Content
Adware-Mirar
- Type
- Program
- SubType
- Adware
- Discovery Date
- 03/29/2005
- Length
- Minimum DAT
- 4342 (03/24/2004)
- Updated DAT
- 5277 (04/18/2008)
- Minimum Engine
- 5.1.00
- Description Added
- 04/26/2004
- Description Modified
- 10/07/2005 11:08 AM (PT)
Tab Navigation
Characteristics
McAfee(R) AVERT recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application. If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software. Please contact the software vendor for further information.
See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.
See http://vil.nai.com/vil/pups/configuration.htm
for information about how to enable, disable, and exclude detection of legitimately installed programs.
Distribution
This is not a virus or a trojan. It is detected as a "potentially unwanted program." It is a direct-marketing adware application that creates a toolbar in Internet Explorer browser. Any search key word is redirected to net-nucleus.com, from where related ads are downloaded and shown within the toolbar. A popup is also shown as mouse pointer hovers around the toolbar, making the user prone to accidentally click it and gets redirected.
This application does not display a license agreement when installed. The full text of the license agreement can be accessed on the author's website http://policy.getmirar.com/EULA.html
Privacy
A privacy policy is not displayed during installation. The software transmits search keyword data to to its own servers during browsing.
System Changes
Files Added
- %SystemDir%\winnb57.dll (304 KB)
- %SystemDir%\windmy.dll (32 KB)
Registry
The following registry keys are created (Only most Significant):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}
"UninstallString"="mshta.exe http://remove.getmirar.com/ "
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}
"DisplayName"="Related Page"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Internet Settings\ZoneMap\Domains\net-nucleus.com\awbeta
"https"="2"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Internet Settings\ZoneMap\Domains\net-nucleus.com\awbeta
"http"="2"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Internet Settings\ZoneMap\Domains\net-nucleus.com\awbeta
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Browser Helper Objects\{9A9C9B69-F908-4AAB-8D0C-10EA8997F37E}
"default"="Related Page"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
"{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}"="0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
"{8E718888-423F-11D2-876E-00A0C9082467}"="00"
HKEY_CLASSES_ROOT\TypeLib\{F8310E7D-4C4D-46A4-A068-B5BB99411CC7}
\1.0\0\win32
"default"="C:\WINDOWS\System32\WinDmy.dll"
HKEY_CLASSES_ROOT\TypeLib\{F8310E7D-4C4D-46A4-A068-B5BB99411CC7}
\1.0
"default"="NN_Bar_Dummy 1.0 Type Library"
HKEY_CLASSES_ROOT\TypeLib\{566DEDE9-9ED8-45DA-9BE6-9B2EEAB17F49}
\1.0\0\win32
"default"="C:\WINDOWS\System32\WinNB57.dll"
HKEY_CLASSES_ROOT\TypeLib\{566DEDE9-9ED8-45DA-9BE6-9B2EEAB17F49}
\1.0
"default"="NN_Bar 1.0 Type Library"
HKEY_CLASSES_ROOT\NN_Bar_Dummy.NN_BarDummy.1\CLSID
"default"="{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}"
HKEY_CLASSES_ROOT\NN_Bar_Dummy.NN_BarDummy.1
"default"="NN_BarDummy Class"
HKEY_CLASSES_ROOT\NN_Bar_Dummy.NN_BarDummy\CurVer
"default"="NN_Bar_Dummy.NN_BarDummy.1"
HKEY_CLASSES_ROOT\NN_Bar_Dummy.NN_BarDummy\CLSID
"default"="{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}"
HKEY_CLASSES_ROOT\NN_Bar_Dummy.NN_BarDummy
"default"="NN_BarDummy Class"
HKEY_CLASSES_ROOT\Interface\{6E4C7AFC-9915-4036-B7F9
-8B3F1710788F}\TypeLib
"(default)"="{566DEDE9-9ED8-45DA-9BE6-9B2EEAB17F49}"
HKEY_CLASSES_ROOT\Interface\{6E4C7AFC-9915-4036-B7F9
-8B3F1710788F}\ProxyStubClsid32
"default"="{00020424-0000-0000-C000-000000000046}"
HKEY_CLASSES_ROOT\Interface\{6E4C7AFC-9915-4036-B7F9
-8B3F1710788F}\ProxyStubClsid
"default"="{00020424-0000-0000-C000-000000000046}"
HKEY_CLASSES_ROOT\Interface\{6E4C7AFC-9915-4036-B7F9
-8B3F1710788F}
"default"="INN_WebBand"
HKEY_CLASSES_ROOT\Interface\{54B287F9-FD90-4457-B65E
-CB91560C021D}\TypeLib
"(default)"="{566DEDE9-9ED8-45DA-9BE6-9B2EEAB17F49}"
