When the program is executed, it creates the following registry subkey:
The program then checks if Mozilla Firefox is installed on the computer. If so, the prefs.js file is modified so that the home page and default search provider point to the following location:
It also attempts to modify the home page and default search provider for Internet Explorer by modifying the following registry entries:
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\"Start Page" = "http://www.easysear.ch/"
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\"Default" = "http://www.easysear.ch/"
The program may also update itself without the user's consent.