|
Type Adware Name Zeno Browser Enhancer Publisher www.zenotecnico.com Risk Impact Medium File Names dwdsregt.exe Systems Affected Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP Zeno Adware Behavior Adware.ZenoSearch is an adware that displays pop-up ads based on searches the user performs on popular web search engines. Zeno Adware Symptoms Pop-up ads Zeno Adware Transmission The Adware.ZenoSearch program must be executed. When Adware.ZenoSearch is executed, it performs the following actions: Adds the values: "SysStart" = "[PATH TO ADWARE]\[ADWARE FILENAME]" "{1C-CC-C5-54-ZN}" = "c:\windows\system32\dwdsregt.exe FI002" to the registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run so that it runs everytime Windows starts. Adds the values: "DisplayName" = "Zeno Browser Enhancer removal" "UninstallString" = "[PATH TO ADWARE]\[ADWARE FILENAME] -UPop" to the registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zeno Browser Enhancer Creates the file: %UserProfile%\Start Menu\Programs\Startup\Zeno.lnk so that it runs at startup. Note: %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\[CURRENT USER] (Windows NT/2000/XP). Creates the harmless text file %System%\zxdnt3d.cfg. Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP). Displays pop-up ads based on keywords the user searches for on the following web search engines: search.lycos.com www.hotbot.com search.information.com www.overture.com mysearch.myway.com web.ask.com search.aol.com search.msn.com yahoo.com google.com Remove Zeno Adware Manually Run Regedit and search for these: qwdxrego.exe ssysyq2r.exe Remove the two entries that show up. Then open C:\winnt\system32 (or c:\windows\system32) and remove the two files there as well. You’ll also find a shortcut labeled Zeno (or zeno.lnk, including the extension) in your startup directory. Delete that too. Restart. NOTE: Information regarding virus/adware removal are provided for educational purposes only, we have not verified this information and it is provided as-is. Copyright © 2006 by www.free-adware-spyware-virus-removal.com - All Rights Reserved No part of this article may be copied, or reproduced without express written permission. |