When Adware.EZToolbar is installed, it performs the following actions:
- Creates the file %Windir%\Downloaded Program Files\potwbar.dll.
Note: %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
- Creates the following registry subkeys:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
\{4E7BD74F-2B8D-469E-C0FF-FD7BA09AAA7D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\potwbar.POTWBAR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
\Uninstall\POTWBAR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
\Browser Helper Objects\{4E7BD74F-2B8D-469E-C0FF-FD7BA09AAA7D}
HKEY_CURRENT_USER\Software\Dynamic Toolbar\POTWBAR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database
\Distribution Units\{4E7BD74F-2B8D-469E-C0FF-FD7BA09AAA7D}
- Adds the value:
"{4E7BD74F-2B8D-469E-C0FF-FD7BA09AAA7D}" = "00"
to the registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
so that the adware runs every time Internet Explorer is starts.
- Sends information about Internet sites visited and keywords searched in search engines like google, to a server on the toolbar.pickofthe***.com domain.
