Sunday, December 14, 2008

CasinoClient Adware

Removing CasinoClient
Categories: Adware
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.


Visible Symptoms:
Files in system folders:
[%PROFILE_TEMP%]\cas2setup.exe
[%PROGRAM_FILES%]\System Files\System.exe
[%WINDOWS%]\pf78.exe
[%PROFILE%]\LOCAL.EXE
[%PROGRAM_FILES%]\Cas\Client\casclient.exe
[%PROGRAM_FILES%]\Cas\Client\casmf.dll
[%PROGRAM_FILES%]\Cas\Client\hf.txt
[%PROGRAM_FILES%]\Cas\Client\sf.txt
[%PROGRAM_FILES%]\Cas\Client\Uninstall.exe
[%DESKTOP%]\chat now.lnk
[%DESKTOP%]\free plasma tv.lnk
[%DESKTOP%]\poker shortcut.lnk
[%DESKTOP%]\weather.lnk
[%PROFILE_TEMP%]\cassetup.exe
[%PROFILE_TEMP%]\cas2setup.exe
[%PROGRAM_FILES%]\System Files\System.exe
[%WINDOWS%]\pf78.exe
[%PROFILE%]\LOCAL.EXE
[%PROGRAM_FILES%]\Cas\Client\casclient.exe
[%PROGRAM_FILES%]\Cas\Client\casmf.dll
[%PROGRAM_FILES%]\Cas\Client\hf.txt
[%PROGRAM_FILES%]\Cas\Client\sf.txt
[%PROGRAM_FILES%]\Cas\Client\Uninstall.exe
[%DESKTOP%]\chat now.lnk
[%DESKTOP%]\free plasma tv.lnk
[%DESKTOP%]\poker shortcut.lnk
[%DESKTOP%]\weather.lnk
[%PROFILE_TEMP%]\cassetup.exe

How to detect CasinoClient:

Files:
[%PROFILE_TEMP%]\cas2setup.exe
[%PROGRAM_FILES%]\System Files\System.exe
[%WINDOWS%]\pf78.exe
[%PROFILE%]\LOCAL.EXE
[%PROGRAM_FILES%]\Cas\Client\casclient.exe
[%PROGRAM_FILES%]\Cas\Client\casmf.dll
[%PROGRAM_FILES%]\Cas\Client\hf.txt
[%PROGRAM_FILES%]\Cas\Client\sf.txt
[%PROGRAM_FILES%]\Cas\Client\Uninstall.exe
[%DESKTOP%]\chat now.lnk
[%DESKTOP%]\free plasma tv.lnk
[%DESKTOP%]\poker shortcut.lnk
[%DESKTOP%]\weather.lnk
[%PROFILE_TEMP%]\cassetup.exe
[%PROFILE_TEMP%]\cas2setup.exe
[%PROGRAM_FILES%]\System Files\System.exe
[%WINDOWS%]\pf78.exe
[%PROFILE%]\LOCAL.EXE
[%PROGRAM_FILES%]\Cas\Client\casclient.exe
[%PROGRAM_FILES%]\Cas\Client\casmf.dll
[%PROGRAM_FILES%]\Cas\Client\hf.txt
[%PROGRAM_FILES%]\Cas\Client\sf.txt
[%PROGRAM_FILES%]\Cas\Client\Uninstall.exe
[%DESKTOP%]\chat now.lnk
[%DESKTOP%]\free plasma tv.lnk
[%DESKTOP%]\poker shortcut.lnk
[%DESKTOP%]\weather.lnk
[%PROFILE_TEMP%]\cassetup.exe

Folders:
[%PROGRAM_FILES%]\cmman

Registry Keys:
HKEY_CLASSES_ROOT\appid\main.dll
HKEY_CLASSES_ROOT\typelib\{67c89c18-b4f3-46a9-8800-e9e7a55afbd9}
HKEY_CLASSES_ROOT\typelib\{d4c89c18-b4f3-46a9-8800-e9e7a55afbd9}
HKEY_CURRENT_USER\software\cmsystem
HKEY_CURRENT_USER\Software\CAS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\Main.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{E0DC5CC4-25A5-4BC7-A3AA-3525733DC796}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8293D547-38DD-4325-B35A-F1817EDFA5FC}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Main.MimeFilter
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Main.MimeFilter.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D4C89C18-B4F3-46A9-8800-E9E7A55AFBD9}

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

Removing CasinoClient:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

Also Be Aware of the Following Threats:
Tarliver Trojan Cleaner
Voltron.Annoyer Adware Symptoms
Remove ConHook Trojan

No comments: