Topic: Adware-HistoryClean

[Clive]

This is not a virus or trojan. It is a direct-marketing adware application. This application generates extra pop-up ads while using Internet Explorer.

This application is currently bundled with a program called Free History Cleaner. Users agree to have the Adware installed in the license agreement, although they may not realize at first that this file was packaged with the product they installed.

Installation

Upon execution, the application installs itself into the %SysDir% directory using a random filename.

(Where %Sysdir% is the Windows System directory, for example C:\WINDOWS\SYSTEM)


For example:

c:\WINNT\system32\xflogt.exe

The following Registry key(s) is/are added to hook system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "xflogt" = C:\WINNT\System32\xflogt.exe
Another registry key is created to store program data:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Explorer\comms
Users who would like to check for the presence of potentially unwanted programs on their system should run the command line scanner with the /PROGRAM switch.

http://vil.nai.com/vil/content/v_100964.htm