HKEY_CLASSES_ROOT\Interface\{54B287F9-FD90-4457-B65E
-CB91560C021D}\ProxyStubClsid32
"default"="{00020424-0000-0000-C000-000000000046}"
HKEY_CLASSES_ROOT\Interface\{54B287F9-FD90-4457-B65E
-CB91560C021D}\ProxyStubClsid
"default"="{00020424-0000-0000-C000-000000000046}"
HKEY_CLASSES_ROOT\Interface\{54B287F9-FD90-4457-B65E
-CB91560C021D}
"default"="INN_Bar_Helper"
HKEY_CLASSES_ROOT\Interface\{224302B0-94E9-45C2-9E5B
-BA989EE556E1}\TypeLib
"(default)"="{F8310E7D-4C4D-46A4-A068-B5BB99411CC7}"
HKEY_CLASSES_ROOT\Interface\{224302B0-94E9-45C2-9E5B
-BA989EE556E1}\ProxyStubClsid32
"default"="{00020424-0000-0000-C000-000000000046}"
HKEY_CLASSES_ROOT\Interface\{224302B0-94E9-45C2-9E5B
-BA989EE556E1}\ProxyStubClsid
"default"="{00020424-0000-0000-C000-000000000046}"
HKEY_CLASSES_ROOT\Interface\{224302B0-94E9-45C2-9E5B
-BA989EE556E1}
"default"="INN_BarDummy"
HKEY_CLASSES_ROOT\Interface\{1037B06C-84B7-4240-8D80
-485810A0497D}\TypeLib
"(default)"="{566DEDE9-9ED8-45DA-9BE6-9B2EEAB17F49}"
HKEY_CLASSES_ROOT\Interface\{1037B06C-84B7-4240-8D80
-485810A0497D}\ProxyStubClsid32
"default"="{00020420-0000-0000-C000-000000000046}"
HKEY_CLASSES_ROOT\Interface\{1037B06C-84B7-4240-8D80
-485810A0497D}\ProxyStubClsid
"default"="{00020420-0000-0000-C000-000000000046}"
HKEY_CLASSES_ROOT\Interface\{1037B06C-84B7-4240-8D80
-485810A0497D}
"default"="_INN_WebBandEvents"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B69-F908-4AAB-8D0C-10EA8997F37E}
\TypeLib
"default"="{566DEDE9-9ED8-45DA-9BE6-9B2EEAB17F49}"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B69-F908-4AAB-8D0C-10EA8997F37E}
\InprocServer32
"ThreadingModel"="Apartment"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B69-F908-4AAB-8D0C-10EA8997F37E}
\InprocServer32
"(default)"="C:\WINDOWS\System32\WinNB57.dll"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
\TypeLib
"default"="{566DEDE9-9ED8-45DA-9BE6-9B2EEAB17F49}"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
\Properties
"Ticket"="02813714255679"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
\Properties
"BlockEnable"="1"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
\Properties
"PopupCount"="0"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
\Properties
"ShowType"="1"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
\Properties
"Show3X"="1"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
\Properties
"BuildName"="875455"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
\Properties
"Version"="57"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
\InprocServer32
"ThreadingModel"="Apartment"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
\InprocServer32
"(default)"="C:\WINDOWS\System32\WinNB57.dll"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
"default"="Related Page"
HKEY_CLASSES_ROOT\CLSID\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}
\VersionIndependentProgID
"default"="NN_Bar_Dummy.NN_BarDummy"
HKEY_CLASSES_ROOT\CLSID\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}
\TypeLib
"default"="{F8310E7D-4C4D-46A4-A068-B5BB99411CC7}"
HKEY_CLASSES_ROOT\CLSID\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}
\ProgID
"default"="NN_Bar_Dummy.NN_BarDummy.1"
HKEY_CLASSES_ROOT\CLSID\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}
\InprocServer32
"ThreadingModel"="Apartment"
HKEY_CLASSES_ROOT\CLSID\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}
\InprocServer32
"(default)"="C:\WINDOWS\System32\WinDmy.dll"
HKEY_CLASSES_ROOT\CLSID\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}
"default"="NN_BarDummy Class"
The following registry keys are modified:
- HKEY_USERS\S-1-5-21-854245398-1383384898-842925246-500
\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
"{0E5CBF21-D15F-11D0-8301-00AA005B4383}"="(large amount of hex data) - checksum F0C0546122F3AF764B7DCBC26E1147CA"
- HKEY_USERS\S-1-5-21-854245398-1383384898-842925246-500
\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
"ITBarLayout"="(large amount of hex data) - checksum BFBE59250AF8355DADAD5DFC6A0B21B8"
Network Impact
Slowdown due to download of search keyword hijack related data from its own servers. The adware is observed to contact following site.
