Content

Generic PUP.x!o!53d187eba6df

Type
Program
SubType
-
Discovery Date
06/25/2009
Length
139152
Minimum DAT
5657 (06/25/2009)
Updated DAT
5657 (06/25/2009)
Minimum Engine
5300.2777
Description Added
06/25/2009
Description Modified
06/25/2009 10:46 AM (PT)
Risk Assessment
Corporate User
Low
Home User
Low

Tab Navigation

Characteristics

This software is not a virus or a Trojan. It is detected as a "potentially unwanted program" (PUP). PUPs are any piece of software that a reasonably security- or privacy-minded computer user may want to be informed of and, in some cases, remove. PUPs are often made by a legitimate corporate entity for some beneficial purpose, but they alter the security state of the computer on which they are installed, or the privacy posture of the user of the system, such that most users will want to be aware of them.

File PropertyProperty Value
FileNamebe689b217effc63c6a1b505e28ecc68d7aaf92db.exe
McAfee ArtemisArtemis!53d187eba6df
McAfee DetectionGeneric PUP.x!o
Length139,152 bytes
CRCE861CA76
MD553D187EBA6DFA6012FB4EE366604DD26
SHA1BE689B217EFFC63C6A1B505E28ECC68D7AAF92DB

Other Common Detection Aliases

Company NameDetection Name
avastWin32:BHO-GG
AVG (GriSoft)Puper.H
AviraDR/BHO.dvi.30
BitDefenderDropped:Application.Generic.37562
clamavAdware.Agent-3842
eSafe (Alladin)Win32.DRBHO.Dvi
Eseta variant of Win32/Adware.Cinmus
FortiNetAdware/AdClicker
Kasperskynot-a-virus:AdWare.Win32.BHO.dvi
microsoftprogram:win32/sogou
normanNetworkWorm.FJI
pandaAdware/WebSearch
risingAdWare.Win32.Cpush.bz
SophosTroj/AdClick-ER
Trend MicroCryp_Naix-6
vba32AdWare.Win32.BHO.dvi
V-BusterAdware.BHO.KCL

Avert® Labs has observed the following system activities:

ActivityRisk Level
Performs a shell execute of downloaded or existing files
Informational
Registers DLLsInformational

Other detections that have been observed.

FileNameMcAfee Supported
%COMMONPROGRAMFILES%\pushware\cpush.dll
AdClicker-BJ
%COMMONPROGRAMFILES%\pushware\uninst.exe
Generic PUP.x

System Changes

These are general defaults for typical path variables. (Although they may differ, these examples are common.):
%WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

The following files were analyzed:

  • %USERPROFILE%\local settings\temp\be689b217effc63c6a1b505e28ecc68d7aaf92db.exe
  • The following files have been added to the system:

  • %COMMONPROGRAMFILES%\pushware
  • %COMMONPROGRAMFILES%\pushware\cpush.dll
  • %COMMONPROGRAMFILES%\pushware\uninst.exe
  • The following registry elements have been created:

