1. /
  2. Security Response/
  3. Adware.Ztoolbar

Adware.Ztoolbar

Updated:
February 13, 2007 11:40:23 AM
Type:
Adware
Risk Impact:
Low
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Adware.Ztoolbar is executed, it performs the following actions:
  1. Creates the following registry entries:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
    \{A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB}
    HKEY_LOCAL_MACHINE\SOFTWARE\ZSearchCo\ZSearch
    HKEY_CLASSES_ROOT\ZToolbar.StockBar
    HKEY_CLASSES_ROOT\ZToolbar.StockBar.1
    HKEY_CLASSES_ROOT\CLSID\{A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB}
    HKEY_CLASSES_ROOT\ZToolbar.activator.1
    HKEY_CLASSES_ROOT\ZToolbar.activator
    HKEY_CLASSES_ROOT\CLSID\{FFF5092F-7172-4018-827B-FA5868FB0478}
    HKEY_CLASSES_ROOT\ZToolbar.ParamWr.1
    HKEY_CLASSES_ROOT\ZToolbar.ParamWr
    HKEY_CLASSES_ROOT\CLSID\{D7BF3304-138B-4DD5-86EE-491BB6A2286C}
    HKEY_CLASSES_ROOT\TypeLib\{84C94803-B5EC-4491-B2BE-7B113E013B77}
    HKEY_CLASSES_ROOT\Interface\{6DEEE498-08CC-43F0-BCA0-DBB5A25C9501}
    HKEY_CLASSES_ROOT\Interface\{DCFAB192-4A0E-4720-8E24-70D5F0CB8C39}
    HKEY_CLASSES_ROOT\Interface\{F4394F24-163D-430B-B5AF-B68B56031B99}

    So that the Adware.Ztoolbar gets loaded as an Internet Explorer search toolbar.

  2. All queries are sent to [http://]www.tnssearch.com/[REMOVED] when the search toolbar is used. Search results may contain advertisements.


Summary| Technical Details| Removal

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report, Volume 17
Symantec DeepSight Screensaver