ADW_WUPD.D

Download the latest scan engine

In the wild: No

Reported detections:

Low
 

Description:

Alias: Adware-WUpd (NAI)

Threat Type: Adware

Systems Affected: Windows 95, 98, ME, NT, 2000, XP

Installer Name: NS.EXE

This adware downloads other free software applications from the Internet and installs them in the compromised system.



Solution:

TREND MICRO SOLUTION

  • Minimum scan engine version needed: 7.100
      TMAPTN version needed: 228.20
  • DCE version needed: 3.8
      TMADCE version needed: 162.01

MANUAL REMOVAL INSTRUCTIONS

Using the Grayware Uninstall Option

To remove this grayware program using its uninstall option, do the following:

  1. Click Start>Settings>Control Panel.
  2. Double-click on Add/Remove Programs.
  3. In the displayed list, choose the following program:
    Deskad Service
  4. Click on Change/Remove.
  5. Follow the instructions on the dialog box that appears.
  6. Close the Add/Remove Programs window, and the Control Panel window.


Details:

Upon execution, this adware adds its following components:

  • %Program Files%\DeskAd Service\DeskAdComm.dll
  • %Program Files%\DeskAd Service\DeskAdKeep.exe
  • %Program Files%\DeskAd Service\DeskAdServ.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

It adds the following registry entry to ensure its automatic execution at every Windows startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run
DeskAd Service = "%Program Files%\DeskAd Service\DeskAdServ.exe"

It also adds the following registry entry to keep track of updates to itself:

HKEY_LOCAL_MACHINE\Software\DeskAd Service
LastUpdate = <hex value>




Analysis by: Michael Lactaotao

Description created:  Feb 15, 2005



TECHNICAL DETAILS



Initial samples received on:  Feb 13, 2005



SOLUTION


Spyware pattern version needed : 0.619.00

Pattern release date:  Mar 18, 2008