Wednesday, December 3, 2008

DropSpam Adware

Removing DropSpam
Categories: Adware,Hijacker
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits
A Search hijacker redirects search results to other pages and may
transmit search and browsing data to unknown servers. An error page hijacker directs
the browser to another page, usually an advertising page, instead of the usual error
page when the requested URL is not found.

Visible Symptoms:
Files in system folders:
[%APPDATA%]\microsoft\addins\ewwotb.dll
[%PROFILE_TEMP%]\updrun.exe
[%PROGRAM_FILES%]\dslifestyle\dslifestyle.exe
[%WINDOWS%]\aac.exe
[%WINDOWS%]\appupdate.exe
[%WINDOWS%]\dslife.exe
[%WINDOWS%]\ewwsetup.exe
[%WINDOWS%]\invupd.exe
[%WINDOWS%]\invupdate.exe
[%WINDOWS%]\updrun.exe
[%WINDOWS%]\aae1.exe
[%APPDATA%]\microsoft\addins\ewwotb.dll
[%PROFILE_TEMP%]\updrun.exe
[%PROGRAM_FILES%]\dslifestyle\dslifestyle.exe
[%WINDOWS%]\aac.exe
[%WINDOWS%]\appupdate.exe
[%WINDOWS%]\dslife.exe
[%WINDOWS%]\ewwsetup.exe
[%WINDOWS%]\invupd.exe
[%WINDOWS%]\invupdate.exe
[%WINDOWS%]\updrun.exe
[%WINDOWS%]\aae1.exe

How to detect DropSpam:

Files:
[%APPDATA%]\microsoft\addins\ewwotb.dll
[%PROFILE_TEMP%]\updrun.exe
[%PROGRAM_FILES%]\dslifestyle\dslifestyle.exe
[%WINDOWS%]\aac.exe
[%WINDOWS%]\appupdate.exe
[%WINDOWS%]\dslife.exe
[%WINDOWS%]\ewwsetup.exe
[%WINDOWS%]\invupd.exe
[%WINDOWS%]\invupdate.exe
[%WINDOWS%]\updrun.exe
[%WINDOWS%]\aae1.exe
[%APPDATA%]\microsoft\addins\ewwotb.dll
[%PROFILE_TEMP%]\updrun.exe
[%PROGRAM_FILES%]\dslifestyle\dslifestyle.exe
[%WINDOWS%]\aac.exe
[%WINDOWS%]\appupdate.exe
[%WINDOWS%]\dslife.exe
[%WINDOWS%]\ewwsetup.exe
[%WINDOWS%]\invupd.exe
[%WINDOWS%]\invupdate.exe
[%WINDOWS%]\updrun.exe
[%WINDOWS%]\aae1.exe

Folders:
[%PROGRAMS%]\drop spam
[%PROGRAM_FILES%]\dropspam
[%PROGRAM_FILES%]\dslifestyle
[%COMMON_PROGRAMS%]\Drop Spam

Registry Keys:
HKEY_CLASSES_ROOT\appid\oesrv.exe
HKEY_CLASSES_ROOT\appid\{54ac0313-c709-4f55-a430-ec7e89f74665}
HKEY_CLASSES_ROOT\clsid\{1d95d4b4-f3de-4bde-af1d-219b23b58986}
HKEY_CLASSES_ROOT\CLSID\{2DEA8791-C2B7-48E1-8992-8E8E6A6FE789}
HKEY_CLASSES_ROOT\clsid\{3058b2ea-a146-451a-916a-a5dcce7fa0b7}
HKEY_CLASSES_ROOT\clsid\{5d50d513-e136-4f9f-b610-c7805e5f2491}
HKEY_CLASSES_ROOT\clsid\{88b79166-13ab-4d04-aee8-7ab1cde75d7e}
HKEY_CLASSES_ROOT\ewwie.band
HKEY_CLASSES_ROOT\ewwie.band.1
HKEY_CLASSES_ROOT\ewwie.popcounter
HKEY_CLASSES_ROOT\ewwie.popcounter.1
HKEY_CLASSES_ROOT\ewwotb.addin
HKEY_CLASSES_ROOT\ewwotb.addin.1
HKEY_CLASSES_ROOT\interface\{1e98666f-6260-42c9-b846-32b20fdefe7b}
HKEY_CLASSES_ROOT\interface\{1fa6a0f9-705d-4c47-b67c-f12d5f171470}
HKEY_CLASSES_ROOT\interface\{34dae02f-aac8-4a32-a188-7444bcdae162}
HKEY_CLASSES_ROOT\interface\{4cd72ddb-061e-4366-8a47-babde2dcdba0}
HKEY_CLASSES_ROOT\interface\{68b8dcdb-efa4-420a-bb8a-71b9892a2063}
HKEY_CLASSES_ROOT\interface\{a3080819-9a46-4acf-aa24-b34d59715c5e}
HKEY_CLASSES_ROOT\interface\{a5f6c90c-abe4-4c57-a421-8c5a202aa9f8}
HKEY_CLASSES_ROOT\interface\{a7c16b8f-9eea-4e6b-abf8-34e492e14019}
HKEY_CLASSES_ROOT\interface\{b13281cf-8778-4c98-ae23-abba4637a33d}
HKEY_CLASSES_ROOT\oehk.oerebar
HKEY_CLASSES_ROOT\oehk.oerebar.1
HKEY_CLASSES_ROOT\oesrv.oeinterface
HKEY_CLASSES_ROOT\oesrv.oeinterface.1
HKEY_CLASSES_ROOT\typelib\{8220059c-d959-4f27-b559-179a8c5efdc1}
HKEY_CLASSES_ROOT\typelib\{9ca78f1b-ee6b-4fd0-84e0-794d58a51496}
HKEY_CLASSES_ROOT\typelib\{cc1074c2-0ca2-408e-81f9-ca8ad68d31a9}
HKEY_CLASSES_ROOT\typelib\{de6317f7-6ef0-45c2-88d1-8e09415817f1}
HKEY_CLASSES_ROOT\typelib\{f45e6252-3fb8-4876-b185-cdc91f42165d}
HKEY_CURRENT_USER\software\dropspam
HKEY_CURRENT_USER\software\dropspamtoolbar
HKEY_CURRENT_USER\software\microsoft\office\outlook\addins\ewwotb.addin.1
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{B6E649FA-5461-40d7-AB4D-54FC3C8DB767}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DEA8791-C2B7-48E1-8992-8E8E6A6FE789}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\drop spam
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\internet explorer toolbar - dropspam
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\lifestyle . dropspam
HKEY_CLASSES_ROOT\clsid\{2dea8791-c2b7-48e1-8992-8e8e6a6fe789}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\extensions\{b6e649fa-5461-40d7-ab4d-54fc3c8db767}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{2dea8791-c2b7-48e1-8992-8e8e6a6fe789}

Registry Values:
HKEY_CURRENT_USER\software\microsoft\internet explorer\main
HKEY_CURRENT_USER\software\microsoft\search assistant
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\software\microsoft\internet explorer\main
HKEY_CURRENT_USER\software\microsoft\search assistant
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

Removing DropSpam:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

Also Be Aware of the Following Threats:
Stealth.Keylogger Spyware Cleaner
Backdoor.EggDrop.Server Trojan Symptoms
Remove Hpt Trojan
Delf.zc Downloader Removal

No comments: