Adware Ting

Type: Adware (Spyware was a generalized term used in the past)

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

Systems Not Affected: DOS, Linux, Macintosh, OS/2, UNIX, Windows 3.x

This spyware threat can be detected only by spyware scanning software that support expanded threats.

The Aware's Behavior

Adware 'Ting' is an adware program that changes the Internet Explorer home page to 78ting.com, for advertising purposes.

Your home page will be changed to 78ting.com.

This adware component of this spyware must be manually installed or installed as a component of another program that you install on your system.

File names: internet.exe

When the Adware 'Ting' is executed, it performs the following

Copies itself as System\internet.exe.

Adds the value:

internet="System\internet.exe"

to the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
\Windows\CurrentVersion\Run

..so that Ting's spyware runs when you start Windows.

Adds the value:

DisableRegistryTools="1"

to the registry key:

HKEY_CURRENT_USER\Software\Microsoft
\Windows\CurrentVersion\Policies\System

so that you are not able to run Regedit on your computer.

Changes the Internet Explorer home page to 78ting.com.

*Make sure you Run a full system spyware scan and delete all the spyware files detected as Adware under the filename(s) Ting.

Then Delete the spyware value that was added to the registry.

Restore your Internet Explorer settings.

Scanning for and deleting the Spyware and Adware files

Run your free spyware scanner and make sure that it is configured to scan all files.

Run a full system scan.

If any files are detected as spyware infected with the Adware 'Ting', Delete them.

Deleting the Spyware value from the Registry

Click Start, and then click Run. (The Run dialog box appears.)

Type: notepad

and click OK. (Notepad opens a text file.)

Type, or copy and paste, the following text into the text file:

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft
\Windows\CurrentVersion\Policies\System]

DisableRegistryTools=dword:00000000

Save the file as:

repair.reg

in the root folder (usually C:\).

Click Start, and then click Run.

Then Type: regedit -s \repair.reg

and then click OK.

Click Start, and then click Run. (The Run dialog box appears.)

Type: regedit

Then click OK. (The Registry Editor opens.)

Navigate to the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
\Windows\CurrentVersion\Run

In the right pane, delete the value:

internet="System\internet.exe"

Exit the Registry Editor.