McAfee > Theat Center > PUP Detail Page

Characteristics

This is a not a trojan or virus.  It is a potentially unwanted program that displays adult content advertising based on the websites visited by the infected user.
When run, it copies itself into the windows system directory and %ProgramFiles% directory.
c:\ \comsoft\dialers\wild4_jp : wild4_jp.exe
C:\ : Wild4_jp-uninstall.exe

It adds a shortcut to the Desktop, Start Menu, and tray.

The following registry values are also added to run the application at startup and uninstall:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Wild4_jp
 = c:<\program files>\comsoft\dialers\wild4_jp\wild4_jp.exe /noconnect

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Wild4_jp\UninstallString
 = C:\ \Wild4_jp-uninstall.exe /uninstall

Modifies internet browser settings:

HKEY_CLASSES_ROOT\.jpnd\(Default) = jpnd File
HKEY_CLASSES_ROOT\.jpnd\Content Type = application/x-jpnd
HKEY_CLASSES_ROOT\jpnd File\(Default) = jpnd Data
HKEY_CLASSES_ROOT\jpnd File\EditFlags = 00 00 01 00
HKEY_CLASSES_ROOT\mime\database\
content = type\application/x-jpnd\Extension.jpnd
HKEY_CLASSES_ROOT\jpnd File\shell\open\command\
(Default) = c:\<\program files>\comsoft\dialers\wild4_jp\wild4_jp.exe %1

HKEY_USERS\.default\software\netscape\netscape navigator\viewers\application/x-jpnd
 = c:\<\program files>\comsoft\dialers\wild4_jp\wild4_jp.exe %1
HKEY_USERS\.default\software\netscape\netscape navigator\viewers\TYPE28 = application/x-jpnd
HKEY_USERS\.default\software\netscape\netscape navigator\user trusted external applications\c:\<\program files>\comsoft\dialers\wild4_jp\wild4_jp.exe = yes
HKEY_USERS\.default\software\netscape\netscape navigator\suffixes\application/x-jpnd = jpnd

Removal

Instructions on Enabling/Disabling Detection and Removal of Potentially Unwanted Programs

Aliases

Aliases

• TROJ_WILDJP