ADW_ADSTAT.A
Discovery Date: Jan 31, 2005
Description & Threat Type: Adware
Systems Affected: Windows 95, 98, ME, NT, 2000, and XP.
This adware may come from freeware bundled packages. Upon execution it creates the folder Windows AdStatus in the Windows program files directory. It drops the following files in its created folder:
* Info.txt
* WinStat.exe
* WinStatComm.dll
* WinStatKeep.exe
It also creates the following registry entry so that it runs at Windows startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\Run
Windows AdStatus = "C:\Program Files\Windows AdStatus\WinStat.exe"
It also creates the following registry entries:
HKEY_LOCAL_MACHINE\Software\
Windows AdStatus
HKEY_LOCAL_MACHINE\Software\Microsoft>Windows>CurrentVersion >Uninstall
Windows AdStatus
Solution:
TREND MICRO SOLUTION
* Minimum scan engine version needed: 7.100
TMAPTN version needed: 214.13
* DCE version needed: 3.8
TMADCE version needed: 148.02
MANUAL REMOVAL INSTRUCTIONS
Using the Grayware Uninstall Option
To remove this grayware program using its uninstall option, do the following:
1. Click Start>Settings>Control Panel.
2. Double-click on Add/Remove Programs.
3. In the displayed list, choose the following program:
Windows Adstatus
4. Click on Change/Remove.
5. Follow the instructions on the dialog box that appears.
6. Close the Add/Remove Programs window, and the Control Panel window.
Identifying the Grayware Program
Download the latest grayware pattern file and scan your system. Note all files detected as ADW_ADSTAT.A.
Terminating the Grayware Program
This procedure terminates the running grayware process. You will need the name(s) of the file(s) detected earlier.
1. Open Windows Task Manager.
» On Windows 95, 98, and ME, press
CTRL+ALT+DELETE
» On Windows NT, 2000, and XP, press
CTRL+SHIFT+ESC, then click the Processes tab.
2. In the list of running programs*, locate the grayware file(s) detected earlier.
3. Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your system.
4. Do the same for all detected grayware files in the list of running processes.
5. To check if the grayware process has been terminated, close Task Manager, and then open it again.
6. Close Task Manager.
*NOTE: On systems running Windows 95, 98, and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the grayware process. Otherwise, continue with the next procedure, noting additional instructions.
Removing Grayware Entries from the Registry
1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry:
Windows AdStatus = "C:\Program Files\Windows AdStatus\WinStat.exe"
4. In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>
5. In the right panel, locate and delete the entry:
Windows AdStatus
6. In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Uninstall
7. In the right panel, locate and delete the entry:
Windows AdStatus
8. Close Registry Editor.
NOTE: If you were not able to terminate the grayware process as described in the previous procedure, restart your system.
Additional Windows ME/XP Cleaning Instructions
Users running Windows ME and XP must disable System Restore to allow full scanning of infected systems.
Users running other Windows versions can proceed with the succeeding procedure set(s).
Running Trend Micro Antivirus
Download and unzip the latest grayware pattern file and scan your system. Then, delete all files detected as ADW_ADSTAT.A.
(Copy of the original TREND MICRO Site) For more information read here: ADW_ADSTAT.A
AW: Windows AdStatus (Adware)
