Symantec Security Response

http://www.symantec.com/security_response/index.jsp

Adware.Websearch

Updated: February 13, 2007 11:35:02 AM
Type: Adware
Publisher: IBIS LLC
Risk Impact: Low
File Names: common.dll IExploreSkins.exe PIB.exe QDow_AS2.dll setupex.exe TBPS.exe toolbar.dll WSG.exe
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

SUMMARY

Behavior


Adware.Websearch is an adware component that modifies Internet Explorer's default home page and search settings. It adds a toolbar to Internet Explorer and a number of icons to the system tray. It also sends user information to a predetermined Web site, including keywords from searches.

Note: Detections prior to March 21, 2005 may detect this security risk as Adware.Huntbar or Adware.Huntbar.B .

Symptoms


The files on the computer are detected as Adware.Websearch.

Transmission


This adware component can be manually installed or installed as a component of another program.

Protection

  • Initial Rapid Release version October 15, 2003
  • Latest Rapid Release version November 7, 2009 revision 033
  • Initial Daily Certified version October 15, 2003 revision 004
  • Latest Daily Certified version November 8, 2009 revision 002
  • Initial Weekly Certified release date October 15, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

TECHNICAL DETAILS


When Adware.Websearch is executed, it performs the following actions:
  1. May create the following registry entries, each of which may contain multiple subkeys:

