McAfee > Theat Center > Virus Detail Page

Overview

This is a Potentially Unwanted Program (PUP) detection. It is not a virus or trojan. PUPs are any piece of software which a reasonably security-or privacy-minded computer user may want to be informed of.

Characteristics

This program is detected as a "potentially unwanted application".  It is neither a virus nor a trojan.

This kind of application generally comes bundled with another program, which usually discloses the fact that it is ad-supported.  Users agree to have the Adware installed in the license agreement, although they may not realise at first that this file was packaged with the product they installed.

There are different variants of this program.  The description is a general guide.

Upon exectuion it silently downloads and installs the Search tool bar in the IE without user notification.

After the installation the browser may appear as below.

Drops 2020search2.dll in %Windows% Folder and installs it as a 2020 search tool bar.
Sends Os version and User info at the time of installation to remote site "srng05.srng.net/../reg.php"

Upon execution, the application does the following

• Add's a search bar as a plugin to IE using 2020search2.dll as a BHO.
• It changes default search page to "http://search.2020search.com/../redir.php?"
• It removes start page of IE.
• It removes the "CustomizeSearch" of IE
• It changes the "SearchAssistant" of IE to one of its site http://pop.popuptoat.com/../search.html
• It downloads and installs another Adware bundled with it. Detected as Adware-SRNG

The following registry key(s) are created

•  HKEY_CLASSES_ROOT\2020search2.2020SEARCH2
•  HKEY_CLASSES_ROOT\CLSID\{4E7BD74F-2B8D-469E-92C6-CE7EB590A94D}
•  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\Explorer\Browser Helper Objects\ {4E7BD74F-2B8D-469E-2C6-CE7EB590A94D}
•  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\Uninstall\2020SEARCHTB
  

The detection of this type of file is not automatically activated. Users who would like to check for the presence of this kind of files on their system should run the command line scanner with the /PROGRAM switch.
Please note that VirusScan 7, and higher, has also an option, which enables users to detect this kind of program automatically (see below).

Symptoms

The presence of 2020Search2.dll in %Windows% folder.

Method of Infection

Removal

Instructions on Enabling/Disabling Detection and Removal of Potentially Unwanted Programs

Variants

Variants

N/A

All Information

Overview -

This is a Potentially Unwanted Program (PUP) detection. It is not a virus or trojan. PUPs are any piece of software which a reasonably security-or privacy-minded computer user may want to be informed of.

Characteristics

Characteristics -

This program is detected as a "potentially unwanted application".  It is neither a virus nor a trojan.

This kind of application generally comes bundled with another program, which usually discloses the fact that it is ad-supported.  Users agree to have the Adware installed in the license agreement, although they may not realise at first that this file was packaged with the product they installed.

There are different variants of this program.  The description is a general guide.

Upon exectuion it silently downloads and installs the Search tool bar in the IE without user notification.

After the installation the browser may appear as below.

Drops 2020search2.dll in %Windows% Folder and installs it as a 2020 search tool bar.
Sends Os version and User info at the time of installation to remote site "srng05.srng.net/../reg.php"

Upon execution, the application does the following

• Add's a search bar as a plugin to IE using 2020search2.dll as a BHO.
• It changes default search page to "http://search.2020search.com/../redir.php?"
• It removes start page of IE.
• It removes the "CustomizeSearch" of IE
• It changes the "SearchAssistant" of IE to one of its site http://pop.popuptoat.com/../search.html
• It downloads and installs another Adware bundled with it. Detected as Adware-SRNG

The following registry key(s) are created

•  HKEY_CLASSES_ROOT\2020search2.2020SEARCH2
•  HKEY_CLASSES_ROOT\CLSID\{4E7BD74F-2B8D-469E-92C6-CE7EB590A94D}
•  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\Explorer\Browser Helper Objects\ {4E7BD74F-2B8D-469E-2C6-CE7EB590A94D}
•  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\Uninstall\2020SEARCHTB
  

The detection of this type of file is not automatically activated. Users who would like to check for the presence of this kind of files on their system should run the command line scanner with the /PROGRAM switch.
Please note that VirusScan 7, and higher, has also an option, which enables users to detect this kind of program automatically (see below).

Symptoms

Symptoms -

The presence of 2020Search2.dll in %Windows% folder.

Method of Infection

Method of Infection -

Removal -

Removal -

Instructions on Enabling/Disabling Detection and Removal of Potentially Unwanted Programs

Variants

Variants -

N/A