ADW_CYCLONGEMS

Publish Date: 14 luglio 2014

RDN/Generic PUP.x!bzj. (McAfee); Trojan.Gen (Symantec); Trojan.Win32.Generic!BT (Sunbelt)

Piattaforma:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

Valutazione del rischio complessivo:

Reported Infection:

Sistema di Impatto: :

Informazioni esposizione: :

Basso

Medio

Alto

Critico

Tipo di minaccia informatica:
Adware
Distruttivo?:
No
Crittografato?:
In the wild::
Sì

Panoramica e descrizione

Dettagli tecnici

Dimensione file: 656,384 bytes

Tipo di file: EXE

Residente in memoria: No

Data di ricezione campioni iniziali: 14 luglio 2014

Otras modificaciones del sistema

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\System

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Validation

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CC

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\DomainList

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Extra1

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\TriggerDomainList

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\TriggerExprList

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CurrentPackage\Urls\
Pending

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CurrentPackage\Urls\
Done

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CurrentPackage\Campaigns\
Pending

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CurrentPackage\Campaigns\
Done

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CommandListContainer

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\FailureControl

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\VersionNames

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Agent

Agrega las siguientes entradas de registro:

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\System
RqT = "493e"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\System
ShHd = "0"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\System
CnQs = "0"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\System
MdQs = "1f4"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Validation
13 = "a9afef2451a946b401d0f0bd01cb94c1"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CC
dtj = "a"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CC
gdd = "1"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CC
lad = "{random values}"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CC
da = "1"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CC
dd = "1"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CC
cd = "1"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Validation
15 = "03df7559fbe5978608473d15021abce5"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Extra1
CheckBrowserWaitTime1 = "1388"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Extra1
CheckBrowserWaitTime2 = "271"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Extra1
RemoveAccents = "0"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Extra1
TimeToEventWaitTime = "36ee8"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Extra1
FullContext = "1"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Extra1
UseTriggers = "3"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Validation
14 = "d4fa55b34866359ebb794b2163b545c8"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
NotifOnWeb = "1"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
WebNotifHash = "&sn=4"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
ShowNotif = "1"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
FormWidth = "1e"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
FormHeight = "32"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
BackColor = "E5E4EB"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
FormBottomPadding = "5"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
FormRightPadding = "5"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
Title = "Publicidad ofrecida por Cyclon"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
TitleSize = "c"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
TitleColor = "302F2E"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
TitleLeftPadding = "a"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
TitleTopPadding = "14"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
MessageSize = "8"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
MessageColor = "302F2E"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
MessageLeftPadding = "8"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
MessageTopPadding = "8"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
ShowCloseButton = "1"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
ShowQuestionButton = "1"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
QuestionButtonURL = "http://www.{BLOCKED}-media.com"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
ShowOptionsButton = "0"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
ShowGrip = "0"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
CallDelay = "bb8"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
FormDelay = "753"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
AniInterval = "0"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
AniDuration = "0"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
ShowImage = "1"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
ImageLeftPadding = "8"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
ImageTopPadding = "12"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer\Notifications
Scroll = "0"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Validation
16 = "0286dc3f2ff05f60eb74a3dd090715fa"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
PingInterval = "0"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
LastPingLocalTime = "{random values}"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
BrowserDetectMode = "URL"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
UrlOperationMode = "Include"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
KeywordsPath = "http://{BLOCKED}tizer.net/as/ext/GetClasifiedCampaign"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
AllowedCampaigns = "0"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
IntervalTime = "384"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
WaitBrowser = "1"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
Report = "0"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
UseFlyBrowser = "0"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\AdServer
WordsLock = "f"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Validation
2 = "2f336fae991a4948e5761d060ffd1a3e"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CurrentPackage
RemainTime = "0"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CurrentPackage
RemainFromLocalTime = "{random values}"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Validation
4 = "e75d41390273ac58efb17ef04edc1c2c"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Agent
WantedProcess = "Install"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Agent
AllowVersions = "ffffffff"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Agent
RunVersion = "0"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Agent
Host = "markettizer.net"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Agent
AgentVersion = "2250"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Validation
1 = "1bf6ae612250b14a1959a921906ead19"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\CC
da = "0"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Validation
15 = "1622d2653aec0f31560cfc0088b02994"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\System
CnQs = "1"

HKEY_CURRENT_USER\Software\Context2pro\
context2prod\Validation
13 = "95eb4090ba62c6cecf33497d31b0af1a"

Soluzioni

Motore di scansione minimo: 9.700

Step 1

Los usuarios de Windows ME y XP, antes de llevar a cabo cualquier exploración, deben comprobar que tienen desactivada la opción Restaurar sistema para permitir la exploración completa del equipo.

