Spyware.CWSAddClass

Printer Friendly Page

Updated: February 13, 2007 11:39:40 AM

Type: Spyware

Risk Impact: High

File Names: Addclass.exe

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Spyware.CWSAddClass is executed, it does the following:

Terminates the process, %System%\Mshta.exe.

Note: %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
Creates the file, %Windir%\Addclass.exe.

Note: %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
Modifies the values:

"SearchAssistant"="http:/ /ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm" "CustomizeSearch"="http:/ /ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm" "(Default)"="(value not set)"

in the registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Searchto:

"SearchAssistant"="http:/ /www.hand-book.com/search" "CustomizeSearch"="http:/ /www.hand-book.com/search" "(Default)"="http:/ /www.hand-book.com/search"
Modifies the values:

"Search Page"="http:/ /www.microsoft.com/isapi/redir.dll?prd=ie&r=iesearch" "Default_Search_URL"="http:/ /www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="http:/ /www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"

in the registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Mainto:

"Search Page"="http:/ /www.hand-book.com/search" "Default_Search_URL"="http:/ /www.hand-book.com/search"
"Start Page"="http:/ /www.hand-book.com/hp"
Modifies the value:

"(Default)"="(value not set)"

in the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixesto:

"(Default)"="http:/ /ehttp.cc/?"
Modifies the value:

"(Default)"="http://"

in the registry key:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Default Prefixto:

"(Default)"="http:/ /ehttp.cc/?"
Adds the value:

"Search Bar"="http:/ /www.hand-book.com/search"

to the registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Adds the value:

"(Default)"="http:/ /www.hand-book.com/search"

to the registry key:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Search URL
Adds the value:

"AddClass"="%Windir%\addclass.exe"

to the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runso that the Spyware runs when you start Windows.

Removal

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}