Adware.Adstation

Behavior
Adware.Adstation is an adware program that displays pop-up advertisements.

Symptoms
One or more files are detected as Adware.Adstation

Transmission
The file must be manually executed to install this program.

technical details
File names: adstation.exe
adshook.dll

When Adware.Adstation runs, it performs the following actions:

1. Downloads configuration files and updates to itself from the www.2pari.co.kr domain.

2. Creates the folder %System%\adstation

Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

3. Creates the following files in the %System%\adstation folder:

* logo.bmp
* go.bmp
* icon.bmp
* menu.dat
* adshook.dll

4. Loads the file adshook.dll, which may monitor Web sites visited.

5. Creates the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\ADNCommunication\AdStation

6. Downloads and displays adware on the compromised computer.

To delete the value from the registry

1. Click Start > Run.
2. Type regedit

Then click OK.

Note: If the registry editor fails to open the risk may have modified the registry to prevent access to the registry editor. Security Response has developed a tool to resolve this problem. Download and run this tool, and then continue with the removal.

3. Navigate to and delete the subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\ADNCommunication\AdStation

4. Exit the Registry Editor.