When Adware.Fastwebfinder is executed, it does one of the following:
Adware.Fastwebfinder is not yet installed in %Windir% folder
If Adware.Fastwebfinder does not find the file %Windir%\Ld.exe, it will do the following:
Adware.Fastwebfinder is already installed in the %Windir% folder
- Copies itself as %Windir%\Ld.exe.
Note: %Windir% is a variable. The adware locates the Windows installation folder (by default, this is C:\Windows or C:\Winnt) and copies itself to that location.
- Adds the value:
to the registry key:
so that the adware runs each time you start Windows.
If Adware.Fastwebfinder finds the file %Windir%\Ld.exe, it will do the following:
- Connects to www.fastwebfinder.com.
- Downloads information, including the file Dnse.dll, which it copies to the %Windir% folder.
Then, this information is used to hijack the following (of Internet Explorer):
- Home Page
- Search Bar
- Search Assistant