Content

Adware-Malwarewipe

Type
Program
SubType
Adware
Discovery Date
12/28/2005
Length
Varies
Minimum DAT
4662 (12/29/2005)
Updated DAT
5294 (05/13/2008)
Minimum Engine
5.1.00
Description Added
12/28/2005
Description Modified
12/28/2005 1:20 PM (PT)
Risk Assessment
Corporate User
N/A
Home User
N/A

Tab Navigation

Characteristics

McAfee(R) AVERT recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application. If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software. Please contact the software vendor for further information.

See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.

Distribution

This is not a virus or a trojan. It is detected as a "potentially unwanted program". This is an anti-spyware application claiming to remove unwanted malicious spyware programs. It is known to be associated with some versions of the Puper Trojan which direct users to a website pushing Malwarewipe. In order to clean or delete any elements it finds, you must first enter a valid serial number to activate the full version or click on the “Buy Online” button and purchase the full version. The software also appears to be related to or possibly a re-branding of Adware-Spyaxe .

 

This application displays a license agreement when installed. The agreement appears to be a standard legal boilerplate and does not clearly indicate the functionality of the software. A copy of the EULA was not available on the malwarewipe.com website.

Privacy

A privacy policy is not displayed during installation. However, a policy can be accessed on the author's website: http://www.malwarewipe.com/privacy.php

System Changes

General defaults for typical path variables (although they may be different, they usually are not):
%WinDir% = \WINDOWS (Windows 9x/ME/XP), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM32 (Windows 9x/ME/XP), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

"*" - Denotes files that, though installed along with the software, are by themselves innocent and not included in detection.

Files Added

  • Installer: mw_install.exe (2736 KB)
    MD5: FAF52BE58AED45C9A41A008183CDE7F9
  • c:\program files\malwarewipe\uninst.exe (34 KB)
    MD5: 2AFEA8079479F0E2956E5498E230F68B
  • c:\program files\malwarewipe\msvcr71.dll* (340 KB)
  • c:\program files\malwarewipe\msvcp71.dll* (488 KB)
  • c:\program files\malwarewipe\malwarewipe.url (1 KB)
  • c:\program files\malwarewipe\malwarewipe.exe (1492 KB)
    MD5: 3BA90052438B45E78AC259205EC6C921
  • c:\program files\malwarewipe\db.dat (968 KB)
  • c:\program files\malwarewipe\lang\english.ini (31 KB)
  • c:\program files\malwarewipe\quarantine\
  • c:\documents and settings\administrator\start menu\programs\malwarewipe\uninstall malwarewipe 4.0.lnk (1 KB)
  • c:\documents and settings\administrator\start menu\programs\malwarewipe\malwarewipe 4.0.lnk (1 KB)
  • c:\documents and settings\administrator\start menu\programs\malwarewipe\malwarewipe 4.0 website.lnk (1 KB)
  • c:\documents and settings\administrator\start menu\malwarewipe 4.0.lnk (1 KB)
  • c:\documents and settings\administrator\desktop\malwarewipe.lnk (1 KB)
  • c:\documents and settings\administrator\application data\microsoft\internet explorer\quick launch\malwarewipe 4.0.lnk (1 KB)