    HKEY_CLASSES_ROOT\CLSID\{0A68C5A2-64AE-4415-88A2-6542304A4745}
    HKEY_CLASSES_ROOT\CLSID\{310CC549-4541-46A9-940F-52B342A6E682}
    HKEY_CLASSES_ROOT\CLSID\{339BB23F-A864-48C0-A59F-29EA915965EC}
    HKEY_CLASSES_ROOT\CLSID\{69357D4E-BF4D-4651-91E9-52ECD45A0128}
    HKEY_CLASSES_ROOT\CLSID\{6E21F428-5617-47F7-AED8-B2E1D8FBA711}
    HKEY_CLASSES_ROOT\CLSID\{708BE496-E202-497B-BC31-9CF47E3BF8D6}
    HKEY_CLASSES_ROOT\CLSID\{87067F04-DE4C-4688-BC3C-4FCF39D609E7}
    HKEY_CLASSES_ROOT\CLSID\{87766247-311C-43B4-8499-3D5FEC94A183}
    HKEY_CLASSES_ROOT\CLSID\{8952A998-1E7E-4716-B23D-3DBE03910972}
    HKEY_CLASSES_ROOT\CLSID\{8A05273A-2EA5-42DE-AA75-59EA7D9D50D7}
    HKEY_CLASSES_ROOT\CLSID\{8B0FA130-0C3D-4CB1-AEB7-2C29DA5509A3}
    HKEY_CLASSES_ROOT\CLSID\{A8DEB4A5-D9EF-4D21-B4F6-921475004E7D}
    HKEY_CLASSES_ROOT\CLSID\{BBF122A7-8A4D-45B5-9E00-0F68BC87C904}
    HKEY_CLASSES_ROOT\CLSID\{CABCF5E7-0C79-4F1C-909D-B9CF68FED746}
    HKEY_CLASSES_ROOT\CLSID\{CAE0999F-78C5-49DC-9F30-13142AAAABA4}
    HKEY_CLASSES_ROOT\CLSID\{F1616B86-9288-489D-B71A-0CCF2F1A89DA}
    HKEY_CLASSES_ROOT\CLSID\{FB45C451-B0E9-4407-BB6A-9361013F3E9A}
    HKEY_CLASSES_ROOT\CLSID\{FF76A5DA-6158-4439-99FF-EDC1B3FE100C}
    HKEY_CLASSES_ROOT\TypeLib\{37AC49E3-E906-4BD8-AE83-D0F7FB48FD17}
    HKEY_CLASSES_ROOT\TypeLib\{8992B6CA-B8C9-4AED-BF89-0A17F6296A06}
    HKEY_CLASSES_ROOT\TypeLib\{B23B3ADD-84B1-414A-92B9-0CABE5A781F4}
    HKEY_CLASSES_ROOT\TypeLib\{D8BD4DED-5BB2-4D4E-9A6A-F10244FED7D6}
    HKEY_CLASSES_ROOT\TypeLib\{DB9A4E78-35DF-4A54-B6C5-C5190CEAF949}
    HKEY_CLASSES_ROOT\Interface\{234F09FB-FE89-4C6D-9203-31832FC051C3}
    HKEY_CLASSES_ROOT\Interface\{365B9A54-E613-46E5-9DB1-4F91A9DE80BD}
    HKEY_CLASSES_ROOT\Interface\{618BE527-B7F5-417C-BC51-98FDC2D6DE61}
    HKEY_CLASSES_ROOT\Interface\{66C22569-F05C-4A70-A142-763B337E1002}
    HKEY_CLASSES_ROOT\Interface\{7B8BD940-B1EF-460C-85A2-9ACAAF7F9303}
    HKEY_CLASSES_ROOT\Interface\{99AA88D1-D9D3-410A-BE9E-044F94C183DA}
    HKEY_CLASSES_ROOT\Interface\{BD6F129A-08DB-4CC5-A75A-F2AB79E55B6E}
    HKEY_CLASSES_ROOT\Interface\{D1951679-1D52-43FC-9585-0737143585F5}
    HKEY_CLASSES_ROOT\Interface\{F273D4EA-2025-4410-8408-251A0CD46BE7}
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \Explorer\Browser Helper Objects\{0A68C5A2-64AE-4415-88A2-6542304A4745}
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \Explorer\Browser Helper Objects\{87766247-311C-43B4-8499-3D5FEC94A183}
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \Explorer\Browser Helper Objects\{8952A998-1E7E-4716-B23D-3DBE03910972}
    HKEY_CLASSES_ROOT\Installer\Features\CA2E4A17C7EE67447B98D93D8144E0D0
    HKEY_CLASSES_ROOT\Installer\Products\CA2E4A17C7EE67447B98D93D8144E0D0
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Features
    \CA2E4A17C7EE67447B98D93D8144E0D0
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products
    \CA2E4A17C7EE67447B98D93D8144E0D0
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\UpgradeCodes
    \53E709BA426171644AFC9A3F08B933A7
    HKEY_CLASSES_ROOT\Installer\UpgradeCodes
    \53E709BA426171644AFC9A3F08B933A7
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database
    \Distribution Units\{87067F04-DE4C-4688-BC3C-4FCF39D609E7}
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \Installer\Components\C3D2CDB9A41E452EA544AB5033418FCB
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \Installer\Features\CA2E4A17C7EE67447B98D93D8144E0D0
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \Installer\Products\CA2E4A17C7EE67447B98D93D8144E0D0
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \Installer\UpgradeCodes\53E709BA426171644AFC9A3F08B933A7
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \Installer\UserData\S-1-5-18\Components\C3D2CDB9A41E452EA544AB5033418FCB
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \Installer\UserData\S-1-5-18\Products\CA2E4A17C7EE67447B98D93D8144E0D0
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \Uninstall\{71A4E2AC-EE7C-4476-B789-9DD318440E0D}
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Setup\RC
    HKEY_CURRENT_USER\Software\MSIETS
    HKEY_CURRENT_USER\Software\Toolbar
    HKEY_CURRENT_USER\Software\Toolbar\Files\SVC
    HKEY_CURRENT_USER\Software\Toolbar\Files\TBR
    HKEY_CURRENT_USER\Software\Toolbar\PlugIns\COMMON
    HKEY_CURRENT_USER\Software\WinTools
    HKEY_CLASSES_ROOT\Common.Buttons\Clsid
    HKEY_CLASSES_ROOT\PROTOCOLS\Handler\tpro
    HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\res\toolbar.ResProtocol
    HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\res\WToolsB.ResProtocol
    HKEY_CLASSES_ROOT\Radio.RadioPlayer
    HKEY_CLASSES_ROOT\TBPS.PluginConfig
    HKEY_CLASSES_ROOT\TBPS.PluginDown
    HKEY_CLASSES_ROOT\TBPS.PluginEvents
    HKEY_CLASSES_ROOT\TBPS.PluginInst
    HKEY_CLASSES_ROOT\TBPS.PluginServer
    HKEY_CLASSES_ROOT\TBPS.ToolbarScript
    HKEY_CLASSES_ROOT\toolbar.IToolbarScriptClass
    HKEY_CLASSES_ROOT\toolbar.ResProtocol
    HKEY_CLASSES_ROOT\WSG.WSGObj
    HKEY_CLASSES_ROOT\WToolsB.ResProtocol
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \Installer\UserData\STO
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \Uninstall\TTOOL_UNINSTALL
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \Uninstall\WinTools
    HKEY_LOCAL_MACHINE\SOFTWARE\Toolbar
    HKEY_LOCAL_MACHINE\SOFTWARE\Toolbar\Files\COMMON
    HKEY_LOCAL_MACHINE\SOFTWARE\Toolbar\Files\SVC
    HKEY_LOCAL_MACHINE\SOFTWARE\Toolbar\Files\TBR
    HKEY_LOCAL_MACHINE\SOFTWARE\Toolbar\PlugIns\COMMON
    HKEY_LOCAL_MACHINE\SOFTWARE\WinTools
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TBPSSVC
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINTOOLSSVC
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\websearch
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\CustomizeSearch
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\SearchAssistant
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26E8361F-BCE7-4F75-A347-98C88B418322}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{63B78BC1-A711-4D46-AD2F-C581AC420D41}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{26E8361F-BCE7-4F75-A347-98C88B418321}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BTIEINScriptConfigProj.BTIEINScriptConfig
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{63B78BC1-A711-4D46-AD2F-C581AC420D41}
    HKEY_LOCAL_MACHINE\SOFTWARE\BTIEIN
    HKEY_CURRENT_USER\Software\BTIEIN

