virus logo Virus

Adware/BetterInet

description-logoAnalysis

This Adware is a utility that downloads files and "upgrades" software. The files are commonly retrieved from these web sites -
www.abetterinternet.com
download.abetterinternet.com
The executable programs initially connect to 'thinstall.abetterinternet.com' to download additional files. The following files are secretly downloaded and detected as follows:
Ceres.cab => Adware/Betterinternet
Csnopol.cab => Adware/Betterinternet
Polau2c.exe => Download/Agent.AY
Farmmext.exe => Download/Stubby.C
After downloading, the Cab files are installed in the system and the exe programs are copied into the System32 directory. These exe files, Farmmext.exe and Ceres.DLL (from Ceres.cab), are hooked up into the registry to execute whenever the system is started.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrenVersion\Run

recommended-action-logoRecommended Action

    FortiGate systems:
  • check the main screen using the web interface to ensure the latest AV/NIDS database has been downloaded and installed -- if required, enable the "Allow Push Update" option
  • Enable the URL blocking feature, and add these URLs to the list -
    www.abetterinternet.com
    download.abetterinternet.com
    thinstall.abetterinternet.com

Telemetry logoTelemetry

ID 320977
Released Sep 14, 2004
Description
Updated		 Feb 23, 2005
Aliases Adware/Binet
Platform Profile Adware typically display advertising content to the user. This advertising content may take many forms, but is typically in the form of web browser pop-up advertisements. In most circumstances, the user is not aware of the Adware component being installed on the local machine.