Registry

The following registry keys are created:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \Uninstall\MalwareWipe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    "MalwareWipe"="C:\Program Files\MalwareWipe\MalwareWipe.exe /h"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \App Paths\MalwareWipe.exe
    "default"="C:\Program Files\MalwareWipe\MalwareWipe.exe"
  • HKEY_LOCAL_MACHINE\SOFTWARE\MalwareWipe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Licenses
  • HKEY_CLASSES_ROOT\TypeLib\{D3103509-F6EC-4592-B5F2-FD862199D778}
  • HKEY_CLASSES_ROOT\Interface\{ED793078-C780-48D0-88B4-73750C76E93B}
  • HKEY_CLASSES_ROOT\Interface\{C0D7466A-B3EA-47BE-9A02-21880BD88F86}
  • HKEY_CLASSES_ROOT\Interface\{B57851EC-5A8C-40B9-A503-0821829F0612}
  • HKEY_CLASSES_ROOT\Interface\{B20C9258-CD4C-495B-BAF9-90D48AF40F1B}
  • HKEY_CLASSES_ROOT\Interface\{9F2DA855-4EC4-4718-AECF-5DB87DBB2DC2}
  • HKEY_CLASSES_ROOT\Interface\{9B3FD365-1ACE-4AE9-84F5-A116726108CD}
  • HKEY_CLASSES_ROOT\Interface\{8FD9BF62-1102-4B8B-B143-6DFA65A9B193}
  • HKEY_CLASSES_ROOT\Interface\{7C14774F-7491-41E4-A720-2A0B23B83F94}
  • HKEY_CLASSES_ROOT\Interface\{77B520FE-71D6-41A2-A765-A6FE25BEFDDB}
  • HKEY_CLASSES_ROOT\Interface\{71DC737F-9935-4E1D-A995-B50DD8EB5EE7}
  • HKEY_CLASSES_ROOT\Interface\{70CE2C9B-9727-4FEA-8CB0-462CD172E74C}
  • HKEY_CLASSES_ROOT\Interface\{335CA9F4-858F-42EB-B6F7-47A0FFA46481}
  • HKEY_CLASSES_ROOT\Interface\{2848A01C-6BE5-4854-B1BD-DFC30761291D}
  • HKEY_CLASSES_ROOT\Interface\{152D1D36-D0CD-41F4-A5A1-4D11ECC41177}
  • HKEY_CLASSES_ROOT\Interface\{14B07D86-9F52-424F-A5CB-C7DE0023E3C2}
  • HKEY_CLASSES_ROOT\Interface\{10D387E3-B30B-41FD-A0FF-1E464A901B53}
  • HKEY_CLASSES_ROOT\CLSID\{A5C70510-5A01-B2A5-CF84-D6DC13859967}
  • HKEY_CLASSES_ROOT\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5}
    "default"="MalwareWipe"
  • HKEY_CLASSES_ROOT\AppID\MalwareWipe.EXE

Network Impact

Possible increase in overhead bandwidth due to download of additional components or updates.

Symptoms

N/A This is not a virus or trojan.

Method of Infection

N/A This is not a virus or trojan.

Variants

Variants

    N/A

All Information

Overview -

This is a Potentially Unwanted Program (PUP) detection. It is not a virus or trojan. PUPs are any piece of software which a reasonably security-or privacy-minded computer user may want to be informed of.

Characteristics

Characteristics -

McAfee(R) AVERT recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application. If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software. Please contact the software vendor for further information.

See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.

Distribution

This is not a virus or a trojan. It is detected as a "potentially unwanted program". This is an anti-spyware application claiming to remove unwanted malicious spyware programs. It is known to be associated with some versions of the Puper Trojan which direct users to a website pushing Malwarewipe. In order to clean or delete any elements it finds, you must first enter a valid serial number to activate the full version or click on the “Buy Online” button and purchase the full version. The software also appears to be related to or possibly a re-branding of Adware-Spyaxe .

 

This application displays a license agreement when installed. The agreement appears to be a standard legal boilerplate and does not clearly indicate the functionality of the software. A copy of the EULA was not available on the malwarewipe.com website.

Privacy

A privacy policy is not displayed during installation. However, a policy can be accessed on the author's website: http://www.malwarewipe.com/privacy.php

System Changes

General defaults for typical path variables (although they may be different, they usually are not):
%WinDir% = \WINDOWS (Windows 9x/ME/XP), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM32 (Windows 9x/ME/XP), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

"*" - Denotes files that, though installed along with the software, are by themselves innocent and not included in detection.

