Alias: Adware-WUpd (NAI)
Threat Type: Adware
Systems Affected: Windows 95, 98, ME, NT, 2000, XP
Installer Name: NS.EXE
This adware downloads other free software applications from the Internet and installs them in the compromised system.
TREND MICRO SOLUTION
- Minimum scan engine version needed: 7.100
TMAPTN version needed: 228.20
- DCE version needed: 3.8
TMADCE version needed:
MANUAL REMOVAL INSTRUCTIONS
Using the Grayware Uninstall Option
To remove this grayware program using its uninstall option, do the following:
- Click Start>Settings>Control Panel.
- Double-click on Add/Remove Programs.
- In the displayed list, choose the following program:
- Click on Change/Remove.
- Follow the instructions on the dialog box that appears.
- Close the Add/Remove Programs window, and the Control Panel window.
Upon execution, this adware adds its following components:
- %Program Files%\DeskAd Service\DeskAdComm.dll
- %Program Files%\DeskAd Service\DeskAdKeep.exe
- %Program Files%\DeskAd Service\DeskAdServ.exe
(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)
It adds the following registry entry to ensure its automatic execution at every Windows startup:
DeskAd Service = "%Program Files%\DeskAd Service\DeskAdServ.exe"
It also adds the following registry entry to keep track of updates to itself:
LastUpdate = <hex value>
Analysis by: Michael Lactaotao