Adware.AUNPS

[Brad]

Behavior
Adware.AUNPS is an adware program that displays advertisements in Internet Explorer windows at regular intervals of time.

Symptoms
Unexpected advertisements appear in Internet Explorer browser windows.

Transmission
This security risk can be installed as part of another program.

technical details
File names:
InstallAPS.exe
AUNPS2.DLL

When Adware.AUNPS is executed, it performs the following actions:

   1. Creates the file %System%\AUNPS2.dll.

      Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

   2. Adds the value:

      "AUNPS2" = "RUNDLL32 AUNPS2.DLL,_Run@16"

      to the registry subkey:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

      so that the risk runs every time Windows starts.

   3. Displays pop-up advertisements in Internet Explorer windows at regular intervals of time.

To delete the value from the registry
   1. Click Start > Run.
   2. Type regedit

      Then click OK.

      Note: If the registry editor fails to open the risk may have modified the registry to prevent access to the registry editor. Security Response has developed a tool to resolve this problem. Download and run this tool, http://securityresponse.symantec.com/avcenter/venc/data/tool.to.reset.shellopencommand.registry.keys.html and then continue with the removal.

   3. Navigate to the subkey:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

   4. In the right pane, delete the value:

      "AUNPS2" = "RUNDLL32 AUNPS2.DLL,_Run@16"

   5. Exit the Registry Editor.