  2. May add the values:

    "TBPS" = ""
    "WinTools" = ""
    "OETool" = ""
    "TB_setup"= ""

    to the registry subkeys:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
  3. May add the value:

    "{339BB23F-A864-48C0-A59F-29EA915965EC}" = ""

    to the registry subkeys:

    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser
  4. May add the values:

    "{8A05273A-2EA5-42DE-AA75-59EA7D9D50D7}" = "00"
    "{339BB23F-A864-48C0-A59F-29EA915965EC}" = "00"

    to the registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar

  5. May add the values:

    "{8952A998-1E7E-4716-B23D-3DBE03910972}" = ""

    to the registry subkeys:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks
  6. May add the values:

    "TUID" = ""
    "WTInstallDate" = ""

    to the registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData
  7. May add the values:

    "%SystemDrive%/WINDOWS/Downloaded Program Files/QDow_AS2.dll
    \{87067F04-DE4C-4688-BC3C-4FCF39D609E7}" =  ""
    "%SystemDrive%/WINDOWS/Downloaded Program Files/QDow_AS2.dll
    \.Owner" = "{87067F04-DE4C-4688-BC3C-4FCF39D609E7}"

    to the registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage

    Note: %SystemDrive% is a variable that refers to the drive on which Windows is installed. By default, this is drive C.
  8. May add the value:

    "%CommonProgramFiles%\MSIETS\" = ""

    to the registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \Installer\Folders

    Note: %CommonProgramFiles% is a variable that refers to the Common Files folder. By default, this is C:\Program Files\Common Files.
  9. May add the value:

    "%Windir%\Downloaded Program Files\QDow_AS2.dll" =  "1"

    to the registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs

    Note: %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
  10. May modify the value:

    "ShellNext" = "[path to executable]"

    in the registry subkey:

    HKEY_CURRENT_USER\Software\Microsoft\Internet Connection Wizard
  11. May modify the value:

