Summary
Summary
More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | May 2008 (4.29) |
| Protection available since | 28 August 2007 09:35:14 (GMT) |
| Last updated | 26 March 2008 22:49:24 (GMT) |
| Detected by | Sophos Anti-Virus for Windows, versions 6 and 7 and PureMessage for Microsoft Exchange. |
More Information
- Summary
- More Information
WebRebates is an adware application which displays advertisements when the browser is active.
WebRebates runs continuously in the background and contains functionality to prevent termination of its processes.
WebRebates may be installed as part of the installation for other software, such as adware-supported shareware or freeware applications, including certain versions of the 'Super Smileys' application.
The default installation folders for WebRebates is usually one of the following:
<Program Files>\Web_Rebates
<Program Files>\Web_Cpr
When WebRebates is installed the following folders and files may be created:
<Temp>\djtopr1150.exe
<Temp>\jkill.exe
<Temp>\ig.exe
<Program Files>\Web_Rebates\
<Program Files>\Web_Rebates\disp1150.exe
<Program Files>\Web_Rebates\WebRebates0.exe
<Program Files>\Web_Rebates\WebRebates1.exe
<Program Files>\Web_Rebates\WebRebates2.dll
<Program Files>\Web_Rebates\WebRebates2.exe
<Program Files>\Web_Rebates\Ap1150\
<Program Files>\Web_Rebates\Da1150\
<Program Files>\Web_Rebates\Sy1150\
<Program Files>\Web_Cpr\disp2000.exe
<Program Files>\Web_Cpr\WebCpr0.exe
<Program Files>\Web_Cpr\WebCpr1.exe
<Program Files>\Web_Cpr\Ap2000\
<Program Files>\Web_Cpr\Da2000\
<Program Files>\Web_Cpr\Sy2000\
<Program Files>\WebRebates4\
<Program Files>\WebRebates4\w11150.exe
<Program Files>\WebRebates4\webrebates.dll
<Program Files>\WebRebates4\webrebates.exe
<Program Files>\WebRebates4\webrebates2.dll
<Program Files>\WebRebates4\webarebates\
<Program Files>\WebRebates4\websrebates\Html\
<Program Files>\WebRebates4\websrebates\Images\
<Program Files>\WebRebates4\websrebates\websrebates\
jkill.exe is a simple command-line utility for Windows that can be used to kill processes.
Registry entries are created at the following locations to run some of the dropped components on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Registry entries may be created under:
HKCU\Software\Microsoft\Internet Explorer\MenuExt\Web Rebates\
HKCU\Software\Microsoft\Internet Explorer\MenuExt\Web Rebates.\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\untopr1150\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\untopr11150\
WebRebates usually provides an uninstall option which can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is typically listed as "WebRebates (by TopRebates.com)" or "Web CPR".
|
