|
I promoted it a while back when it was like 10 cents a download.... I stopped promoting it because it's unfair to people downloading it. Its basically spyware. I downloaded it just to see what it was and I had to remove it because it was messing up my computer.
Here is what it is:
Behavior
Adware.Purityscan is an adware program that downloads and displays advertisements on your computer.
Symptoms
The files that are detected as Adware.Purityscan on your system.
An unusually large number of pop-up ads when browsing Web sites.
Transmission
This adware application needs to be manually installed. However, there are several known programs that have Adware.Purityscan inside of them and install it as the program itself is installed.
File names: rs.exe; winservn.exe; PuritySCAN.exe
Due to the self-updating nature of Adware.PurityScan, this information is liable to change as new versions of the Adware are published.
Upon execution, samples of Adware.PurityScan that we have seen perform the following actions:
Adds the value:
"Content Service"=%system%\winserv[letter].exe
to the registry key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run
or:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run
--------------------------------------------------------------------------------
Note: [letter] is a variable letter that will change for different versions of PuritySCAN. Samples we have seen will generally delete the old version before installing the updated one.
--------------------------------------------------------------------------------
Adds the registry keys:
HKEY_CURRENT_USER\software\purityscan
HKEY_LOCAL_MACHINE\Software\ClickSpring
HKEY_LOCAL_MACHINE\Software\Microsoft\Shared\Click Flag
Creates some or all of the following files:
%Program Files%\PurityScan\PuritySCAN.exe
%System%\Winserv[letter].exe
%System%\Winservn.exeps_uninstaller.exe
<Current folder>\Rs.exe
Creates a shortcut to PuritySCAN on the Windows desktop.
Contacts the remote server, clickspring.net, registers system information and the status of the installation with them, and then checks for software updates to install.
|