  • HKEY_LOCAL_MACHINE\software\classes\clsid\{11f09afd-75ad-4e51-ab43-e09e9351ce16}\
    • (default) = cadlogic object
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{11f09afd-75ad-4e51-ab43-e09e9351ce16}\inprocserver32\
    • (default) = c:\program files\common files\pushware\cpush.dll
    • threadingmodel = apartment
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{11f09afd-75ad-4e51-ab43-e09e9351ce16}\progid\
    • (default) = newzadspopup.bklogc.1
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{11f09afd-75ad-4e51-ab43-e09e9351ce16}\typelib\
    • (default) = {de2267bd-b163-407f-9e8d-6adec771e7ab}
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{11f09afd-75ad-4e51-ab43-e09e9351ce16}\versionindependentprogid\
    • (default) = newzadspopup.bklogc
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{34a12a06-48c0-420d-8f11-73552ee9631a}\
    • (default) = ctoolbardetector object
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{34a12a06-48c0-420d-8f11-73552ee9631a}\inprocserver32\
    • (default) = c:\program files\common files\pushware\cpush.dll
    • threadingmodel = apartment
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{34a12a06-48c0-420d-8f11-73552ee9631a}\progid\
    • (default) = newadpopup.toolbardetector.1
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{34a12a06-48c0-420d-8f11-73552ee9631a}\typelib\
    • (default) = {de2267bd-b163-407f-9e8d-6adec771e7ab}
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{34a12a06-48c0-420d-8f11-73552ee9631a}\versionindependentprogid\
    • (default) = newadpopup.toolbardetector
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{cde9eb54-a08e-4570-b748-13f5ddb5781c}\
    • (default) = cpopupblock object
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{cde9eb54-a08e-4570-b748-13f5ddb5781c}\inprocserver32\
    • (default) = c:\program files\common files\pushware\cpush.dll
    • threadingmodel = apartment
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{cde9eb54-a08e-4570-b748-13f5ddb5781c}\progid\
    • (default) = newdcocomediapop.popcoco.1
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{cde9eb54-a08e-4570-b748-13f5ddb5781c}\typelib\
    • (default) = {de2267bd-b163-407f-9e8d-6adec771e7ab}
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{cde9eb54-a08e-4570-b748-13f5ddb5781c}\versionindependentprogid\
    • (default) = newdcocomediapop.popcoco
  • HKEY_LOCAL_MACHINE\software\classes\interface\{0ad3ab16-6d0e-4f04-8660-fb1f36bc2dc0}\
    • (default) = iadlogic
  • HKEY_LOCAL_MACHINE\software\classes\interface\{0ad3ab16-6d0e-4f04-8660-fb1f36bc2dc0}\proxystubclsid\
    • (default) = {00020424-0000-0000-c000-000000000046}
  • HKEY_LOCAL_MACHINE\software\classes\interface\{0ad3ab16-6d0e-4f04-8660-fb1f36bc2dc0}\proxystubclsid32\
    • (default) = {00020424-0000-0000-c000-000000000046}
  • HKEY_LOCAL_MACHINE\software\classes\interface\{0ad3ab16-6d0e-4f04-8660-fb1f36bc2dc0}\typelib\
    • (default) = {de2267bd-b163-407f-9e8d-6adec771e7ab}
    • version = 3157553
  • HKEY_LOCAL_MACHINE\software\classes\interface\{2f685b36-c53a-4653-9231-1dae5736de45}\
    • (default) = itoolbardetector
  • HKEY_LOCAL_MACHINE\software\classes\interface\{2f685b36-c53a-4653-9231-1dae5736de45}\proxystubclsid\
    • (default) = {00020424-0000-0000-c000-000000000046}
  • HKEY_LOCAL_MACHINE\software\classes\interface\{2f685b36-c53a-4653-9231-1dae5736de45}\proxystubclsid32\
    • (default) = {00020424-0000-0000-c000-000000000046}
  • HKEY_LOCAL_MACHINE\software\classes\interface\{2f685b36-c53a-4653-9231-1dae5736de45}\typelib\
