ADW_SKPLUS
Windows 2000, Windows XP, Windows Server 2003
Threat Type: Adware
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
227,040 bytes
EXE
27 Apr 2011
Arrival Details
This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Other System Modifications
This adware adds the following registry keys:
HKEY_CURRENT_USER\Software\skplus
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Ext\
Settings\{GUID}
It adds the following registry entries:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Ext\
Settings\{GUID}
Flags = "075c0001"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Ext\
Settings\{GUID}
Version = "*"
It adds the following registry entries as part of its installation routine:
HKEY_CURRENT_USER\Software\skplus
run = "{installation date}"
Other Details
This adware connects to the following possibly malicious URL:
- xml.{BLOCKED}s.kr
- inno.{BLOCKED}s.co.kr