Name :	Adware:W32/Boran
Detection Names :	Adware.Win32.Boran
Aliases :	Adware.Borlan (Symantec) Adware_Boran (Trend Micro) Program:Win32/MMSAssist (Microsoft)
Category:	Spyware
Type:	Adware
Platform:	W32

This program delivers advertising content to the user. It is usually annoying but harmless, unless it is combined with spyware or trackware.

Adware:W32/Boran is an adware program that acts as a Browser Helper Object (BHO). While active, the program displays Chinese-language advertising contents.


Installation

Boran software is usually distributed bundled with other Chinese adware/spyware program, such as  MMSAssist, Webwork or Vision Communicate "Cai Xin Fa Song" (Pinyin).

Once downloaded onto the system, Boran software must be executed manually. Upon execution, it drops executable and configuration files at:


It may also create one or more of the following files:


Some variants may drop multiple component files and configuration files using a different path name and file name, for example:



Activity

While active, the adware checks Internet availability by contacting:


It then downloads advertising contents from:


And downloads configuration files and the latest cabinet files (CAB) by using the following URL pattern:



Registry

This adware installs as a service by adding the following registry subkey:


The ImagePath's value C:\WINDOWS\System32\rundll32.exe [Path to the component DLL file],Service -s indicates that the adware will be started automatically as a background process when Windows is started.

It may also create one or more of the following registery subkeys: