||||
Symantec.com > Security Response > Threats and Risks > Adware.Smartsearch
PRINT THIS PAGE

Adware.Smartsearch

Printer Friendly Page

Updated: February 13, 2007 11:36:32 AM
Type: Adware
Publisher: Smart Search Asia Ltd.
Risk Impact: High
File Names: C:\y.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Windows\explore.exe C:\Windows\sys
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP


When Adware.Smartsearch is executed, it performs the following actions:
  1. Creates the file, Temp.txt (this file may be several megabytes in size). This file is not a threat, and therefore Symantec antivirus products do not detect it.

  2. Adds the value:

    "SystemEmergency"="<path to Adware.Smartsearch executable file>"

    to the registry key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

    so that Adware.Smartsearch runs when you start Windows.

  3. Sets the value:

    "(Default)"="http:/ /smartsearch.ws/?q="

    in the registry key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix

    which adds the string, http:/ /smartsearch.ws/?q=, to any URLs typed into the Address bar of Internet Explorer. For example, if a user was to type www.example.com into the Address bar, Internet Explorer would go to the URL, http:/ /smartsearch.ws/?q=www.example.com.

  4. Sets the value:

    "www"="http:/ /smartsearch.ws/?q="

    in the registry key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes
  5. Sets the values:
    • "Search"="http:/ /smartsearch.ws/?q="
    • "SearchURL"="http:/ /smartsearch.ws/?q="

      in the registry key:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer

  6. Sets the values:
    • "Default_Page_URL"="http:/ /smartsearch.ws"
    • "Default_Search_URL"="http:/ /smartsearch.ws/?q="
    • "Search Bar"="http:/ /smartsearch.ws/?q="
    • "Search Page"="http:/ /smartsearch.ws/?q="
    • "Start Page"="http:/ /smartsearch.ws"

      in the registry key:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main

  7. Sets the values:
    • "CustomizeSearch"="http:/ /smartsearch.ws/?q="
    • "SearchAssistant"="http:/ /smartsearch.ws/?q="

      in the registry key:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search

  8. Sets the values:
    • "Search"="http:/ /smartsearch.ws/?q="
    • "SearchURL"="http:/ /smartsearch.ws/?q="

      in the registry key:

      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer

  9. Sets the values:
    • "Default_Page_URL"="http:/ /smartsearch.ws"
    • "Default_Search_URL"="http:/ /smartsearch.ws/?q="
    • "Search Bar"="http:/ /smartsearch.ws/?q="
    • "Search Page"="http:/ /smartsearch.ws/?q="
    • "Start Page"="http:/ /smartsearch.ws"

      in the registry key:

      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main

  10. Contacts the Web site, http:/ /smartsearch.ws, and downloads software updates.


Search by name
Example: W32.Beagle.AG@mm
Windows 7
Windows Vista Security
©1995 - 2009 Symantec Corporation
Site Map|
Legal Notices|
Privacy Policy|
|
Contact Us|
Global Sites|
License Agreements|
RSS