Home Malware Programs Adware Adware.Webmoner

Adware.Webmoner

Posted: November 29, 2010

Adware.Webmoner is an annoying adware program that bombards computer users with annoying popup advertisments from corrupt websites. Adware.Webmoner can also send valuable personal information to malicious third parties. Adware.Webmoner embeds itself into the compromised system as a Browser Helper Object (BHO), making it difficult to remove manually. Adware.Webmoner will eventually try and convince the oblivious PC user to purchase a dysfunctional software to solve the problems it created. Do not fall for this trickery and have Adware.Webmoner removed immediately.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Temp%\dat1.tmp

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}[HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device][HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device][HKEY_CURRENT_USER\Software\Microsoft\Multimedia\ActiveMovie\Filter Cache][HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform][HKEY_CURRENT_USER\Software\NATATA eBook\The Real Princess{F61B9126-7CC2-4BB1-B0BD-E7A872CACCE2}][HKEY_CURRENT_USER\Software\NATATA eBook][HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82184935-B894-4AB2-8590-603BA7D74B71}\LocalServer32][HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82184935-B894-4AB2-8590-603BA7D74B71}\ProgID][HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82184935-B894-4AB2-8590-603BA7D74B71}][HKEY_LOCAL_MACHINE\SOFTWARE\Classes\[filename of the sample #1 without extension].eProtocol\Clsid][HKEY_LOCAL_MACHINE\SOFTWARE\Classes\[filename of the sample #1 without extension].eProtocol]HKEY..\..\..\..{RegistryKeys}(Default) = "[file and pathname of the sample #1]"(Default) = "[filename of the sample #1 without extension].eProtocol"(Default) = "eProtocol"(Default) = "{82184935-B894-4AB2-8590-603BA7D74B71}"0 = E0 5A 00 00 65 68 63 66 00 00 00 00 00 00 00 00 02 01 00 00 00 00 00 00 01 00 20 00 49 00 00 00 40 00 64 00 65 00 76 00 69 00 63 00 65 00 3A 00 64 00 6D 00 6F 00 3A 00 7B 00 32 00 45 00 45 00 42 00 34 00 41 00 44 00 46 00 2D 00 34 00 35 00 37 00 38 0CLSID = "{07B65360-C445-11CE-AFDE-00AA006C14F4}"CLSID = "{79376820-07D0-11CF-A24D-0020AFD79767}"DSGuid = "{00000000-0000-0000-0000-000000000000}"FilterData = 02 00 00 00 00 00 80 00 01 00 00 00 00 00 00 00 30 70 69 33 02 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 30 74 79 33 00 00 00 00 38 00 00 00 48 00 00 00 6D 69 64 73 00 00 10 00 80 00 00 AA 00 38 9B 71 00 00 00 00 00 00 00 00 00 00 00 0FilterData = 02 00 00 00 00 00 80 00 01 00 00 00 00 00 00 00 30 70 69 33 02 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 30 74 79 33 00 00 00 00 A8 00 00 00 B8 00 00 00 31 74 79 33 00 00 00 00 A8 00 00 00 C8 00 00 00 32 74 79 33 00 00 00 00 A8 00 00 0FriendlyName = "Default DirectSound Device"FriendlyName = "Default MidiOut Device"MidiOutId = 0xFFFFFFFFThe Real Princess{F61B9126-7CC2-4BB1-B0BD-E7A872CACCE2} = 00 00 00 00 80 B9 E3 40eBook = ""exe = "1"exeal = "0"
Loading...