    • (default) = {de2267bd-b163-407f-9e8d-6adec771e7ab}
    • version = 3157553
  • HKEY_LOCAL_MACHINE\software\classes\interface\{50c4cdd9-22d7-49ff-ac6d-7d4d528a3ab2}\
    • (default) = ipopupblock
  • HKEY_LOCAL_MACHINE\software\classes\interface\{50c4cdd9-22d7-49ff-ac6d-7d4d528a3ab2}\proxystubclsid\
    • (default) = {00020424-0000-0000-c000-000000000046}
  • HKEY_LOCAL_MACHINE\software\classes\interface\{50c4cdd9-22d7-49ff-ac6d-7d4d528a3ab2}\proxystubclsid32\
    • (default) = {00020424-0000-0000-c000-000000000046}
  • HKEY_LOCAL_MACHINE\software\classes\interface\{50c4cdd9-22d7-49ff-ac6d-7d4d528a3ab2}\typelib\
    • (default) = {de2267bd-b163-407f-9e8d-6adec771e7ab}
    • version = 3157553
  • HKEY_LOCAL_MACHINE\software\classes\newadpopup.toolbardetector.1\
    • (default) = ctoolbardetector object
  • HKEY_LOCAL_MACHINE\software\classes\newadpopup.toolbardetector.1\clsid\
    • (default) = {34a12a06-48c0-420d-8f11-73552ee9631a}
  • HKEY_LOCAL_MACHINE\software\classes\newadpopup.toolbardetector\
    • (default) = ctoolbardetector object
  • HKEY_LOCAL_MACHINE\software\classes\newadpopup.toolbardetector\clsid\
    • (default) = {34a12a06-48c0-420d-8f11-73552ee9631a}
  • HKEY_LOCAL_MACHINE\software\classes\newadpopup.toolbardetector\curver\
    • (default) = newadpopup.toolbardetector.1
  • HKEY_LOCAL_MACHINE\software\classes\newdcocomediapop.popcoco.1\
    • (default) = cpopupblock object
  • HKEY_LOCAL_MACHINE\software\classes\newdcocomediapop.popcoco.1\clsid\
    • (default) = {cde9eb54-a08e-4570-b748-13f5ddb5781c}
  • HKEY_LOCAL_MACHINE\software\classes\newdcocomediapop.popcoco\
    • (default) = cpopupblock object
  • HKEY_LOCAL_MACHINE\software\classes\newdcocomediapop.popcoco\clsid\
    • (default) = {cde9eb54-a08e-4570-b748-13f5ddb5781c}
  • HKEY_LOCAL_MACHINE\software\classes\newdcocomediapop.popcoco\curver\
    • (default) = newdcocomediapop.popcoco.1
  • HKEY_LOCAL_MACHINE\software\classes\newzadspopup.bklogc.1\
    • (default) = cadlogic object
  • HKEY_LOCAL_MACHINE\software\classes\newzadspopup.bklogc.1\clsid\
    • (default) = {11f09afd-75ad-4e51-ab43-e09e9351ce16}
  • HKEY_LOCAL_MACHINE\software\classes\newzadspopup.bklogc\
    • (default) = cadlogic object
  • HKEY_LOCAL_MACHINE\software\classes\newzadspopup.bklogc\clsid\
    • (default) = {11f09afd-75ad-4e51-ab43-e09e9351ce16}
  • HKEY_LOCAL_MACHINE\software\classes\newzadspopup.bklogc\curver\
    • (default) = newzadspopup.bklogc.1
  • HKEY_LOCAL_MACHINE\software\classes\typelib\{de2267bd-b163-407f-9e8d-6adec771e7ab}\1.0\
    • (default) = newadpopup 1.0 type library
  • HKEY_LOCAL_MACHINE\software\classes\typelib\{de2267bd-b163-407f-9e8d-6adec771e7ab}\1.0\0\win32\
    • (default) = c:\program files\common files\pushware\cpush.dll
  • HKEY_LOCAL_MACHINE\software\classes\typelib\{de2267bd-b163-407f-9e8d-6adec771e7ab}\1.0\flags\
    • (default) = 48
  • HKEY_LOCAL_MACHINE\software\classes\typelib\{de2267bd-b163-407f-9e8d-6adec771e7ab}\1.0\helpdir\
    • (default) = c:\program files\common files\pushware\
  • HKEY_LOCAL_MACHINE\software\cpush\update\
    • ad_version = 1,1,1,1
  • HKEY_LOCAL_MACHINE\software\microplugins\common\
    • param = sid=ad
    • size = 9526
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\currentversion\explorer\browser helper objects\{11f09afd-75ad-4e51-ab43-e09e9351ce16}\
    • (default) = adpopup
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\currentversion\uninstall\contentmatch\
    • displayname = adsense based popad
    • uninstallstring = c:\program files\common files\pushware\uninst.exe
  • Symptoms