    "Search Bar" = "[Web site on the websearch.com or huntbar.com domain]"

    in the registry subkeys:

    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
  12. May modify the value:

    "Start Page" = "[Web site on the websearch.com or huntbar.com domain]"

    in the registry subkeys:

    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
  13. May modify the value:

    "CustomizeSearch" = "res://%SystemDrive%\PROGRA~1\Toolbar\toolbar.dll/sa"

    in the registry subkeys:

    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search
  14. May modify the value:

    "SearchAssistant" = "[Web site on the websearch.com or huntbar.com domain]"

    in the registry subkeys:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search

  15. Attempts to download files from a predetermined Web site. If the download is successful, it decompresses the files into multiple folders, and starts multiple programs. Files may be created in the following folders:

    • %SystemDrive%\Documents and Settings\All Users\Start Menu\Programs\Web Search Tools
    • %CommonProgramFiles%\WinTools
    • %CommonProgramFiles%\WinTools\Update
    • %ProgramFiles%\Toolbar
    • %ProgramFiles%\Toolbar\Cursors
    • %ProgramFiles%\Toolbar\Recordings
    • %ProgramFiles%\Toolbar\Skins
    • %ProgramFiles%\Toolbar\Update
    • %ProgramFiles%\websearch
    • [original folder]\Cursors
    • [original folder]\Skins
    • [original folder]\temp

      Note: %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files. <original folder> refers to the folder the adware was executed in.

  16. Appears in the Internet Explorer as a search toolbar, and in the System Tray as an icon.

  17. Logs keywords from searches and sends the logs to a predetermined Web site.

  18. May download an updated version of itself.

  19. May open Internet Explorer to www.websearch.com.


REMOVAL


Removal using the Adware.Websearch Removal Tool
Symantec Security Response has developed a removal tool for Adware.Websearch. Use this removal tool first, as it is the easiest way to remove this threat.

The tool can be found here: http://securityresponse.symantec.com/avcenter/FxWebsch.exe

The current version of the tool is 1.0.0 and will have a digital signature timestamp equivalent to 02/28/2005 06:17 AM PST.
Note: The date and time displayed will be adjusted to your time zone, if your computer is not set to the Pacific time zone.

It has been reported that a computer with Adware.Websearch on it may also have other security risks installed. Symantec recommends that the following steps be carried out:
    1. Run the Adware.Websearch Removal Tool.
    2. Update the definitions by starting the Symantec program and running LiveUpdate.
    3. Run a full system scan to detect any other security risks on the computer.
    4. If the scan detects any further security risks, check for removal tools at http://securityresponse.symantec.com/avcenter/security.risks.tools.list.html.
    5. If there are no removal tools for the security risks that are detected, follow the manual removal instructions listed in the threat report.

Manual Removal
The following instructions pertain to all Symantec antivirus products that support security risk detection.
  1. Update the definitions.
  2. Uninstall Search Toolbar, TS Toolbar, and WebSearch Toolbar using the Add/Remove Programs utility.
  3. Run a full system scan.
  4. Delete any values added to the registry.
  5. Reset the Internet Explorer home page.
  6. Reset the Internet Explorer search page.
  7. Delete folders created by the adware.
For specific details on each of these steps, read the following instructions.

1. To update the definitions
To obtain the most recent definitions, start your Symantec program and run LiveUpdate.


2. To uninstall the Adware
  1. Do one of the following:
    1. On the Windows 98 taskbar:
      1. Click Start > Settings > Control Panel.
      2. In the Control Panel window, double-click Add/Remove Programs.

    2. On the Windows Me taskbar:
      1. Click Start > Settings > Control Panel.
      2. In the Control Panel window, double-click Add/Remove Programs.
        If you do not see the Add/Remove Programs icon, click "...view all Control Panel options."

    3. On the Windows 2000 taskbar:
      By default, Windows 2000 is set up the same as Windows 98, so follow the instructions for Windows 98. If otherwise, click Start, point to Settings > Control Panel, and then click Add/Remove Programs.