Files Added

  • Installer: mw_install.exe (2736 KB)
    MD5: FAF52BE58AED45C9A41A008183CDE7F9
  • c:\program files\malwarewipe\uninst.exe (34 KB)
    MD5: 2AFEA8079479F0E2956E5498E230F68B
  • c:\program files\malwarewipe\msvcr71.dll* (340 KB)
  • c:\program files\malwarewipe\msvcp71.dll* (488 KB)
  • c:\program files\malwarewipe\malwarewipe.url (1 KB)
  • c:\program files\malwarewipe\malwarewipe.exe (1492 KB)
    MD5: 3BA90052438B45E78AC259205EC6C921
  • c:\program files\malwarewipe\db.dat (968 KB)
  • c:\program files\malwarewipe\lang\english.ini (31 KB)
  • c:\program files\malwarewipe\quarantine\
  • c:\documents and settings\administrator\start menu\programs\malwarewipe\uninstall malwarewipe 4.0.lnk (1 KB)
  • c:\documents and settings\administrator\start menu\programs\malwarewipe\malwarewipe 4.0.lnk (1 KB)
  • c:\documents and settings\administrator\start menu\programs\malwarewipe\malwarewipe 4.0 website.lnk (1 KB)
  • c:\documents and settings\administrator\start menu\malwarewipe 4.0.lnk (1 KB)
  • c:\documents and settings\administrator\desktop\malwarewipe.lnk (1 KB)
  • c:\documents and settings\administrator\application data\microsoft\internet explorer\quick launch\malwarewipe 4.0.lnk (1 KB)

Registry

The following registry keys are created:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \Uninstall\MalwareWipe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    "MalwareWipe"="C:\Program Files\MalwareWipe\MalwareWipe.exe /h"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \App Paths\MalwareWipe.exe
    "default"="C:\Program Files\MalwareWipe\MalwareWipe.exe"
  • HKEY_LOCAL_MACHINE\SOFTWARE\MalwareWipe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Licenses
  • HKEY_CLASSES_ROOT\TypeLib\{D3103509-F6EC-4592-B5F2-FD862199D778}
  • HKEY_CLASSES_ROOT\Interface\{ED793078-C780-48D0-88B4-73750C76E93B}
  • HKEY_CLASSES_ROOT\Interface\{C0D7466A-B3EA-47BE-9A02-21880BD88F86}
  • HKEY_CLASSES_ROOT\Interface\{B57851EC-5A8C-40B9-A503-0821829F0612}
  • HKEY_CLASSES_ROOT\Interface\{B20C9258-CD4C-495B-BAF9-90D48AF40F1B}
  • HKEY_CLASSES_ROOT\Interface\{9F2DA855-4EC4-4718-AECF-5DB87DBB2DC2}
  • HKEY_CLASSES_ROOT\Interface\{9B3FD365-1ACE-4AE9-84F5-A116726108CD}
  • HKEY_CLASSES_ROOT\Interface\{8FD9BF62-1102-4B8B-B143-6DFA65A9B193}
  • HKEY_CLASSES_ROOT\Interface\{7C14774F-7491-41E4-A720-2A0B23B83F94}
  • HKEY_CLASSES_ROOT\Interface\{77B520FE-71D6-41A2-A765-A6FE25BEFDDB}
  • HKEY_CLASSES_ROOT\Interface\{71DC737F-9935-4E1D-A995-B50DD8EB5EE7}
  • HKEY_CLASSES_ROOT\Interface\{70CE2C9B-9727-4FEA-8CB0-462CD172E74C}
  • HKEY_CLASSES_ROOT\Interface\{335CA9F4-858F-42EB-B6F7-47A0FFA46481}
  • HKEY_CLASSES_ROOT\Interface\{2848A01C-6BE5-4854-B1BD-DFC30761291D}
  • HKEY_CLASSES_ROOT\Interface\{152D1D36-D0CD-41F4-A5A1-4D11ECC41177}
  • HKEY_CLASSES_ROOT\Interface\{14B07D86-9F52-424F-A5CB-C7DE0023E3C2}
  • HKEY_CLASSES_ROOT\Interface\{10D387E3-B30B-41FD-A0FF-1E464A901B53}
  • HKEY_CLASSES_ROOT\CLSID\{A5C70510-5A01-B2A5-CF84-D6DC13859967}
  • HKEY_CLASSES_ROOT\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5}
    "default"="MalwareWipe"
  • HKEY_CLASSES_ROOT\AppID\MalwareWipe.EXE

Network Impact

Possible increase in overhead bandwidth due to download of additional components or updates.

Symptoms

Symptoms -

N/A This is not a virus or trojan.

Method of Infection

Method of Infection -

N/A This is not a virus or trojan.

Removal -

Removal -

Instructions on Enabling/Disabling Detection and Removal of Potentially Unwanted Programs

Variants

Variants -

    N/A