Updated: February 13, 2007 11:39:25 AM
Type: Spyware
Version: 1.0.0.1
Publisher: iDownload.com
Risk Impact: High
File Names:
install.exe
toolbar.dll
idInst.exe
idcs50202.exe
OTY2MTo4OjEy.exe
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
Once Spyware.ISearch is executed, it performs the following actions:
- Creates one or more of the following files:
- %Windir%\Unins000.exe (An uninstaller)
- %Windir%\Unins000.dat
- %System%\Toolbar.dll (A Browser Helper Object detected as Spyware.ISearch)
- %System%\Version.txt
- %UserProfile%\Local Settings\Temp\idcs50202.exe
Notes:
- %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
- %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows (Windows 95/98/Me/XP) or C:\Winnt (Windows NT/2000).
- %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\[CURRENT USER] (Windows NT/2000/XP).
- Creates the following registry subkeys:
HKEY_CLASSES_ROOT\CLSID\{1C78AB3F-A857-482E-80C0-3A1E5238A565}
HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion
\Explorer\Browser Helper Objects
\{1C78AB3F-A857-482E-80C0-3A1E5238A565}
HKEY_CLASSES_ROOT\iSearch.Object
HKEY_CLASSES_ROOT\iSearch.Object.1
HKEY_CLASSES_ROOT\TypeLib\{6D3F5DE4-E980-4407-A10F-9AC771ABAAE6}
HKEY_LOCAL_MACHINE\Software\Classes\TypeLib
\{6D3F5DE4-E980-4407-A10F-9AC771ABAAE6}
HKEY_LOCAL_MACHINE\Software\Classes\CLSID
\{1C78AB3F-A857-482E-80C0-3A1E5238A565}
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar
\{1C78AB3F-A857-482E-80C0-3A1E5238A565}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\Explorer\Browser Helper Objects
\{1C78AB3F-A857-482E-80C0-3A1E5238A565}
HKEY_LOCAL_MACHINE\Software\In3rd
HKEY_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\Uninstall
\iSearch Toolbar_is1
HKEY_CURRENT_USER\Software\iSearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar
\WebBrowser\{1C78AB3F-A857-482E-80C0-3A1E5238A565}
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer
\URLSearchHooks\{1C78AB3F-A857-482E-80C0-3A1E5238A565}
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt
\&iSearch The Web
- Modifies the values:
"Btn_Search" = "2"
"NoDriveTypeAutoRun" = "91"
"SpecifyDefaultButtons" = "1"
"NoBandCustomize" = "1"
"NoToolbarCustomize" = "1
in the registry subkey:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Technorati
Digg
Delicious
Reddit
StumbleUpon
Yahoo Buzz
Twitter
Facebook
Newsvine
