Home / malware

PDF

Program:Win32/Ircfast

First posted on 01 June 2010.
Source: SecurityHome

Aliases :

Program:Win32/Ircfast is also known as not-a-virus:AdWare.Win32.FakeInstaller.afc (Kaspersky), AdWare.Downloader.C (BitDefender), Win32/DreamGroup_i (CA), Win32/Downloader.Ircfast (ESET), Trojan.Win32.StartPage.fwo (Rising AV), AdWare.Win32.FakeInstaller.afc (Sunbelt Software), TROJ_STARTPA.TV (Trend Micro).

Explanation :

Program:Win32/Ircfast is a potentially unwanted application that arrives as a packaged installer. It drops several shortcuts on the desktop and bookmarks these. The shortcuts and bookmarks direct the user to predefined URLs promoting other unwanted applications.
Top

Program:Win32/Ircfast is a potentially unwanted application that arrives as a packaged installer. When installed, it may display the following interface: It drops several shortcuts on the desktop and bookmarks these. The shortcuts and bookmarks direct the user to predefined URLs promoting other unwanted applications. These may have the following names:

<Desktop>\Juegos.url

<Desktop>\Traductor.url

<Desktop>\Videos.url

<Desktop>\Descargar programas.url

It modifies the Internet Explorer home page to the following: Modifies value: "Start Page"With data: "http://descargar.mp3.es/index.php?rvs=hompag" or "http://spanish.ircfast.com/index.php?rvs=hompag"In subkey: HKCU\Software\Microsoft\Internet Explorer\Main

Analysis by Marianne Mallen

Last update 01 June 2010

 

TOP