Adware.Appoli

Behavior
Adware.Appoli is an adware component that downloads and displays advertisements.

Symptoms
Displays pop-up advertisements when browsing using Microsoft Internet Explorer. Your Symantec program detects Adware.Appoli.

Transmission
This adware is installed manually.

technical details
File names: varies

When Adware.Appoli is executed, it performs the following actions:

1. Creates the following file:

* %System%\[random filename].dll.

Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

2. Creates the following registry keys:

HKEY_CLASSES_ROOT\Appolinaria.Media
HKEY_CLASSES_ROOT\CLSID\{1AA8D727-B537-479B-A284-054ECAEBB01B}
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{88CC91DE-5930-45AD-9E04-6B1233609FEA}
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{FC7E0260-A046-4613-9FD8-1D52EBE22448}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{88CC91DE-5930-45AD-9E04-6B1233609FEA}

3. Displays pop-up advertisements in Internet Explorer.

REMOVAL INSTRUCTIONS
See: http://securityresponse.symantec.com/avcenter/venc/data/adware.appoli.html

To delete the value from the registry
1. Click Start > Run.
2. Type regedit

Then click OK.

3. Navigate to and delete the following registry entries:

HKEY_CLASSES_ROOT\Appolinaria.Media
HKEY_CLASSES_ROOT\CLSID\{1AA8D727-B537-479B-A284-054ECAEBB01B}
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{88CC91DE-5930-45AD-9E04-6B1233609FEA}
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{FC7E0260-A046-4613-9FD8-1D52EBE22448}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{88CC91DE-5930-45AD-9E04-6B1233609FEA}

4. Exit the Registry Editor.