spyology

MataHari · Junior Data inscrierii: 15/Oct/2008 Mesaje: 16

Va salut pe toti in primul rand ,si as dori daca poate cineva sa-mi dea detalii despre spyware KeenValue.As vrea sa stiu cat mai numeroase detalii.Va multumesc anticipat.[color=orange][/color]

the shadow · Trimis: 15/10/2008 21:51 Titlul subiectului: raspuns

Keenval: adware
Versiunea: 1.6
Publisher: eUniverse.com
Riscul de impact: sporit
File Names: %CommonProgramFiles%\KeenValue\IESliderWin32.dll %CommonProgramFiles%\KeenValue\Keenvalue.exe %C
Sistemele afectate: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

Comportamentul:

Keenval este un adware care redirectioneaza browserul catre un portal care downloadeaza si mai mult adware.
Atentie: detectiile inaintea datei de 7 martie 2005 il recunosc drept Adware.Keenval.B.

Simptome:

Una sau mai multe file-uri sunt detectate ca Adware.Keenval.

Transmisia:

Poate fi downloadat de pe un website compromis si necesita instalare manuala.

Protectia si indepartarea:

Unealta de indepartare poate fi gasita aici:
http://securityresponse.symantec.com/avcenter/FxKeenVl.exe

Detalii tehnice.

Cand KeenValue.exe este executat, actioneaza astfel:

1. Poate crea urmatoarele file-uri si foldere:
# %CommonProgramFiles%\KeenValue\IESliderWin32.dll
# %CommonProgramFiles%\KeenValue\Keenvalue.exe
# %CommonProgramFiles%\KeenValue\KeenValueInstall_with_track_120.exe
# %CommonProgramFiles%\KeenValue\Killkeenvalue.exe
# %CommonProgramFiles%\KeenValue\Kv???.dat
# %CommonProgramFiles%\KeenValue\Kvlhookwin.dll
# %CommonProgramFiles%\KeenValue\Kwm.exe
# %CommonProgramFiles%\KeenValue\SendUninstallInfo.exe
# %CommonProgramFiles%\KeenValue\Setup_incredifind_ultimatesaver_with_track.exe
# %CommonProgramFiles%\KeenValue\Tipb.exe
# %CommonProgramFiles%\KeenValue\Uninstall.exe
# %CommonProgramFiles%\KeenValue\Setup_powersearch_ultimateSaver_with_track.exe
# %CommonProgramFiles%\updmgr
# %CommonProgramFiles%\KeenValue
# %CommonProgramFiles%\updater\delupdat.exe
# %CommonProgramFiles%\updater\wupdater.exe
# %CommonProgramFiles%\updater\sui.exe
# %CommonProgramFiles%\updater\data1.dat
# %CommonProgramFiles%\updater\data2.dat
# C:\updaterInstall_112.exe
# %System%\setup_incred_9.exe
# %System%\unins000.dat
# %System%\unins000.exe
# %System%\somatic.dll
# %ProgramFiles%\PerfectNav\BHO\PerfectNav150c.dll
# %ProgramFiles%\MSBB\keen_value_installer.exe
# %ProgramFiles%\MyFreeCursors
# %ProgramFiles%\Dynamic Toolbar\SOMATIC
# C:\Documents and Settings\All Users\Start Menu\Programs\Startup\KeenValue.lnk

2. Adauga valorile:
"KeenValue" = "%CommonProgramFiles%\KeenValue\KeenValue.exe"
"updater" = "%CommonProgramFiles%\updater\wupdater.exe"
"updmgr" = "%CommonProgramFiles%\updmgr\rvupdmgr.exe"

in urmatorul registry subkey:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

astfel incat adware-ul este executat de fiecare data cand Windows porneste.

KeenValue este un adware a carui activitate s-a inregistrat cu precadere in perioada 2003 - 2005. Intrebarea mea legitima este: de ce in 2008 se mai ridica aceasta problema.

Este un adware care se instaleaza de cele mai multe ori prin browser-ul Internet Explorer. Personal, folosesc Firefox de la Mozilla. Nu am intampinat astfel de probleme.

Admit faptul ca prin aceasta postare am depasit cadrul de interes al forumului de fata, chiar daca ne aflam la sectiunea IT & Internet. Raspunsul mi-a facut insa placere.

[url=http://www.99poze.ro/p/509c3c47b3c9d12d1e47a3e3655fab25.jpg] KeenValue raspuns

[/url] [url=http://www.99poze.ro/p/bc99d2408593fe0678f5931d55acc2a8.jpg] KeenValue raspuns

[/url]
_________________
informatia inseamna putere

MataHari · Junior Data inscrierii: 15/Oct/2008 Mesaje: 16

Multumesc frumos