Step 2

Eliminar esta clave del Registro

[ learnMore ]

Importante: si modifica el Registro de Windows incorrectamente, podría hacer que el sistema funcione mal de manera irreversible. Lleve a cabo este paso solo si sabe cómo hacerlo o si puede contar con ayuda de su administrador del sistema. De lo contrario, lea este artículo de Microsoft antes de modificar el Registro del equipo.

In HKEY_CURRENT_USER\Software\Context2pro\context2prod
- System

In HKEY_CURRENT_USER\Software\Context2pro\context2prod
- Validation

In HKEY_CURRENT_USER\Software\Context2pro\context2prod
- CC

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- DomainList

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- Extra1

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- Notifications

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- TriggerDomainList

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- TriggerExprList

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CurrentPackage\Urls
- Pending

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CurrentPackage\Urls
- Done

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CurrentPackage\Campaigns
- Pending

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CurrentPackage\Campaigns
- Done

In HKEY_CURRENT_USER\Software\Context2pro\context2prod
- CommandListContainer

In HKEY_CURRENT_USER\Software\Context2pro\context2prod
- FailureControl

In HKEY_CURRENT_USER\Software\Context2pro\context2prod
- VersionNames

In HKEY_CURRENT_USER\Software\Context2pro\context2prod
- Agent

Step 3

Eliminar este valor del Registro

[ learnMore ]

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\System
- RqT = "493e"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\System
- ShHd = "0"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\System
- CnQs = "0"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\System
- MdQs = "1f4"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Validation
- 13 = "a9afef2451a946b401d0f0bd01cb94c1"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CC
- dtj = "a"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CC
- gdd = "1"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CC
- lad = "{random values}"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CC
- da = "1"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CC
- dd = "1"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CC
- cd = "1"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Validation
- 15 = "03df7559fbe5978608473d15021abce5"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Extra1
- CheckBrowserWaitTime1 = "1388"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Extra1
- CheckBrowserWaitTime2 = "271"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Extra1
- RemoveAccents = "0"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Extra1
- TimeToEventWaitTime = "36ee8"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Extra1
- FullContext = "1"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Extra1
- UseTriggers = "3"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Validation
- 14 = "d4fa55b34866359ebb794b2163b545c8"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- NotifOnWeb = "1"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- WebNotifHash = "&sn=4"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- ShowNotif = "1"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- FormWidth = "1e"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- FormHeight = "32"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- BackColor = "E5E4EB"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- FormBottomPadding = "5"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- FormRightPadding = "5"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- Title = "Publicidad ofrecida por Cyclon"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- TitleSize = "c"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- TitleColor = "302F2E"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- TitleLeftPadding = "a"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- TitleTopPadding = "14"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- MessageSize = "8"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- MessageColor = "302F2E"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- MessageLeftPadding = "8"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- MessageTopPadding = "8"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- ShowCloseButton = "1"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- ShowQuestionButton = "1"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- QuestionButtonURL = "http://www.{BLOCKED}-media.com"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- ShowOptionsButton = "0"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- ShowGrip = "0"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- CallDelay = "bb8"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- FormDelay = "753"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- AniInterval = "0"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- AniDuration = "0"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- ShowImage = "1"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- ImageLeftPadding = "8"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- ImageTopPadding = "12"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer\Notifications
- Scroll = "0"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Validation
- 16 = "0286dc3f2ff05f60eb74a3dd090715fa"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- PingInterval = "0"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- LastPingLocalTime = "{random values}"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- BrowserDetectMode = "URL"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- UrlOperationMode = "Include"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- KeywordsPath = "http://{BLOCKED}tizer.net/as/ext/GetClasifiedCampaign"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- AllowedCampaigns = "0"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- IntervalTime = "384"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- WaitBrowser = "1"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- Report = "0"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- UseFlyBrowser = "0"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\AdServer
- WordsLock = "f"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Validation
- 2 = "2f336fae991a4948e5761d060ffd1a3e"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CurrentPackage
- RemainTime = "0"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CurrentPackage
- RemainFromLocalTime = "{random values}"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Validation
- 4 = "e75d41390273ac58efb17ef04edc1c2c"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Agent
- WantedProcess = "Install"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Agent
- AllowVersions = "ffffffff"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Agent
- RunVersion = "0"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Agent
- Host = "markettizer.net"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Agent
- AgentVersion = "2250"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Validation
- 1 = "1bf6ae612250b14a1959a921906ead19"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\CC
- da = "0"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Validation
- 15 = "1622d2653aec0f31560cfc0088b02994"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\System
- CnQs = "1"

