||||
Symantec.com > Security Response > Threats and Risks > Adware.BrowserAid
PRINT THIS PAGE

Adware.BrowserAid

Printer Friendly Page

Updated: February 13, 2007 11:37:37 AM
Type: Adware
Publisher: BrowserAid
Risk Impact: Medium
File Names: msiefr40.dll inetp60.dll stlb2.dll
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP


When executed Adware.BrowserAid may perform some or all of the following actions:
  1. May create some or all of the following files:

    • %System%\msiefr40.dll (detected as Adware.BrowserAid)
    • %System%\e6f1873b.dll (detected as Adware.BrowserAid)
    • %System%\stlb2.dll (detected as Adware.BrowserAid)
    • %System%\stlb2.xml
    • %Windir%\uptodate.exe (detected as Adware.BrowserAid)

      Note:
    • %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
    • %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

  2. May create one the following folders:

    • %UserProfile%\Application Data\{12EE7A5E-0674-42F9-A76B-000000004D00}
    • %UserProfile%\Application Data\{2CF0B992-5EEB-4143-99C2-5297EF71F44B}

      Note: %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\[Current User] (Windows NT/2000/XP).

  3. May create one or more of the following registry subkeys:

    HKEY_CLASSES_ROOT\AppID\{418B46A9-5343-4E1A-A654-42B04E3F869E}
    HKEY_CLASSES_ROOT\AppID\{87690003-2714-45E7-8A1B-DC0658DE778C}
    HKEY_CLASSES_ROOT\CLSID\{087173EF-9829-4F49-8340-A524177D3F60}
    HKEY_CLASSES_ROOT\CLSID\{0ddbb570-0396-44c9-986a-8f6f61a51c2f}
    HKEY_CLASSES_ROOT\CLSID\{12EE7A5E-0674-42f9-A76A-000000004D00}
    HKEY_CLASSES_ROOT\CLSID\{12EE7A5E-0674-42f9-A76B-000000004D00}
    HKEY_CLASSES_ROOT\CLSID\{337D0C1D-4053-4FAB-AF2B-45C2F7B0FAA6}
    HKEY_CLASSES_ROOT\CLSID\{5F5564AC-DE7A-4DCD-9296-32E71A35DCB6}
    HKEY_CLASSES_ROOT\CLSID\{606220AE-90E0-41CA-BF6D-C89272ED680C}
    HKEY_CLASSES_ROOT\CLSID\{80672997-D58C-4190-9843-C6C61AF8FE97}
    HKEY_CLASSES_ROOT\CLSID\{DBD7AAA2-1725-4663-8C8B-52A840693469}
    HKEY_CLASSES_ROOT\CLSID\{E004800A-73C6-4587-B855-98D0CE0C16B1}
    HKEY_CLASSES_ROOT\CLSID\{F20AE630-6DE2-43CA-A988-7CD40C36EF0B}
    HKEY_CLASSES_ROOT\Interface\{2A167E61-D100-450D-A1B0-6EAF394BCB87}
    HKEY_CLASSES_ROOT\Interface\{4A2563C7-FC68-4EE8-A11C-2022EBCC1B0F}
    HKEY_CLASSES_ROOT\Interface\{4B0FCEB7-8163-46EE-9EAF-85BD933D0A46}
    HKEY_CLASSES_ROOT\Interface\{670801FD-C247-4E44-9424-69E5D77C6725}
    HKEY_CLASSES_ROOT\Interface\{8A7D38BE-849D-478F-A7CF-55EC95722358}
    HKEY_CLASSES_ROOT\Interface\{E58F4168-608C-45C2-9BFF-061229730B2E}
    HKEY_CLASSES_ROOT\Interface\{EE06D877-386F-4A44-A9ED-75EB6C3E7E80}
    HKEY_CLASSES_ROOT\Interface\{EE06D877-386F-4A44-A9ED-75EB6C3E7E81}
    HKEY_CLASSES_ROOT\Interface\{F8D96098-E9F7-42E1-88F3-A3719D70EA8D}
    HKEY_CLASSES_ROOT\TypeLib\{12EE7A5E-0674-42F9-A76C-000000004D00}
    HKEY_CLASSES_ROOT\TypeLib\{7313BFD0-62C4-40F4-8041-3FBDBC80AC07}
    HKEY_CLASSES_ROOT\TypeLib\{85C2C2A1-3F20-4EAD-ADC3-BD3217391543}
    HKEY_CLASSES_ROOT\TypeLib\{BA87B15B-7DE7-4DA4-8BF7-5C616D6C99DA}
    HKEY_CLASSES_ROOT\bho.FResultsRequest
    HKEY_CLASSES_ROOT\bho.FResultsRequest.1
    HKEY_CLASSES_ROOT\Bho.FeaturedResultsBHO
    HKEY_CLASSES_ROOT\Bho.FeaturedResultsBHO.1
    HKEY_CLASSES_ROOT\bho.FResultsRequestDispatcher
    HKEY_CLASSES_ROOT\bho.FResultsRequestDispatcher.1
    HKEY_CLASSES_ROOT\bho.IAdvertisementBHO