    This symptoms of this detection are the files, registry, and network communication referenced in the characteristics section.

    Method of Infection

    This is not a virus or Trojan. PUPs do not "infect" systems. They may be installed by a user individually or possibly as a part of a software package (in a bundle, for example).

    Removal

    AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

    Additional Windows ME/XP removal considerations

    Variants

    Variants

      N/A

    All Information

    Overview -

    McAfee® Avert® Labs recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application. If you agreed to a license agreement for this or another bundled application, you may have legal obligations with regard to removing this software, or to using the host application without this software. Please contact the software vendor for further information.

    See http://vil.nai.com/vil/DATReadme.aspx for a list of program detections added to the DATs.

    See http://vil.nai.com/vil/pups/configuration.aspx for information about how to enable, disable, and exclude the detection of legitimately installed programs.

    This software is not a virus or a Trojan. It is detected as a "potentially unwanted program" (PUP). PUPs are any piece of software that a reasonably security- or privacy-minded computer user may want to be informed of and, in some cases, remove. PUPs are often made by a legitimate corporate entity for some beneficial purpose, but they alter the security state of the computer on which they are installed, or the privacy posture of the user of the system, such that most users will want to be aware of them.

    Characteristics

    Characteristics -

    This software is not a virus or a Trojan. It is detected as a "potentially unwanted program" (PUP). PUPs are any piece of software that a reasonably security- or privacy-minded computer user may want to be informed of and, in some cases, remove. PUPs are often made by a legitimate corporate entity for some beneficial purpose, but they alter the security state of the computer on which they are installed, or the privacy posture of the user of the system, such that most users will want to be aware of them.

    File PropertyProperty Value
    FileNamebe689b217effc63c6a1b505e28ecc68d7aaf92db.exe
    McAfee ArtemisArtemis!53d187eba6df
    McAfee DetectionGeneric PUP.x!o
    Length139,152 bytes
    CRCE861CA76
    MD553D187EBA6DFA6012FB4EE366604DD26
    SHA1BE689B217EFFC63C6A1B505E28ECC68D7AAF92DB

    Other Common Detection Aliases

    Company NameDetection Name
    avastWin32:BHO-GG
    AVG (GriSoft)Puper.H
    AviraDR/BHO.dvi.30
    BitDefenderDropped:Application.Generic.37562
    clamavAdware.Agent-3842
    eSafe (Alladin)Win32.DRBHO.Dvi
    Eseta variant of Win32/Adware.Cinmus
    FortiNetAdware/AdClicker
    Kasperskynot-a-virus:AdWare.Win32.BHO.dvi
    microsoftprogram:win32/sogou
    normanNetworkWorm.FJI
    pandaAdware/WebSearch
    risingAdWare.Win32.Cpush.bz
    SophosTroj/AdClick-ER
    Trend MicroCryp_Naix-6
    vba32AdWare.Win32.BHO.dvi
    V-BusterAdware.BHO.KCL

    Avert® Labs has observed the following system activities:

    ActivityRisk Level
    Performs a shell execute of downloaded or existing files
    Informational
    Registers DLLsInformational

    Other detections that have been observed.

    FileNameMcAfee Supported
    %COMMONPROGRAMFILES%\pushware\cpush.dll
    AdClicker-BJ
    %COMMONPROGRAMFILES%\pushware\uninst.exe
    Generic PUP.x

    System Changes

    These are general defaults for typical path variables. (Although they may differ, these examples are common.):
    %WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
    %SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
    %ProgramFiles% = \Program Files

    The following files were analyzed:

  • %USERPROFILE%\local settings\temp\be689b217effc63c6a1b505e28ecc68d7aaf92db.exe
  • The following files have been added to the system:

  • %COMMONPROGRAMFILES%\pushware
  • %COMMONPROGRAMFILES%\pushware\cpush.dll
  • %COMMONPROGRAMFILES%\pushware\uninst.exe
  • The following registry elements have been created:

