Adware.2Search

Printer Friendly Page

Updated: February 13, 2007 11:46:03 AM

Type: Adware

Risk Impact: High

File Names: getst.exe main.exe plugin.dll svchost.exe the007guard.ocx the007installer.exe 007guard.exe

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Adware.2search is executed, it performs the following actions:

Creates some of the following files:
- %ProgramFiles%\2search\2search.dll
- %ProgramFiles%\2Search\date.dat
- %ProgramFiles%\2Search\defaultne.txt
- %ProgramFiles%\2search\get.exe
- %ProgramFiles%\2Search\getst.exe
- %ProgramFiles%\2Search\main.exe
- %ProgramFiles%\2Search\plugin.dll
- %ProgramFiles%\2Search\svchost.exe
- %ProgramFiles%\2Search\uninstall.exe
- %ProgramFiles%\The Guard\the007guard.ocx
- %ProgramFiles%\The Guard\the007installer.exe
- %System%\007guard.exe
- %System%\2searchinstaller.exe
- %System%\feeds\1.dat
- %System%\feeds\2.dat
- %System%\feeds\3.dat
- %System%\feeds\4.dat
- %System%\feeds\feed.dst
- %ProgramFiles%\IM Names\IM-svr.exe
- %ProgramFiles%\IM Names\IMNames.exe
- %ProgramFiles%\IM Names\1.exe
- %ProgramFiles%\IM Names\main.exe
- %UserProfile%\Application Data\IM-Names\exclusion_AOL.ini
- %UserProfile%\Application Data\IM-Names\exclusion_MSN.ini
- %UserProfile%\Application Data\IM-Names\exclusion_Yahoo.ini
  
  Note:
- %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
- %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
- %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\[CURRENT USER] (Windows NT/2000/XP).
Registers a Browser Helper Objects by creating and populating the following registry subkeys:

HKEY_CLASSES_ROOT\Interface\{03BE31FE-6526-4D9C-B197-4A3E5DCFF696} HKEY_CLASSES_ROOT\Interface\{8395562C-205D-434B-BE19-3C4E07E6D415}HKEY_CLASSES_ROOT\Interface\{9C33138E-0581-4C28-A943-BC238A68208C}HKEY_CLASSES_ROOT\Interface\{F79A1360-2754-43F3-8297-8A39408BE2BF}HKEY_CLASSES_ROOT\TypeLib\{68E774CB-72D1-4A52-B55B-C0B1011E013B} HKEY_CLASSES_ROOT\CLSID\{4508E20C-ACAD-11D2-9FC0-00550076E06F} HKEY_CLASSES_ROOT\IEsearch.clsIESpy HKEY_CLASSES_ROOT\GoogleCatch.clsIESpy HKEY_CLASSES_ROOT\Interface\{0EB61AF8-0B15-48B6-A971-1F206F2E3D5E} HKEY_CLASSES_ROOT\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} HKEY_CLASSES_ROOT\TypeLib\{20048BB0-DB68-11CF-9CAF-00AA006CB425} HKEY_CLASSES_ROOT\TypeLib\{20048BB0-DB68-11CF-9CAF-00AA006CB425} HKEY_CLASSES_ROOT\TypeLib\{4508E20A-ACAD-11D2-9FC0-00550076E06F} HKEY_CLASSES_ROOT\The007Guard.The007GuardCtrl.1HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4508E20C-ACAD-11D2-9FC0-00550076E06F} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4508E20C-ACAD-11D2-9FC0-00550076E06F}
HKEY_CURRENT_USER\Software\IMAdvertiser\AOL HKEY_CURRENT_USER\Software\IMAdvertiser\MSN HKEY_CURRENT_USER\Software\IMAdvertiser\Yahoo HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4508E20C-ACAD-11D2-9FC0-00550076E06F}
Creates one or more of the following registry subkeys:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2search HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2search HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\the guard HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\the guard HKEY_LOCAL_MACHINE\SOFTWARE\WinRAR SFX\C:\%Program Files%The Guard HKEY_CURRENT_USER\WinRAR SFX\C:\%Program Files%The Guard HKEY_CURRENT_USER\SOFTWARE\WinRAR SFX\C:\%Program Files%2searchHKEY_LOCAL_MACHINE\SOFTWARE\WinRAR SFX\C:\%Program Files%2search
May add one of the following values:
"2Search" = "%ProgramFiles%\2search\main.exe"
"svchost" = "%ProgramFiles%\2search\svchost.exe"

to the registry subkeys:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Runso that it runs every time Windows starts.
May add the value:

"IMprocess" = "%ProgramFiles%\IM Names\IM-svr.EXE""[NAME]" = "[VALUE]"

to the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

so that it runs every time Windows starts.
May add the following entry:

*.hottestgames.netto the registry subkey:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow
May add the values:

"C:\%Program Files%IM Names" = "%ProgramFiles%\IM Names" "C:\%Program Files%2search": "%ProgramFiles%\2search"

to the registry subkey:

HKEY_CURRENT_USER\Software\WinRAR SFX
May also perform the following activities:
- Monitor Internet Explorer for access to predetermined search engine and auction Web sites.
- Display the URLs of the recorded Web sites in Internet Explorer.
- Send advertisements via instant messengers.
- Display several advertisement popups.

Removal

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}