Your PC Protector

[Curson]

Your PC Protector est un rogue (faux anti-spyware) qui s'installe sans permission, le malware affiche de fausses alertes vous indiquant que vous êtes infecté par un spyware et vous recommande d'acheter ce faux anti-spyware pour soit disant désinfecter votre ordinateur.




Le dropper crée le service AdbUdp :

"Type"=dword:00000010
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"DisplayName"="Adobe Update Service"
"ImagePath"="C:\\Program Files\\svchost.exe"

Enregistrement d'une BHO portant le nom "ASC-AntiSpyware IEPlugin"

[{77DC0Baa-3235-4ba9-8BE8-aa9EB678FA02}\InprocServer32]
@="C:\\Program Files\\adc32.dll"
"ThreadingModel"="Apartment"

Chose plutôt rare, un poème etait fourni avec le dropper :

SHE walks in beauty, like the night
Of cloudless climes and starry skies;
And all that 's best of dark and bright
Meet in her aspect and her eyes:
Thus mellow'd to that tender light
Which heaven to gaudy day denies.
One shade the more, one ray the less,
Had half impair'd the nameless grace
Which waves in every raven tress,
Or softly lightens o'er her face;
Where thoughts serenely sweet express
How pure, how dear their dwelling-place.
And on that cheek, and o'er that brow,
So soft, so calm, yet eloquent,
The smiles that win, the tints that glow,
But tell of days in goodness spent,
A mind at peace with all below,
A heart whose love is innocent!