  • HKEY_LOCAL_MACHINE\software\classes\clsid\{11f09afd-75ad-4e51-ab43-e09e9351ce16}\
    • (default) = cadlogic object
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{11f09afd-75ad-4e51-ab43-e09e9351ce16}\inprocserver32\
    • (default) = c:\program files\common files\pushware\cpush.dll
    • threadingmodel = apartment
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{11f09afd-75ad-4e51-ab43-e09e9351ce16}\progid\
    • (default) = newzadspopup.bklogc.1
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{11f09afd-75ad-4e51-ab43-e09e9351ce16}\typelib\
    • (default) = {de2267bd-b163-407f-9e8d-6adec771e7ab}
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{11f09afd-75ad-4e51-ab43-e09e9351ce16}\versionindependentprogid\
    • (default) = newzadspopup.bklogc
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{34a12a06-48c0-420d-8f11-73552ee9631a}\
    • (default) = ctoolbardetector object
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{34a12a06-48c0-420d-8f11-73552ee9631a}\inprocserver32\
    • (default) = c:\program files\common files\pushware\cpush.dll
    • threadingmodel = apartment
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{34a12a06-48c0-420d-8f11-73552ee9631a}\progid\
    • (default) = newadpopup.toolbardetector.1
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{34a12a06-48c0-420d-8f11-73552ee9631a}\typelib\
    • (default) = {de2267bd-b163-407f-9e8d-6adec771e7ab}
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{34a12a06-48c0-420d-8f11-73552ee9631a}\versionindependentprogid\
    • (default) = newadpopup.toolbardetector
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{cde9eb54-a08e-4570-b748-13f5ddb5781c}\
    • (default) = cpopupblock object
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{cde9eb54-a08e-4570-b748-13f5ddb5781c}\inprocserver32\
    • (default) = c:\program files\common files\pushware\cpush.dll
    • threadingmodel = apartment
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{cde9eb54-a08e-4570-b748-13f5ddb5781c}\progid\
    • (default) = newdcocomediapop.popcoco.1
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{cde9eb54-a08e-4570-b748-13f5ddb5781c}\typelib\
    • (default) = {de2267bd-b163-407f-9e8d-6adec771e7ab}
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{cde9eb54-a08e-4570-b748-13f5ddb5781c}\versionindependentprogid\
    • (default) = newdcocomediapop.popcoco
  • HKEY_LOCAL_MACHINE\software\classes\interface\{0ad3ab16-6d0e-4f04-8660-fb1f36bc2dc0}\
    • (default) = iadlogic
  • HKEY_LOCAL_MACHINE\software\classes\interface\{0ad3ab16-6d0e-4f04-8660-fb1f36bc2dc0}\proxystubclsid\
    • (default) = {00020424-0000-0000-c000-000000000046}
  • HKEY_LOCAL_MACHINE\software\classes\interface\{0ad3ab16-6d0e-4f04-8660-fb1f36bc2dc0}\proxystubclsid32\
    • (default) = {00020424-0000-0000-c000-000000000046}
  • HKEY_LOCAL_MACHINE\software\classes\interface\{0ad3ab16-6d0e-4f04-8660-fb1f36bc2dc0}\typelib\
    • (default) = {de2267bd-b163-407f-9e8d-6adec771e7ab}
    • version = 3157553
  • HKEY_LOCAL_MACHINE\software\classes\interface\{2f685b36-c53a-4653-9231-1dae5736de45}\
    • (default) = itoolbardetector
  • HKEY_LOCAL_MACHINE\software\classes\interface\{2f685b36-c53a-4653-9231-1dae5736de45}\proxystubclsid\
    • (default) = {00020424-0000-0000-c000-000000000046}
  • HKEY_LOCAL_MACHINE\software\classes\interface\{2f685b36-c53a-4653-9231-1dae5736de45}\proxystubclsid32\
    • (default) = {00020424-0000-0000-c000-000000000046}
  • HKEY_LOCAL_MACHINE\software\classes\interface\{2f685b36-c53a-4653-9231-1dae5736de45}\typelib\
    • (default) = {de2267bd-b163-407f-9e8d-6adec771e7ab}
    • version = 3157553
  • HKEY_LOCAL_MACHINE\software\classes\interface\{50c4cdd9-22d7-49ff-ac6d-7d4d528a3ab2}\
    • (default) = ipopupblock
  • HKEY_LOCAL_MACHINE\software\classes\interface\{50c4cdd9-22d7-49ff-ac6d-7d4d528a3ab2}\proxystubclsid\
