Home / malware

PDF

Adware:Win32/AdClickCF

First posted on 12 March 2013.
Source: Microsoft

Aliases :

Adware:Win32/AdClickCF is also known as Trojan/Win32.Pasta (AhnLab), Trojan.Win32.Pasta.txt (Kaspersky), Win32/RiskWare.AdClickCF.A application (ESET).

Explanation :

Installation

Adware:Win32/AdClickCF is a program whose website is "c.onehitcf.com". However, it might display advertisements from other websites.

When run, Adware:Win32/AdClickCF looks for its DLL component which is named "ohcf.dat", that is usually bundled with the executable file "OneHit.exe", which is contained within a ZIP archive.

If it doesn't find the component, Adware:Win32/AdClickCF displays pop-up ads such as the following:





If you click "OK", it redirects you to ads such as the following:









If it finds the component, Adware:Win32/AdClickCF displays the following messages:





If you click "Exit here", Adware:Win32/AdClickCF redirects to the following webpage:





Analysis by Wei Li

Last update 12 March 2013

 

TOP