    4. On the Windows XP taskbar:
      1. Click Start > Control Panel.
      2. In the Control Panel window, double-click Add or Remove Programs.

  2. Click Search Toolbar, TS Toolbar, and WebSearch Toolbar, if present.


    Note:     You may need to use the scroll bar to view the whole list.

  3. Click Add/Remove, Change/Remove, or Remove (this varies with the operating system). Follow the prompts.


3. To run the scan
  1. Start your Symantec antivirus program, and then run a full system scan.

    Note: If you ran the Add/Remove programs applet as described in the previous section, all the files may have been removed, and thus none of them will be detected.
  2. If any files are detected as Adware.Websearch and depending on which software version you are using, you may see one or more of the following options:

    Note: This applies only to versions of Norton AntiVirus that support security risk detection. If you are running a version of Symantec AntiVirus Corporate Edition that supports security risk detection, and security risk detection has been enabled, you will only see a message box that gives the results of the scan. If you have questions in this situation, contact your network administrator.
    • Exclude (Not recommended): If you click this button, it will set the risk so that it is no longer detectable. That is, the antivirus program will keep the security risk on your computer and will no longer detect it to remove from your computer.

    • Ignore or Skip: This option tells the scanner to ignore the risk for this scan only. It will be detected again the next time that you run a scan.

    • Cancel: This option is new to Norton Antivirus 2005. It is used when Norton Antivirus 2005 has determined that it cannot delete a security risk. This Cancel option tells the scanner to ignore the risk for this scan only, and thus, the risk will be detected again the next time that you run a scan.

      To actually delete the security risk:
      • Click its file name (under the Filename column).
      • In the Item Information box that displays, write down the full path and file name.
      • Then use Windows Explorer to locate and delete the file.

        If Windows reports that it cannot delete the file, this indicates that the file is in use. In this situation, complete the rest of the instructions on this page, restart the computer in Safe mode, and then delete the file using Windows Explorer. Restart the computer in Normal mode.

    • Delete: This option will attempt to delete the detected files. In some cases, the scanner will not be able to do this.
      • If you see a message, "Delete Failed" (or similar message), manually delete the file.
      • Click the file name of the risk that is under the Filename column.
      • In the Item Information box that displays, write down the full path and file name.
      • Then use Windows Explorer to locate and delete the file.

        If Windows reports that it cannot delete the file, this indicates that the file is in use. In this situation, complete the rest of the instructions on this page, restart the computer in Safe mode, and then delete the file using Windows Explorer. Restart the computer in Normal mode.

4. To delete the value from the registry
    Important: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified subkeys only. Read the document: How to make a backup of the Windows registry.
    1. Click Start > Run.
    2. Type regedit
    3. Click OK.

    4. Navigate to and delete the following subkeys, if present:

      HKEY_CLASSES_ROOT\CLSID\{0A68C5A2-64AE-4415-88A2-6542304A4745}
      HKEY_CLASSES_ROOT\CLSID\{310CC549-4541-46A9-940F-52B342A6E682}
      HKEY_CLASSES_ROOT\CLSID\{339BB23F-A864-48C0-A59F-29EA915965EC}
      HKEY_CLASSES_ROOT\CLSID\{69357D4E-BF4D-4651-91E9-52ECD45A0128}
      HKEY_CLASSES_ROOT\CLSID\{6E21F428-5617-47F7-AED8-B2E1D8FBA711}
      HKEY_CLASSES_ROOT\CLSID\{708BE496-E202-497B-BC31-9CF47E3BF8D6}
      HKEY_CLASSES_ROOT\CLSID\{87067F04-DE4C-4688-BC3C-4FCF39D609E7}
      HKEY_CLASSES_ROOT\CLSID\{87766247-311C-43B4-8499-3D5FEC94A183}
      HKEY_CLASSES_ROOT\CLSID\{8952A998-1E7E-4716-B23D-3DBE03910972}
      HKEY_CLASSES_ROOT\CLSID\{8A05273A-2EA5-42DE-AA75-59EA7D9D50D7}
      HKEY_CLASSES_ROOT\CLSID\{8B0FA130-0C3D-4CB1-AEB7-2C29DA5509A3}
      HKEY_CLASSES_ROOT\CLSID\{A8DEB4A5-D9EF-4D21-B4F6-921475004E7D}
      HKEY_CLASSES_ROOT\CLSID\{BBF122A7-8A4D-45B5-9E00-0F68BC87C904}
      HKEY_CLASSES_ROOT\CLSID\{CABCF5E7-0C79-4F1C-909D-B9CF68FED746}
      HKEY_CLASSES_ROOT\CLSID\{CAE0999F-78C5-49DC-9F30-13142AAAABA4}
      HKEY_CLASSES_ROOT\CLSID\{F1616B86-9288-489D-B71A-0CCF2F1A89DA}
      HKEY_CLASSES_ROOT\CLSID\{FB45C451-B0E9-4407-BB6A-9361013F3E9A}
      HKEY_CLASSES_ROOT\CLSID\{FF76A5DA-6158-4439-99FF-EDC1B3FE100C}
      HKEY_CLASSES_ROOT\TypeLib\{37AC49E3-E906-4BD8-AE83-D0F7FB48FD17}
      HKEY_CLASSES_ROOT\TypeLib\{8992B6CA-B8C9-4AED-BF89-0A17F6296A06}
      HKEY_CLASSES_ROOT\TypeLib\{B23B3ADD-84B1-414A-92B9-0CABE5A781F4}
      HKEY_CLASSES_ROOT\TypeLib\{D8BD4DED-5BB2-4D4E-9A6A-F10244FED7D6}
      HKEY_CLASSES_ROOT\TypeLib\{DB9A4E78-35DF-4A54-B6C5-C5190CEAF949}
      HKEY_CLASSES_ROOT\Interface\{234F09FB-FE89-4C6D-9203-31832FC051C3}
      HKEY_CLASSES_ROOT\Interface\{365B9A54-E613-46E5-9DB1-4F91A9DE80BD}
      HKEY_CLASSES_ROOT\Interface\{618BE527-B7F5-417C-BC51-98FDC2D6DE61}
      HKEY_CLASSES_ROOT\Interface\{66C22569-F05C-4A70-A142-763B337E1002}
      HKEY_CLASSES_ROOT\Interface\{7B8BD940-B1EF-460C-85A2-9ACAAF7F9303}
      HKEY_CLASSES_ROOT\Interface\{99AA88D1-D9D3-410A-BE9E-044F94C183DA}
      HKEY_CLASSES_ROOT\Interface\{BD6F129A-08DB-4CC5-A75A-F2AB79E55B6E}
      HKEY_CLASSES_ROOT\Interface\{D1951679-1D52-43FC-9585-0737143585F5}
      HKEY_CLASSES_ROOT\Interface\{F273D4EA-2025-4410-8408-251A0CD46BE7}
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
      \Explorer\Browser Helper Objects\{0A68C5A2-64AE-4415-88A2-6542304A4745}
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
      \Explorer\Browser Helper Objects\{87766247-311C-43B4-8499-3D5FEC94A183}
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
      \Explorer\Browser Helper Objects\{8952A998-1E7E-4716-B23D-3DBE03910972}
      HKEY_CLASSES_ROOT\Installer\Features\CA2E4A17C7EE67447B98D93D8144E0D0
      HKEY_CLASSES_ROOT\Installer\Products\CA2E4A17C7EE67447B98D93D8144E0D0
      HKEY_CURRENT_USER\Software\Microsoft\Installer\Features
      \CA2E4A17C7EE67447B98D93D8144E0D0
      HKEY_CURRENT_USER\Software\Microsoft\Installer\Products
      \CA2E4A17C7EE67447B98D93D8144E0D0
      HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes
      \53E709BA426171644AFC9A3F08B933A7
      HKEY_CLASSES_ROOT\Installer\UpgradeCodes
      \53E709BA426171644AFC9A3F08B933A7
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database
      \Distribution Units\{87067F04-DE4C-4688-BC3C-4FCF39D609E7}
