include"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
KeywordsPath = "http://{BLOCKED}tizer.net/as/ext/GetClasifiedCampaign"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
AllowedCampaigns = "0"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
IntervalTime = "384"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
WaitBrowser = "1"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
Report = "0"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
UseFlyBrowser = "0"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
WordsLock = "f"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Validation
2 = "2f336fae991a4948e5761d060ffd1a3e"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CurrentPackage
RemainTime = "0"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CurrentPackage
RemainFromLocalTime = "{random values}"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Validation
4 = "e75d41390273ac58efb17ef04edc1c2c"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Agent
WantedProcess = "Install"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Agent
AllowVersions = "ffffffff"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Agent
RunVersion = "0"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Agent
Host = "markettizer.net"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Agent
AgentVersion = "2250"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Validation
1 = "1bf6ae612250b14a1959a921906ead19"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CC
da = "0"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Validation
15 = "1622d2653aec0f31560cfc0088b02994"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\System
CnQs = "1"
HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Validation
13 = "95eb4090ba62c6cecf33497d31b0af1a"
Solutions
Step 1
Für Windows ME und XP Benutzer: Stellen Sie vor einer Suche sicher, dass die Systemwiederherstellung deaktiviert ist, damit der gesamte Computer durchsucht werden kann.
Step 2
Diesen Registrierungsschlüssel löschen
Wichtig: Eine nicht ordnungsgemäße Bearbeitung der Windows Registrierung kann zu einer dauerhaften Fehlfunktion des Systems führen. Führen Sie diesen Schritt nur durch, wenn Sie mit der Vorgehensweise vertraut sind oder wenn Sie Ihren Systemadministrator um Unterstützung bitten können. Lesen Sie ansonsten zuerst diesen Microsoft Artikel, bevor Sie die Registrierung Ihres Computers ändern.
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod
- System
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod
- Validation
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod
- CC
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- DomainList
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- Extra1
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- Notifications
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- TriggerDomainList
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- TriggerExprList
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CurrentPackage\Urls
- Pending
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CurrentPackage\Urls
- Done
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CurrentPackage\Campaigns
- Pending
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CurrentPackage\Campaigns
- Done
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod
- CommandListContainer
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod
- FailureControl
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod
- VersionNames
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod
- Agent
Step 3
Diesen Registrierungswert löschen
Wichtig: Eine nicht ordnungsgemäße Bearbeitung der Windows Registrierung kann zu einer dauerhaften Fehlfunktion des Systems führen. Führen Sie diesen Schritt nur durch, wenn Sie mit der Vorgehensweise vertraut sind oder wenn Sie Ihren Systemadministrator um Unterstützung bitten können. Lesen Sie ansonsten zuerst diesen Microsoft Artikel, bevor Sie die Registrierung Ihres Computers ändern.
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\System
- RqT = "493e"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\System
- ShHd = "0"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\System
- CnQs = "0"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\System
- MdQs = "1f4"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Validation
- 13 = "a9afef2451a946b401d0f0bd01cb94c1"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CC
- dtj = "a"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CC
- gdd = "1"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CC
- lad = "{random values}"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CC
- da = "1"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CC
- dd = "1"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CC
- cd = "1"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Validation
- 15 = "03df7559fbe5978608473d15021abce5"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Extra1
- CheckBrowserWaitTime1 = "1388"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Extra1
- CheckBrowserWaitTime2 = "271"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Extra1
- RemoveAccents = "0"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Extra1
- TimeToEventWaitTime = "36ee8"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Extra1
- FullContext = "1"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Extra1
- UseTriggers = "3"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Validation
- 14 = "d4fa55b34866359ebb794b2163b545c8"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- NotifOnWeb = "1"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- WebNotifHash = "&sn=4"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- ShowNotif = "1"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- FormWidth = "1e"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- FormHeight = "32"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- BackColor = "E5E4EB"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- FormBottomPadding = "5"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- FormRightPadding = "5"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- Title = "Publicidad ofrecida por Cyclon"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- TitleSize = "c"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- TitleColor = "302F2E"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- TitleLeftPadding = "a"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- TitleTopPadding = "14"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- MessageSize = "8"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- MessageColor = "302F2E"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- MessageLeftPadding = "8"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- MessageTopPadding = "8"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- ShowCloseButton = "1"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- ShowQuestionButton = "1"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- QuestionButtonURL = "http://www.{BLOCKED}-media.com"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- ShowOptionsButton = "0"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- ShowGrip = "0"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- CallDelay = "bb8"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- FormDelay = "753"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- AniInterval = "0"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- AniDuration = "0"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- ShowImage = "1"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- ImageLeftPadding = "8"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- ImageTopPadding = "12"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- Scroll = "0"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Validation
- 16 = "0286dc3f2ff05f60eb74a3dd090715fa"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- PingInterval = "0"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- LastPingLocalTime = "{random values}"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- BrowserDetectMode = "URL"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- UrlOperationMode = "Include"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- KeywordsPath = "http://{BLOCKED}tizer.net/as/ext/GetClasifiedCampaign"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- AllowedCampaigns = "0"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- IntervalTime = "384"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- WaitBrowser = "1"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- Report = "0"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- UseFlyBrowser = "0"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- WordsLock = "f"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Validation
- 2 = "2f336fae991a4948e5761d060ffd1a3e"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CurrentPackage
- RemainTime = "0"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CurrentPackage
- RemainFromLocalTime = "{random values}"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Validation
- 4 = "e75d41390273ac58efb17ef04edc1c2c"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Agent
- WantedProcess = "Install"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Agent
- AllowVersions = "ffffffff"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Agent
- RunVersion = "0"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Agent
- Host = "markettizer.net"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Agent
- AgentVersion = "2250"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Validation
- 1 = "1bf6ae612250b14a1959a921906ead19"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CC
- da = "0"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Validation
- 15 = "1622d2653aec0f31560cfc0088b02994"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\System
- CnQs = "1"
- In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Validation
- 13 = "95eb4090ba62c6cecf33497d31b0af1a"
Step 4
Durchsuchen Sie Ihren Computer mit Ihrem Trend Micro Produkt, und löschen Sie Dateien, die als ADW_CYCLONGEMS entdeckt werden. Falls die entdeckten Dateien bereits von Ihrem Trend Micro Produkt gesäubert, gelöscht oder in Quarantäne verschoben wurden, sind keine weiteren Schritte erforderlich. Dateien in Quarantäne können einfach gelöscht werden. Auf dieser Knowledge-Base-Seite finden Sie weitere Informationen.
Participez à notre enquête!