    • (default) = {00020424-0000-0000-c000-000000000046}
  • HKEY_LOCAL_MACHINE\software\classes\interface\{50c4cdd9-22d7-49ff-ac6d-7d4d528a3ab2}\proxystubclsid32\
    • (default) = {00020424-0000-0000-c000-000000000046}
  • HKEY_LOCAL_MACHINE\software\classes\interface\{50c4cdd9-22d7-49ff-ac6d-7d4d528a3ab2}\typelib\
    • (default) = {de2267bd-b163-407f-9e8d-6adec771e7ab}
    • version = 3157553
  • HKEY_LOCAL_MACHINE\software\classes\newadpopup.toolbardetector.1\
    • (default) = ctoolbardetector object
  • HKEY_LOCAL_MACHINE\software\classes\newadpopup.toolbardetector.1\clsid\
    • (default) = {34a12a06-48c0-420d-8f11-73552ee9631a}
  • HKEY_LOCAL_MACHINE\software\classes\newadpopup.toolbardetector\
    • (default) = ctoolbardetector object
  • HKEY_LOCAL_MACHINE\software\classes\newadpopup.toolbardetector\clsid\
    • (default) = {34a12a06-48c0-420d-8f11-73552ee9631a}
  • HKEY_LOCAL_MACHINE\software\classes\newadpopup.toolbardetector\curver\
    • (default) = newadpopup.toolbardetector.1
  • HKEY_LOCAL_MACHINE\software\classes\newdcocomediapop.popcoco.1\
    • (default) = cpopupblock object
  • HKEY_LOCAL_MACHINE\software\classes\newdcocomediapop.popcoco.1\clsid\
    • (default) = {cde9eb54-a08e-4570-b748-13f5ddb5781c}
  • HKEY_LOCAL_MACHINE\software\classes\newdcocomediapop.popcoco\
    • (default) = cpopupblock object
  • HKEY_LOCAL_MACHINE\software\classes\newdcocomediapop.popcoco\clsid\
    • (default) = {cde9eb54-a08e-4570-b748-13f5ddb5781c}
  • HKEY_LOCAL_MACHINE\software\classes\newdcocomediapop.popcoco\curver\
    • (default) = newdcocomediapop.popcoco.1
  • HKEY_LOCAL_MACHINE\software\classes\newzadspopup.bklogc.1\
    • (default) = cadlogic object
  • HKEY_LOCAL_MACHINE\software\classes\newzadspopup.bklogc.1\clsid\
    • (default) = {11f09afd-75ad-4e51-ab43-e09e9351ce16}
  • HKEY_LOCAL_MACHINE\software\classes\newzadspopup.bklogc\
    • (default) = cadlogic object
  • HKEY_LOCAL_MACHINE\software\classes\newzadspopup.bklogc\clsid\
    • (default) = {11f09afd-75ad-4e51-ab43-e09e9351ce16}
  • HKEY_LOCAL_MACHINE\software\classes\newzadspopup.bklogc\curver\
    • (default) = newzadspopup.bklogc.1
  • HKEY_LOCAL_MACHINE\software\classes\typelib\{de2267bd-b163-407f-9e8d-6adec771e7ab}\1.0\
    • (default) = newadpopup 1.0 type library
  • HKEY_LOCAL_MACHINE\software\classes\typelib\{de2267bd-b163-407f-9e8d-6adec771e7ab}\1.0\0\win32\
    • (default) = c:\program files\common files\pushware\cpush.dll
  • HKEY_LOCAL_MACHINE\software\classes\typelib\{de2267bd-b163-407f-9e8d-6adec771e7ab}\1.0\flags\
    • (default) = 48
  • HKEY_LOCAL_MACHINE\software\classes\typelib\{de2267bd-b163-407f-9e8d-6adec771e7ab}\1.0\helpdir\
    • (default) = c:\program files\common files\pushware\
  • HKEY_LOCAL_MACHINE\software\cpush\update\
    • ad_version = 1,1,1,1
  • HKEY_LOCAL_MACHINE\software\microplugins\common\
    • param = sid=ad
    • size = 9526
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\currentversion\explorer\browser helper objects\{11f09afd-75ad-4e51-ab43-e09e9351ce16}\
    • (default) = adpopup
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\currentversion\uninstall\contentmatch\
    • displayname = adsense based popad
    • uninstallstring = c:\program files\common files\pushware\uninst.exe
  • Symptoms

    Symptoms -

    This symptoms of this detection are the files, registry, and network communication referenced in the characteristics section.

    Method of Infection

    Method of Infection -

    This is not a virus or Trojan. PUPs do not "infect" systems. They may be installed by a user individually or possibly as a part of a software package (in a bundle, for example).

    Removal -

    Removal -

    AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

    Additional Windows ME/XP removal considerations

    Variants

    Variants -

      N/A