Content

Adware-Cinmus.gen.t

Type
Program
SubType
Generic
Discovery Date
09/03/2009
Minimum DAT
5730 (09/03/2009)
Updated DAT
5812 (11/24/2009)
Minimum Engine
5.2.00
Description Added
09/03/2009
Description Modified
07/06/2010 11:25 AM (PT)

Tab Navigation

Characteristics

This software is not a virus or a Trojan. It is detected as a "potentially unwanted program" (PUP). PUPs are any piece of software that a reasonably security- or privacy-minded computer user may want to be informed of and, in some cases, remove. PUPs are often made by a legitimate corporate entity for some beneficial purpose, but they alter the security state of the computer on which they are installed, or the privacy posture of the user of the system, such that most users will want to be aware of them.

Adware.Cinmus is an adware program that uses a Browser Helper Object which produces pop-up advertisements at random intervals.

File Information –
  • MD5 : 345EBDF80B3EEF0F49D0AEFD06DBB007
  • SHA1 : 9019F2AE987D27CB84A294DFD4C85B69468534E8

Aliases-
  • Kaspersky: not-a-virus:AdWare.Win32.Cinmus.brmu
  • Microsoft: Trojan:Win32/Cinmus.O
  • Avira: ADSPY/Cinmus.brmu

Characteristics -

Upon execution, the following registry keys have been added to the system:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\InProcServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\TypeLib
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}

The following registry values have been added to the system:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\InProcServer32]
    Default="%userprofile%\Desktop\game.dll"
    ThreadingModel="Apartment"

The above mentioned registry confirms that the "game.dll" is run whenever a CLSID is called.

The following file has been modified:
  • %WinDir%\system.ini

Also it creates the following network connection(s):
  • login.zu[removed]ian.com

To mark the presence in the system, the following Mutex objects have been created

  • IEHelper2ConfFileSymbole
  • mtx_064E2BA0A6F0

[Where %WinDir% is the Windows Directory - for example c:\windows, %userprofile% - C:\Documents and Settings\[UserName]

Symptoms -
  • Presence of above mentioned file and registry keys.
  • Presence of unexpected network connection to the above mentioned IP address.

Method of Infection -

This is not a virus or Trojan. PUPs do not "infect" systems. They may be installed by a user individually or possibly as a part of a software package (in a bundle, for example).

Removal

AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

Additional Windows ME/XP removal considerations

Aliases

Aliases

    N/A