Content

Adware-StarAE.dr

Type
Program
SubType
Dropper
Discovery Date
07/22/2005
Minimum DAT
4541 (07/22/2005)
Updated DAT
4653 (12/19/2005)
Minimum Engine
5.1.00
Description Added
07/22/2005
Description Modified
01/10/2006 10:52 PM (PT)

Tab Navigation

Characteristics

McAfee(R) AVERT™ recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application. If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software. Please contact the software vendor for further information.

See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.

Summary:

This is not a virus or Trojan. It is a direct adware marketing application. Upon execution this application install itself as a browser helper object (BHO) for the internet explorer. It adds URLs to the favorites menu.

Privacy :

EULA is displayed on installation.

Installation:

File name: NJEXPL.EXE
MD5Hash: e3ece51be3674af30eaafa8cfd09f433

On executing the application some of the registry keys which get added are:

  • HKEY_CURRENT_USER\Software\NJStar
  • HKEY_CURRENT_USER\Software\NJStar\NJStar Asian Explorer
  • HKEY_CLASSES_ROOT\CLSID\
    {1E1B2879-30C7-11d4-8DDF-525400E483E3}
  • HKEY_CLASSES_ROOT\IETop100.SiteStatistics
  • HKEY_CLASSES_ROOT\IETop100.SiteStatistics.1
  • HKEY_CLASSES_ROOT\Interface\
    {1E1B2878-30C7-11D4-8DDF-525400E483E3}
  • HKEY_CLASSES_ROOT\TypeLib\
    {1E1B286C-30C7-11D4-8DDF-525400E483E3}  
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
    CurrentVersion\Explorer\Browser Helper Objects\
    {1E1B2879-30C7-11d4-8DDF-525400E483E3}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
    CurrentVersion\Uninstall\NJStar Asian Explorer

Following folders gets added:

  • c:\Documents and Settings\ <Usersname>\Favorites\! Grab News !
  • c:\Documents and Settings\ <Usersname>\Favorites\! Grab News !\1. China
  • c:\Documents and Settings\ <Usersname>\ Favorites
    \! Grab News !\2. Hong Kong
  • c:\Documents and Settings\ <Usersname>\ Favorites
    \! Grab News !\3. Taiwan
  • c:\Documents and Settings\ <Usersname>\ Favorites
    \! Grab News !\4. Global
  • c:\Documents and Settings\ <Usersname>\ Favorites
    \! Grab News !\5. Finance
  • c:\Documents and Settings\ <Usersname>\Favorites
    \! Grab News !\6. Entertainment
  • c:\Documents and Settings\ <Usersname>\\Favorites
    \! Grab News !\7. Sports
  • c:\Documents and Settings\ <Usersname>\Favorites
    \! Grab News !\8. it
  • c:\Program Files\NJStar Asian Explorer

Aliases

Aliases

  • Kaspersky: Trojan-Downloader.Win32.Agent.au