In HKEY_CURRENT_USER\Software\Context2pro\context2prod\Validation
- 13 = "95eb4090ba62c6cecf33497d31b0af1a"

Para eliminar el valor del Registro que este malware/grayware/spyware ha creado:

Abra el Editor del Registro. Haga clic en Inicio>Ejecutar, escriba REGEDIT y, a continuación, pulse Intro.
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>Context2pro>context2prod>System
En el panel derecho, busque y elimine la entrada:
RqT = "493e"
En el panel derecho, busque y elimine la entrada:
ShHd = "0"
En el panel derecho, busque y elimine la entrada:
CnQs = "0"
En el panel derecho, busque y elimine la entrada:
MdQs = "1f4"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>Context2pro>context2prod>Validation
En el panel derecho, busque y elimine la entrada:
13 = "a9afef2451a946b401d0f0bd01cb94c1"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>Context2pro>context2prod>CC
En el panel derecho, busque y elimine la entrada:
dtj = "a"
En el panel derecho, busque y elimine la entrada:
gdd = "1"
En el panel derecho, busque y elimine la entrada:
lad = "{random values}"
En el panel derecho, busque y elimine la entrada:
da = "1"
En el panel derecho, busque y elimine la entrada:
dd = "1"
En el panel derecho, busque y elimine la entrada:
cd = "1"
En el panel derecho, busque y elimine la entrada:
15 = "03df7559fbe5978608473d15021abce5"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>Context2pro>context2prod>AdServer>Extra1
En el panel derecho, busque y elimine la entrada:
CheckBrowserWaitTime1 = "1388"
En el panel derecho, busque y elimine la entrada:
CheckBrowserWaitTime2 = "271"
En el panel derecho, busque y elimine la entrada:
RemoveAccents = "0"
En el panel derecho, busque y elimine la entrada:
TimeToEventWaitTime = "36ee8"
En el panel derecho, busque y elimine la entrada:
FullContext = "1"
En el panel derecho, busque y elimine la entrada:
UseTriggers = "3"
En el panel derecho, busque y elimine la entrada:
14 = "d4fa55b34866359ebb794b2163b545c8"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>Context2pro>context2prod>AdServer>Notifications
En el panel derecho, busque y elimine la entrada:
NotifOnWeb = "1"
En el panel derecho, busque y elimine la entrada:
WebNotifHash = "&sn
En el panel derecho, busque y elimine la entrada:
ShowNotif = "1"
En el panel derecho, busque y elimine la entrada:
FormWidth = "1e"
En el panel derecho, busque y elimine la entrada:
FormHeight = "32"
En el panel derecho, busque y elimine la entrada:
BackColor = "E5E4EB"
En el panel derecho, busque y elimine la entrada:
FormBottomPadding = "5"
En el panel derecho, busque y elimine la entrada:
FormRightPadding = "5"
En el panel derecho, busque y elimine la entrada:
Title = "Publicidad ofrecida por Cyclon"
En el panel derecho, busque y elimine la entrada:
TitleSize = "c"
En el panel derecho, busque y elimine la entrada:
TitleColor = "302F2E"
En el panel derecho, busque y elimine la entrada:
TitleLeftPadding = "a"
En el panel derecho, busque y elimine la entrada:
TitleTopPadding = "14"
En el panel derecho, busque y elimine la entrada:
MessageSize = "8"
En el panel derecho, busque y elimine la entrada:
MessageColor = "302F2E"
En el panel derecho, busque y elimine la entrada:
MessageLeftPadding = "8"
En el panel derecho, busque y elimine la entrada:
MessageTopPadding = "8"
En el panel derecho, busque y elimine la entrada:
ShowCloseButton = "1"
En el panel derecho, busque y elimine la entrada:
ShowQuestionButton = "1"
En el panel derecho, busque y elimine la entrada:
QuestionButtonURL = "http://www.{BLOCKED}-media.com"
En el panel derecho, busque y elimine la entrada:
ShowOptionsButton = "0"
