Application.CorruptedNSIS Description

Application.CorruptedNSIS is an adware program that displays potentially unwanted advertisements on a user’s computer. Application.CorruptedNSIS may register itself as a Browser Help Object or come bundled with other malware. Application.CorruptedNSIS may display adverts in the form of pop-ups, banners, etc. Application.CorruptedNSIS can be uninstalled with a computer security tool or manually.

Type: Adware

Aliases: not-a-virus:AdWare.Win32.Cinmus.bhzf (Kaspersky Lab), Adware-Cinmus!n (McAfee).

How Can You Detect Application.CorruptedNSIS?

Application.CorruptedNSIS Technical Report

As new Application.CorruptedNSIS details are reported by our customers and findings from our Threat Research Center, we will update this section.

Application.CorruptedNSIS’s Country of Origin:

• China

Application.CorruptedNSIS has typically the following processes in memory:

• %ProgramFiles%\Common Files\PushWare\cpush.dll
• %ProgramFiles%\Common Files\PushWare\cpush0.dll
• %ProgramFiles%\Common Files\PushWare\Uninst.exe

Application.CorruptedNSIS creates the following registry entries:

• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\ProgID]
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}\TypeLib]
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\TypeLib]
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}]
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\VersionIndependentProgID]
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\InprocServer32]
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}\ProxyStubClsid32]

Important Article Disclaimer