Content

Adware-abetterintrnt.dldr

Type
Program
SubType
Downloader
Discovery Date
03/07/2005
Minimum DAT
4411 (12/01/2004)
Updated DAT
4702 (02/21/2006)
Minimum Engine
5.1.00
Description Added
12/01/2004
Description Modified
03/17/2005 3:28 PM (PT)

Tab Navigation

Characteristics

McAfee(R) AVERT™ recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application.If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software.Please contact the software vendor for further information.

See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.

Ixplore.exe, detected as adware-BetterInet.dldr, downloads various adware and dialer programs. It also sends out system info to thinstall.betterinternet.com prior to installation of the downloaded programs. Some of the downloaded adware programs are as follows:

  • Adware-BetterInet
  • Adware-IPSentry
  • Downloader-KL 
  • Dialer-RAS.bb.gen

The files are downloaded from following sites

Installation

The Downloader adds itself to the following run registry key in order to get executed on each reboot.

  • KEY_USERS\S-1-5-21-854245398-1383384898-842925246- 500\Software\Microsoft\Windows\CurrentVersion\Run\Apwheel: "C:\Documents  and Settings\Administrator\Desktop\ixplore.exe"

The following files is/are downloaded

  • Name: Dtvbrqgl.exe (Downloader-KL)
    MD5:  A2 80 88 02 0C 3E EA 46 B6 5B 39 87 7B 82 64 AA [0-131FF]
    Size: 78,336 Bytes
  • Name: Ceres.dll (Adware-BetterInet)
    Md5: 81 B5 B9 03 05 26 46 A7 94 06 EB 54 C0 1E 8B D3 [0-4FFFF]
    Size: 327,680 bytes
  • Name: Farmnext.exe (Aware-IPSentry)
    MD5: 10 80 B2 7D FF C3 13 19 A7 D7 FC 1B EF 10 9D E9
    Size: 69, 632 bytes
  • Name: Bg3.exe (Dialer RAS.bb.gen)
    MD5: 57 A3 9E 2A 75 55 E0 CE 53 FF 7D F7 CD B7 52 84
    Size: 70, 144 bytes  

Symptoms

Symptoms depend upon the characteristics of files downloaded.

Aliases

Aliases

  • Adware-BetterInet.dldr