En el panel derecho, busque y elimine la entrada:
ShowGrip = "0"
En el panel derecho, busque y elimine la entrada:
CallDelay = "bb8"
En el panel derecho, busque y elimine la entrada:
FormDelay = "753"
En el panel derecho, busque y elimine la entrada:
AniInterval = "0"
En el panel derecho, busque y elimine la entrada:
AniDuration = "0"
En el panel derecho, busque y elimine la entrada:
ShowImage = "1"
En el panel derecho, busque y elimine la entrada:
ImageLeftPadding = "8"
En el panel derecho, busque y elimine la entrada:
ImageTopPadding = "12"
En el panel derecho, busque y elimine la entrada:
Scroll = "0"
En el panel derecho, busque y elimine la entrada:
16 = "0286dc3f2ff05f60eb74a3dd090715fa"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>Context2pro>context2prod>AdServer
En el panel derecho, busque y elimine la entrada:
PingInterval = "0"
En el panel derecho, busque y elimine la entrada:
LastPingLocalTime = "{random values}"
En el panel derecho, busque y elimine la entrada:
BrowserDetectMode = "URL"
En el panel derecho, busque y elimine la entrada:
UrlOperationMode = "Include"
En el panel derecho, busque y elimine la entrada:
KeywordsPath = "http://{BLOCKED}tizer.net/as/ext/GetClasifiedCampaign"
En el panel derecho, busque y elimine la entrada:
AllowedCampaigns = "0"
En el panel derecho, busque y elimine la entrada:
IntervalTime = "384"
En el panel derecho, busque y elimine la entrada:
WaitBrowser = "1"
En el panel derecho, busque y elimine la entrada:
Report = "0"
En el panel derecho, busque y elimine la entrada:
UseFlyBrowser = "0"
En el panel derecho, busque y elimine la entrada:
WordsLock = "f"
En el panel derecho, busque y elimine la entrada:
2 = "2f336fae991a4948e5761d060ffd1a3e"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>Context2pro>context2prod>CurrentPackage
En el panel derecho, busque y elimine la entrada:
RemainTime = "0"
En el panel derecho, busque y elimine la entrada:
RemainFromLocalTime = "{random values}"
En el panel derecho, busque y elimine la entrada:
4 = "e75d41390273ac58efb17ef04edc1c2c"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>Context2pro>context2prod>Agent
En el panel derecho, busque y elimine la entrada:
WantedProcess = "Install"
En el panel derecho, busque y elimine la entrada:
AllowVersions = "ffffffff"
En el panel derecho, busque y elimine la entrada:
RunVersion = "0"
En el panel derecho, busque y elimine la entrada:
Host = "markettizer.net"
En el panel derecho, busque y elimine la entrada:
AgentVersion = "2250"
En el panel derecho, busque y elimine la entrada:
1 = "1bf6ae612250b14a1959a921906ead19"
En el panel derecho, busque y elimine la entrada:
da = "0"
En el panel derecho, busque y elimine la entrada:
15 = "1622d2653aec0f31560cfc0088b02994"
En el panel derecho, busque y elimine la entrada:
CnQs = "1"
En el panel derecho, busque y elimine la entrada:
13 = "95eb4090ba62c6cecf33497d31b0af1a"
Cierre el Editor del Registro.

Step 4

Explorar el equipo con su producto de Trend Micro para eliminar los archivos detectados como ADW_CYCLONGEMS En caso de que el producto de Trend Micro ya haya limpiado, eliminado o puesto en cuarentena los archivos detectados, no serán necesarios más pasos. Puede optar simplemente por eliminar los archivos en cuarentena. Consulte esta página de Base de conocimientos para obtener más información.

Sondaggio

ADW_CYCLONGEMS

Panoramica e descrizione

Dettagli tecnici

Soluzioni

Risorse

Assistenza

Informazioni su Trend

ADW_CYCLONGEMS

Panoramica e descrizione

Dettagli tecnici

Soluzioni

Risorse

Assistenza

Informazioni su Trend

America

Medio Oriente e Africa

Europa

Asia e Pacifico