Adware Wurldmedia
Type: Adware (General term 'Spyware' was previously used)
Publisher: WurldmediaSystems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
This spyware threat can be detected only by spyware scanning software that support expanded threats.
The Spyware's Behavior
The Adware 'Wurldmedia' is installed as an Internet Explorer (IE) Browser Helper Object. The spyware component detects a known list of Web sites and redirects you to a third-party server.There are multiple variants of this adware:
- Wurldmedia/bpboh
- Wurldmedia/mbho
- Wurldmedia/MSCStat
- Wurldmedia/MShop
- Wurldmedia/Maoo
- Wurldmedia/Tchk
This adware would be automatically installed when you install other programs, the most common of which is Morpheus.
The Wurldmedia's spyware tracks your visits to targeted Web sites that are listed in an encoded file (mscNNNNNN.de). It will append a unique ID and resend the information to a controlling server. Wurldmedia's spyware also connects to a server to download and execute arbitrary code.
Depending on the variant of Adware 'Wurldmedia', the following registry keys may be installed:
HKEY_CLASSES_ROOT\CLSID
\2737A6C0-7E24-11D7-B299-00E0297E0844
HKEY_CLASSES_ROOT\CLSID
\3A279869-C6B6-4410-A041-0435DE6AD916
HKEY_CLASSES_ROOT\CLSID
\40AC4D2D-491D-11D4-AAF2-0008C75DCD2B
HKEY_CLASSES_ROOT\CLSID
\525BBD23-1863-46C6-86D6-5F9A3715D44E
HKEY_CLASSES_ROOT\CLSID
\8E9C4F32-BD3F-4C49-9AF5-3F4C5D32EBD7
HKEY_CLASSES_ROOT\CLSID
\CDBCFEAE-10BA-482C-9F6E-FC67207082D8
*Unregister the .dll files you find, and then restart the computer.
Make sure you Run a full system spyware scan as well, and delete all the files detected as Adware under the filename(s) Wurldmedia.
Then Delete the spyware keys that were added to the registry.
Unregistering the .dll file
Click Start > Run.Click Browse and browse to and select the Windir\System\Regsvr32.dll file.
Click Open.
Add the text, /u mbho.dll, so the line looks like this:
regsvr32 /u mbho.dll
Click OK.
Scanning for and deleting the Spyware files
Run your free spyware scanner and make sure that it is configured to scan all files.Run a full system scan.
If any files are detected as spyware infected with the Adware 'Wurldmedia', Delete them.
Deleting the Spyware Values from the Registry
Click Start, and then click Run. (The Run dialog box appears.)Type regedit
Then click OK. (The Registry Editor opens.)
Navigate to and delete the spyware's keys:
HKEY_CLASSES_ROOT\CLSID
\2737A6C0-7E24-11D7-B299-00E0297E0844
HKEY_CLASSES_ROOT\CLSID
\3A279869-C6B6-4410-A041-0435DE6AD916
HKEY_CLASSES_ROOT\CLSID
\40AC4D2D-491D-11D4-AAF2-0008C75DCD2B
HKEY_CLASSES_ROOT\CLSID
\525BBD23-1863-46C6-86D6-5F9A3715D44E
HKEY_CLASSES_ROOT\CLSID
\8E9C4F32-BD3F-4C49-9AF5-3F4C5D32EBD7
HKEY_CLASSES_ROOT\CLSID
\CDBCFEAE-10BA-482C-9F6E-FC67207082D8
Exit the Registry Editor.
You will find much more on this topic at WorldsLargestNetwork.com
 |
|
|
|
|
WorldsLargestNetwork.comFree Spyware Scanner
PC Speed Boost
Create Website Easily
Computer Monitoring Software
Internet Education
Anti Spy Software
Stop Pop Ups
Scan PC for Spyware
Pop-up Eliminator
