This program delivers advertising content to the user. It is usually annoying but harmless, unless it is combined with spyware or trackware.
Based on the settings of your F-Secure security product, it may block the file from running, move it to the quarantine where it cannot spread or cause harm, or ask you to select an action.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Adware:W32/Boran is an adware program that acts as a Browser Helper Object (BHO). While active, the program displays Chinese-language advertising contents.
Boran software is usually distributed bundled with other Chinese adware/spyware program, such as& MMSAssist, Webwork or Vision Communicate "Cai Xin Fa Song" (Pinyin).
Once downloaded onto the system, Boran software must be executed manually. Upon execution, it drops executable and configuration files at:
It may also create one or more of the following files:
Some variants may drop multiple component files and configuration files using a different path name and file name, for example:
While active, the adware checks Internet availability by contacting:
It then downloads advertising contents from:
And downloads configuration files and the latest cabinet files (CAB) by using the following URL pattern:
This adware installs as a service by adding the following registry subkey:
The ImagePath's value C:\WINDOWS\System32\rundll32.exe [Path to the component DLL file],Service -sindicates that the adware will be started automatically as a background process when Windows is started.
It may also create one or more of the following registery subkeys: