Content

Adware-Cinmus.gen.t

Type
Program
SubType
Generic
Discovery Date
09/03/2009
Minimum DAT
5730 (09/03/2009)
Updated DAT
5812 (11/24/2009)
Minimum Engine
5.2.00
Description Added
09/03/2009
Description Modified
07/06/2010 11:25 AM (PT)

Tab Navigation

Characteristics

This software is not a virus or a Trojan. It is detected as a "potentially unwanted program" (PUP). PUPs are any piece of software that a reasonably security- or privacy-minded computer user may want to be informed of and, in some cases, remove. PUPs are often made by a legitimate corporate entity for some beneficial purpose, but they alter the security state of the computer on which they are installed, or the privacy posture of the user of the system, such that most users will want to be aware of them.

Adware.Cinmus is an adware program that uses a Browser Helper Object which produces pop-up advertisements at random intervals.

File Information –
  • MD5 : 345EBDF80B3EEF0F49D0AEFD06DBB007
  • SHA1 : 9019F2AE987D27CB84A294DFD4C85B69468534E8

Aliases-
  • Kaspersky: not-a-virus:AdWare.Win32.Cinmus.brmu
  • Microsoft: Trojan:Win32/Cinmus.O
  • Avira: ADSPY/Cinmus.brmu

Characteristics -

Upon execution, the following registry keys have been added to the system:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\InProcServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\TypeLib
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}

The following registry values have been added to the system:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\InProcServer32]
    Default="%userprofile%\Desktop\game.dll"
    ThreadingModel="Apartment"

The above mentioned registry confirms that the "game.dll" is run whenever a CLSID is called.

The following file has been modified:
  • %WinDir%\system.ini

Also it creates the following network connection(s):
  • login.zu[removed]ian.com

To mark the presence in the system, the following Mutex objects have been created

  • IEHelper2ConfFileSymbole
  • mtx_064E2BA0A6F0

[Where %WinDir% is the Windows Directory - for example c:\windows, %userprofile% - C:\Documents and Settings\[UserName]

Symptoms -
  • Presence of above mentioned file and registry keys.
  • Presence of unexpected network connection to the above mentioned IP address.

Method of Infection -

This is not a virus or Trojan. PUPs do not "infect" systems. They may be installed by a user individually or possibly as a part of a software package (in a bundle, for example).

Removal

All Users:

Please use the following instructions for all supported versions of Windows to remove threats and other potential risks:

1.Disable System Restore (Windows ME/XP only).

2.Update to current engine and DAT files for detection and removal.

3.Run a complete system scan.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

General repair may be unsuccessful in some instances. If this occurs, please submit a sample for further evaluation.

Aliases

Aliases

    N/A