Is the American.exe file from Americangreetingz.cc a threat?

SUMMARY

You received an email message from the Web site www.americangreetingz.cc. The message had the attachment American.exe, and you want to know if it is a virus.

CAUTION: The information in this document is based on a sample file named American.exe that was received as an email attachment from the mentioned Web site. You should never attempt to determine the safety of a file based only on the file name. If you are uncertain about the safety of a file that you received by email, if you do not know the sender, or you did not request it, we recommend that you delete the email without opening the attachment.

If you do not want to delete the email message, you should:

1. Run LiveUpdate to make sure that you have the most recent virus definitions.
2. Start Norton AntiVirus (NAV), and run a full system scan. Be sure that NAV is configured to scan all files.

Details:
The Web site www.americangreetingz.cc, from which the email message in question originated, has been shut down. The following message was posted on the site as of August 17, 2001:

"The domain AMERICANGREETINGZ.CC has been placed on hold by the Registry for violation of our ZERO TOLERANCE policy on spam and will not be reactivated."

An investigation by SARC, based on an analysis of the sample that was received, has determined the following:

The site has been spamming Internet users with their program. This program arrives as the email attachment American.exe. This file is a installer program. When executed, it creates the file:

WindowsAdshow.exe

When Adshow.exe is run, it changes your Internet Explorer home page to one of the following:

• www.krankin.com
• www.loveadot.com (This site is no longer active.)

It also creates the files:

• WindowsSystemRegSet32.ocx (This is needed to run Adshow.exe.)
• WindowsTempirsetup.exe

The Win.ini file is modified to run Adshow.exe when Windows starts.

NOTE: Some variants of the American.exe (the installer program) create GBV.exe on the Windows desktop.

These files are not malicious, and are apparently a form of "adware." Because the files are not a threat, Norton AntiVirus will not detect them as such.

Removal:
This is an adware program, and the files are not infectious. If you want to remove this program, follow these steps:

1. Using Windows Explorer, locate and delete the following files (if they exist):
   • WindowsAdshow.exe
   • WindowsSystemRegSet32.ocx
   • WindowsTempirsetup.exe
   • <Windows desktop>Gbv.exe
   • <Email attachment or saved file> American.exe
2. Delete any email from Americangreetingz.cc.
3. Use an editor, such as Sysedit, to edit the Win.ini file and remove the reference to Adshow.exe if it exists.
4. Start Internet Explorer, and change the home page to one of your choice.