McAfee > Theat Center > PUP Detail Page

Characteristics

McAfee(R) AVERT™ recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application.  If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software.
Please contact the software vendor for further information.
See http://vil.nai.com/vil/DATReadme.asp    for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm    for information about how to enable, disable, and exclude detection of legitimately installed programs.

Summary:

Upon execution of this adware this install itself as a BHO. This redirects the
mistyped urls, adds links to favorites menu and inserts a seach toolbar in
Internet Explorer.

Installation:

File name : EZSEARCH.DLL
MD5         : d41b5106d269a23c7f571e85a23b19ce

Filenames and locations may vary from version to version.
No EULA was observed at the time of installation.

First when executed this adware adds an entry in the hosts file at location
c:\windows\system32\drivers\etc to redirect "auto.search.msn.com" to
64.159.94.251, this redirects the mistyped urls to "ezcybersearch.com".

When Internet Explorer is opened this connects to "ezcybersearch.com" and downloads pictures to c:\windows\system32\pics folder.

In addition to this it also adds a search toolbar to Internet Explorer and adds links in the favorites menu.

The following registry entries are added

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCE83E45-30B2-4BAE-B1F5-25D128D27A43}"=hex:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Browser Helper Objects\{760A9DDE-1433-
4A7C-8189-D6735BB5D3DD}]@="ezSearchBar Helper"

Removal

Aliases

Aliases

N/A