    HKEY_CLASSES_ROOT\bho.IAdvertisementBHO.1
    HKEY_CLASSES_ROOT\AppID\bho.DLL
    HKEY_CLASSES_ROOT\AppID\My404.DLL
    HKEY_CLASSES_ROOT\My404.Bho404
    HKEY_CLASSES_ROOT\My404.Bho404.1
    HKEY_CLASSES_ROOT\_ATL_GENERATED.SearchToolbarBHO
    HKEY_CLASSES_ROOT\_ATL_GENERATED.SearchToolbarBHO.1
    HKEY_CLASSES_ROOT\_ATL_GENERATED.SearchToolbarName
    HKEY_CLASSES_ROOT\_ATL_GENERATED.SearchToolbarName.1
    HKEY_CLASSES_ROOT\BrowserAidToolbar.Helper
    HKEY_CLASSES_ROOT\BrowserAidToolbar.Helper.1
    HKEY_CLASSES_ROOT\BrowserAidToolbar.IEShower
    HKEY_CLASSES_ROOT\BrowserAidToolbar.IEShower.1
    HKEY_CLASSES_ROOT\BrowserAidToolbar.IEToolBar
    HKEY_CLASSES_ROOT\BrowserAidToolbar.IEToolBar.1
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser Helper Objects
    \{087173ef-9829-4f49-8340-a524177d3f60}
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
    \{0DDBB570-0396-44C9-986A-8F6F61A51C2F}
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
    \{12EE7A5E-0674-42f9-A76A-000000004D00}
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
    \{5F5564AC-DE7A-4DCD-9296-32E71A35DCB6}
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
    \{80672997-D58C-4190-9843-C6C61AF8FE97}
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{07B7F771-1B8E-4B7B-823E-FFAC1732AA9E}
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{12EE7A5E-0674-42f9-A76B-000000004D00}
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LetsSearch
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunWindowsUpdate
    HKEY_CURRENT_USER\Software\A70F6A1D-0195-42a2-934C-D8AC0F7C08EB
    HKEY_CURRENT_USER\Software\{12EE7A5E-0674-42f9-A76B-000000004D00}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2CF0B992-5EEB-4143-99C2-5297EF71F44A}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2CF0B992-5EEB-4143-99C2-5297EF71F44B}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2CF0B992-5EEB-4143-99C2-5297EF71F44C}
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars
    \{2CF0B992-5EEB-4143-99C2-5297EF71F44B}
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
    \{2CF0B992-5EEB-4143-99C2-5297EF71F44A}
    HKEY_LOCAL_MACHINE\SOFTWARE\{2CF0B992-5EEB-4143-99C2-5297EF71F44B}
    HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2CF0B992-5EEB-4143-99C2-5297EF71F44A}
    HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2CF0B992-5EEB-4143-99C2-5297EF71F44B}
    HKEY_USERS\Software\{2CF0B992-5EEB-4143-99C2-5297EF71F44B}
  4. Adds some of the following values:

    "{12EE7A5E-0674-42f9-A76B-000000004D00}" = "rundll32.exe stlb2.dll,DllRunMain"
    "A70F6A1D-0195-42A2-934C-D8AC0F7C08EB"   = "rundll32.exe E6F1873B.DLL, D9EBC318C"
    "Rundll32_7" = "rundll32.exe C:\WINDOWS\System32\msiefr40.dll,DllRunServer"
    "Rundll32_8" = "rundll32.exe C:\1.dll,DllRunServer"
    "    {2CF0B992-5EEB-4143-99C2-5297EF71F44B}" = "rundll32.exe STLBUPDT.dll,DllRunMain"

    to the registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  5. May add the value:

    "{12EE7A5E-0674-42f9-A76B-000000004D00}" = ""

    to the registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar


Search by name
Example: W32.Beagle.AG@mm
Limited Time Offers! Save up to 50%
Windows Vista Security
©1995 - 2009 Symantec Corporation
Site Map|
Legal Notices|
Privacy Policy|
|
Contact Us|
Global Sites|
License Agreements|
RSS