Jump to content
Sign in to follow this  
ky331

database 1351 detects Adobe Reader helper registry keys as adware

Recommended Posts

Malwarebytes' Anti-Malware 1.30

Database version: 1351

Windows 5.1.2600 Service Pack 3

11/1/2008 11:31:37 AM

Scan type: Quick Scan

Registry Keys Infected: 4

Registry Keys Infected:

HKEY_CLASSES_ROOT\acroiehelper.acroiehlprobj (Adware.Cinmus) -> No action taken.

HKEY_CLASSES_ROOT\acroiehelper.acroiehlprobj.1 (Adware.Cinmus) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{06849e9f-c8d7-4d59-b87d-784b7d6be0b3} (Adware.Cinmus) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{06849e9f-c8d7-4d59-b87d-784b7d6be0b3} (Adware.Cinmus) -> No action taken.

==================================

for the CLSID, see http://www.castlecops.com/tk82-AcroIEhelpe...helper_dll.html

Share this post


Link to post
Share on other sites

Same here, here is the developer log and the file in question

Malwarebytes' Anti-Malware 1.30

Database version: 1351

Windows 5.1.2600 Service Pack 2

11/01/2008 15:44:43

mbam-log-2008-11-01 (15-44-38).txt

Scan type: Quick Scan

Objects scanned: 68811

Time elapsed: 18 minute(s), 59 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 7

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\acroiehelper.acroiehlprobj (Adware.Cinmus) -> No action taken. [4054423730346988668370153674797886841301921723252126702671146825692414216922261

4672524691424252167246923677017672094]

HKEY_CLASSES_ROOT\TypeLib\{5f226421-415d-408d-9a09-0dcd94e25b48} (Adware.Cinmus) -> No action taken. [4054423730346988668370153674797886841301921723252126702671146825692414216922261

4672524691424252167246923677017672094]

HKEY_CLASSES_ROOT\Interface\{34a715a0-6587-11d0-924a-0020afc7ac4d} (Adware.Cinmus) -> No action taken. [4054423730346988668370153674797886841301921723252126702671146825692414216922261

4672524691424252167246923677017672094]

HKEY_CLASSES_ROOT\Interface\{6e67bcc1-d776-44bb-9dc8-c09f542c3cb6} (Adware.Cinmus) -> No action taken. [4054423730346988668370153674797886841301921723252126702671146825692414216922261

4672524691424252167246923677017672094]

HKEY_CLASSES_ROOT\CLSID\{06849e9f-c8d7-4d59-b87d-784b7d6be0b3} (Adware.Cinmus) -> No action taken. [4054423730346988668370153674797886841301921723252126702671146825692414216922261

4672524691424252167246923677017672094]

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{06849e9f-c8d7-4d59-b87d-784b7d6be0b3} (Adware.Cinmus) -> No action taken. [4054423730346988668370153674797886841301921723252126702671146825692414216922261

4672524691424252167246923677017672094]

HKEY_CLASSES_ROOT\acroiehelper.acroiehlprobj.1 (Adware.Cinmus) -> No action taken. [4054423730346988668370153674797886841301921723252126702671146825692414216922261

4672524691424252167246923677017672094]

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adware.Cinmus) -> No action taken. [4054423730346988668370153674797886841301921723252126702671146825692414216922261

4672524691424252167246923677017672094]

AcroIEHelper.zip

AcroIEHelper.zip

Share this post


Link to post
Share on other sites

I can't get rid of there 3 items either using Vista

Vista blocks the Mbam startup routine.

HKEY_CLASSES_ROOT\acroiehelper.acroiehlprobj (Adware.Cinmus) -> Delete on reboot.

HKEY_CLASSES_ROOT\acroiehelper.acroiehlprobj.1 (Adware.Cinmus) -> Delete on reboot.

HKEY_CLASSES_ROOT\CLSID\{06849e9f-c8d7-4d59-b87d-784b7d6be0b3} (Adware.Cinmus) -> Delete on reboot.

Share this post


Link to post
Share on other sites

Thanks, it sure is fixed now, WOW that was fast!

What about the other items it found, it was like 7 or 8. Those other items were delelted or removed before the fix

Only the 3 mentioned were not removed.

So are we now missing something from Adobe, or will thinks be ok?

Share this post


Link to post
Share on other sites
Thanks, it sure is fixed now, WOW that was fast!

What about the other items it found, it was like 7 or 8. Those other items were delelted or removed before the fix

Only the 3 mentioned were not removed.

So are we now missing something from Adobe, or will thinks be ok?

MBAM has very good component link detection and all it took was a single hit on a single component for all of that to be detected so it was easy to fix .

Share this post


Link to post
Share on other sites

Hi,

I got an error msg "Error Code 725 (5,0) when I tried to restore the FP for the following entry:

C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adware.Cinmus)

The 6 registry keys were restored. What do I do about the file?

Kay

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.