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
      \Installer\Components\C3D2CDB9A41E452EA544AB5033418FCB
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
      \Installer\Features\CA2E4A17C7EE67447B98D93D8144E0D0
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
      \Installer\Products\CA2E4A17C7EE67447B98D93D8144E0D0
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
      \Installer\UpgradeCodes\53E709BA426171644AFC9A3F08B933A7
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
      \Installer\UserData\S-1-5-18\Components\C3D2CDB9A41E452EA544AB5033418FCB
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
      \Installer\UserData\S-1-5-18\Products\CA2E4A17C7EE67447B98D93D8144E0D0
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
      \Uninstall\{71A4E2AC-EE7C-4476-B789-9DD318440E0D}
      HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Setup\RC
      HKEY_CURRENT_USER\Software\MSIETS
      HKEY_CURRENT_USER\Software\Toolbar
      HKEY_CURRENT_USER\Software\Toolbar\Files\SVC
      HKEY_CURRENT_USER\Software\Toolbar\Files\TBR
      HKEY_CURRENT_USER\Software\Toolbar\PlugIns\COMMON
      HKEY_CURRENT_USER\Software\WinTools
      HKEY_CLASSES_ROOT\Common.Buttons\Clsid
      HKEY_CLASSES_ROOT\PROTOCOLS\Handler\tpro
      HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\res\toolbar.ResProtocol
      HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\res\WToolsB.ResProtocol
      HKEY_CLASSES_ROOT\Radio.RadioPlayer
      HKEY_CLASSES_ROOT\TBPS.PluginConfig
      HKEY_CLASSES_ROOT\TBPS.PluginDown
      HKEY_CLASSES_ROOT\TBPS.PluginEvents
      HKEY_CLASSES_ROOT\TBPS.PluginInst
      HKEY_CLASSES_ROOT\TBPS.PluginServer
      HKEY_CLASSES_ROOT\TBPS.ToolbarScript
      HKEY_CLASSES_ROOT\toolbar.IToolbarScriptClass
      HKEY_CLASSES_ROOT\toolbar.ResProtocol
      HKEY_CLASSES_ROOT\WSG.WSGObj
      HKEY_CLASSES_ROOT\WToolsB.ResProtocol
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
      \Installer\UserData\STO
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
      \Uninstall\TTOOL_UNINSTALL
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
      \Uninstall\WinTools
      HKEY_LOCAL_MACHINE\SOFTWARE\Toolbar
      HKEY_LOCAL_MACHINE\SOFTWARE\Toolbar\Files\COMMON
      HKEY_LOCAL_MACHINE\SOFTWARE\Toolbar\Files\SVC
      HKEY_LOCAL_MACHINE\SOFTWARE\Toolbar\Files\TBR
      HKEY_LOCAL_MACHINE\SOFTWARE\Toolbar\PlugIns\COMMON
      HKEY_LOCAL_MACHINE\SOFTWARE\WinTools
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TBPSSVC
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINTOOLSSVC
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\websearch
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\CustomizeSearch
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\SearchAssistant
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26E8361F-BCE7-4F75-A347-98C88B418322}
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{63B78BC1-A711-4D46-AD2F-C581AC420D41}
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{26E8361F-BCE7-4F75-A347-98C88B418321}
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BTIEINScriptConfigProj.BTIEINScriptConfig
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{63B78BC1-A711-4D46-AD2F-C581AC420D41}
      HKEY_LOCAL_MACHINE\SOFTWARE\BTIEIN
      HKEY_CURRENT_USER\Software\BTIEIN

