Threat Database Adware Adware.Adposhel.FB

Adware.Adposhel.FB

By CagedTech in Adware

Threat Scorecard

Ranking: 12,327
Threat Level: 20 % (Normal)
Infected Computers: 2,081
First Seen: June 16, 2019
Last Seen: September 9, 2023
OS(es) Affected: Windows

Adware.Adposhel.FB is a heuristic detection, made with the intent to generically detect Potentially Unwanted Programs. Potentially Unwanted Programs may install toolbars, may act with unclear objectives and it may even contain adware.

Whenever Adware.Adposhel.FB is present in a system, users may notice the following behavior:

  • Random web page text being turned into hyperlinks.
  • The default home page of their browser is changed.
  • Advertising banners may be injected into any visited websites.
  • Changes to the browser's default search provider and the search box.
  • Browser popups with fake updates and other unsolicited software.
  • Unwanted adware programs may be installed on the computer without the user's consent.

The following behavior may indicate the presence of this threat on your computer (Seeing files with names such as the following):

%ProgramData%\db219601\ffc52abc.dll
%ProgramData%\dns unlocker\consoleapplication1.dll
%ProgramData%\dns unlocker\unins000.dat
%ProgramData%\\dns unlocker\unins000.exe
%TEMP%\is-r1q9h.tmp\_isetup\_shfoldr.dll
%TEMP%\is-r1q9h.tmp\consoleapplication1.dll
%TEMP%\13336722.t.exe

Users may notice modifications to the system registry such as:

In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{db219601}
Sets value: "0"
With data: "cs5wvtuei6xoywhtikq07ceip_nxzpka2f0vwxaxsftrwtdrlqwtcmvyq8ooexwcsxhyfrfa4q"

In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{db219601}
Sets value: "1"
With data: "0x56e05a00"

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E1527582-8509-4011-B922-29E3FB548882}_is1
Sets value: "DisplayName"
With data: "dns unlocker version 1.4"

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E1527582-8509-4011-B922-29E3FB548882}_is1
Sets value: "DisplayVersion"
With data: "1.4"

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E1527582-8509-4011-B922-29E3FB548882}_is1
Sets value: "Inno Setup: App Path"
With data: "%ProgramFiles%\dns unlocker"

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E1527582-8509-4011-B922-29E3FB548882}_is1
Sets value: "Inno Setup: Icon Group"
With data: "dns unlocker"

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E1527582-8509-4011-B922-29E3FB548882}_is1
Sets value: "Inno Setup: Language"
With data: "english"

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E1527582-8509-4011-B922-29E3FB548882}_is1
Sets value: "Inno Setup: Setup Version"
With data: "5.5.5 (a)"

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E1527582-8509-4011-B922-29E3FB548882}_is1
Sets value: "Inno Setup: User"
With data: "administrator"

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E1527582-8509-4011-B922-29E3FB548882}_is1
Sets value: "InstallLocation"
With data: "%ProgramFiles%\dns unlocker\"

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E1527582-8509-4011-B922-29E3FB548882}_is1
Sets value: "Publisher"
With data: "www.dnsunlocker.com"

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E1527582-8509-4011-B922-29E3FB548882}_is1
Sets value: "QuietUninstallString"
With data: ""%ProgramFiles%\dns unlocker\unins000.exe" /silent"

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E1527582-8509-4011-B922-29E3FB548882}_is1
Sets value: "UninstallString"
With data: ""%ProgramFiles%\dns unlocker\unins000.exe""

In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\11598763487076930564
Sets value: "0"
With data: "0x00000001"

In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\6e9e32b9a6539227
Sets value: "0"
With data: "m8nespl_eg7h94q4u_cp-9atphabtycrzi87b0gicrk_3j17rfwlgncr26cheieuoywu8us76rouo3x3jjxnseiofknzllqjvwz5ci-u8dhnpnyc_isa5_8hwvbps0wps27rohzh5wo6gm8cp7t2qh3wikyqko_sbyfo92kwu5nwndvjvqwus_he3o1pjbfdu2o4fonzoeoh2i7nhie2ehbjnxj5vwuocneiuh613uxmoglxwmjgkdgax4tjoo02xwxkfrlltcgnkojkl6zwy9cw43dd8j76ex1pgonet20o1c3hfkkrqkxkrvz3qyozgaidleadyeoh2nyoljk2fbbjqpmt6kkxhadzpr6fhm-rqkon1nseyxztakv5adrgrzycbsh8pnpizjo_1w9ek8p5wrr3j2ex-l_mzuizg3hyyes3ykeqjpwk6d7cgxi2fb"

In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\6e9e32b9a6539227
Sets value: "1"
With data: "dhvlx___efocwaxasgphyuvs0dip"

In subkey: HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C9421E55-F44A-4C6B-86B6-B92631FCBBCD}
Sets value: "DHCPNameServer"
With data: "82.163.143.171"

In subkey: HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C9421E55-F44A-4C6B-86B6-B92631FCBBCD}
Sets value: "NameServer"
With data: "82.163.143.171 82.163.142.173"

In subkey: HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
Sets value: "DHCPNameServer"
With data: "82.163.143.171"

In subkey: HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
Sets value: "NameServer"
With data: "82.163.143.171 82.163.142.173"

Trending

Most Viewed

Loading...