    5. Navigate to the subkeys:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
    6. In the right pane, delete the values:

      "TBPS" = ""
      "WinTools" = ""
      "OETool" = ""
      "TB_setup"= ""

    7. Navigate to the subkeys:

      HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
      HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser
    8. In the right pane, delete the value:

      "{339BB23F-A864-48C0-A59F-29EA915965EC}" = ""

    9. Navigate to the subkey:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar

    10. In the right pane, delete the values:

      "{8A05273A-2EA5-42DE-AA75-59EA7D9D50D7}" = "00"
      "{339BB23F-A864-48C0-A59F-29EA915965EC}" = "00"
    11. Navigate to the subkeys:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks
      HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks

    12. In the right pane, delete the value:

      "{8952A998-1E7E-4716-B23D-3DBE03910972}" = ""
    13. Navigate to the subkey:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData
    14. In the right pane, delete the values:

      "TUID" = ""
      "WTInstallDate" = ""
    15. Navigate to the subkey:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage
    16. In the right pane, delete the values:

      "%SystemDrive%/WINDOWS/Downloaded Program Files/QDow_AS2.dll
      \{87067F04-DE4C-4688-BC3C-4FCF39D609E7}" =  ""
      "%SystemDrive%/WINDOWS/Downloaded Program Files/QDow_AS2.dll
      \.Owner" = "{87067F04-DE4C-4688-BC3C-4FCF39D609E7}"
    17. Navigate to the subkey:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
      \Installer\Folders
    18. In the right pane, delete the value:

      "%CommonProgramFiles%\MSIETS\" = ""
    19. Navigate to the subkey:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs

    20. In the right pane, delete the value:

      "%Windir%\Downloaded Program Files\QDow_AS2.dll" =  "1"
    21. Navigate to the subkey:

      HKEY_CURRENT_USER\Software\Microsoft\Internet Connection Wizard
    22. In the right pane, delete the value:

      "ShellNext" = "[path to executable]"

    23. Exit the Registry Editor.

5. To reset the Internet Explorer home page 6. To reset the Internet Explorer Search page
    Follow the instructions for your version of Windows.

    Windows 98/Me/2000
    1. Start Microsoft Internet Explorer.
    2. Click the Search button on the toolbar.
    3. In the Search pane, click Customize.
    4. Click Reset.
    5. Click Autosearch Settings.
    6. Select a search site from the drop-down list, and then click OK.
    7. Click OK.

    Windows XP
    Because Windows XP is set by default to use animated characters in the search, how you do this can vary. Read all the instructions before you start.
    1. Start Microsoft Internet Explorer.
    2. Click the Search button on the toolbar.
    3. Do one of the following:
      • If the pane that opens looks similar to the following picture, click the word Customize and proceed to step h:




      • If the pane that opens has the words "Search Companion" at the top, and the center looks similar to the following picture, click the Change preferences link and proceed with step d.




    4. Click the Change Internet search behavior link.
    5. Under "Internet Search Behavior," click With Classic Internet Search.
    6. Click OK. Then close Internet Explorer. (Close the program for the change to take effect.)
    7. Start Internet Explorer. When the search pane opens, it should look similar to the following picture:





      Click the word Customize, and then proceed with the next step.

    8. In the Search pane, click Customize.
    9. Click Reset.
    10. Click Autosearch Settings.
    11. Select a search site from the drop-down list, and then click OK.
    12. Click OK.
    13. Do one of the following:
      • If you were using (or want to continue using) the "Classic Internet Search" panel, stop here (or proceed with the next section).
      • If you want to go back to the "Search Companion" search (it usually has an animated character at the button), proceed with step n.

    14. Click the word Customize again.
    15. In the "Customize Search Settings" window, click Use Search Companion > OK.
    16. Close Internet Explorer. The next time you open it, it will again use the Search Companion.

7. Delete folders created by the adware
  1. Click Start > Programs > Accessories > Windows Explorer
  2. Navigate to and delete the folder %ProgramFiles%\Websearch, if present
  3. Exit Windows Explorer.


©1995 - 2009 Symantec Corporation
Site Map|
Legal Notices|
Privacy Policy