- net-nucleus.com
Symptoms
N/A This is not a virus or trojan.
Method of Infection
N/A This is not a virus or trojan.
Variants
Variants
N/A
All Information
Overview -
This is a Potentially Unwanted Program (PUP) detection. It is not a virus or trojan. PUPs are any piece of software which a reasonably security-or privacy-minded computer user may want to be informed of.
Aliases
- Adware-Mirar
Characteristics
Characteristics -
McAfee(R) AVERT recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application. If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software. Please contact the software vendor for further information.
See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.
See http://vil.nai.com/vil/pups/configuration.htm
for information about how to enable, disable, and exclude detection of legitimately installed programs.
Distribution
This is not a virus or a trojan. It is detected as a "potentially unwanted program." It is a direct-marketing adware application that creates a toolbar in Internet Explorer browser. Any search key word is redirected to net-nucleus.com, from where related ads are downloaded and shown within the toolbar. A popup is also shown as mouse pointer hovers around the toolbar, making the user prone to accidentally click it and gets redirected.
This application does not display a license agreement when installed. The full text of the license agreement can be accessed on the author's website http://policy.getmirar.com/EULA.html
Privacy
A privacy policy is not displayed during installation. The software transmits search keyword data to to its own servers during browsing.
System Changes
Files Added
- %SystemDir%\winnb57.dll (304 KB)
- %SystemDir%\windmy.dll (32 KB)
Registry
The following registry keys are created (Only most Significant):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}
"UninstallString"="mshta.exe http://remove.getmirar.com/ "
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}
"DisplayName"="Related Page"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Internet Settings\ZoneMap\Domains\net-nucleus.com\awbeta
"https"="2"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Internet Settings\ZoneMap\Domains\net-nucleus.com\awbeta
"http"="2"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Internet Settings\ZoneMap\Domains\net-nucleus.com\awbeta
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Browser Helper Objects\{9A9C9B69-F908-4AAB-8D0C-10EA8997F37E}
"default"="Related Page"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
"{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}"="0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
"{8E718888-423F-11D2-876E-00A0C9082467}"="00"
HKEY_CLASSES_ROOT\TypeLib\{F8310E7D-4C4D-46A4-A068-B5BB99411CC7}
\1.0\0\win32
"default"="C:\WINDOWS\System32\WinDmy.dll"
HKEY_CLASSES_ROOT\TypeLib\{F8310E7D-4C4D-46A4-A068-B5BB99411CC7}
\1.0
"default"="NN_Bar_Dummy 1.0 Type Library"
HKEY_CLASSES_ROOT\TypeLib\{566DEDE9-9ED8-45DA-9BE6-9B2EEAB17F49}
\1.0\0\win32
"default"="C:\WINDOWS\System32\WinNB57.dll"
HKEY_CLASSES_ROOT\TypeLib\{566DEDE9-9ED8-45DA-9BE6-9B2EEAB17F49}
\1.0
"default"="NN_Bar 1.0 Type Library"
HKEY_CLASSES_ROOT\NN_Bar_Dummy.NN_BarDummy.1\CLSID
"default"="{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}"
HKEY_CLASSES_ROOT\NN_Bar_Dummy.NN_BarDummy.1
"default"="NN_BarDummy Class"
HKEY_CLASSES_ROOT\NN_Bar_Dummy.NN_BarDummy\CurVer
"default"="NN_Bar_Dummy.NN_BarDummy.1"
HKEY_CLASSES_ROOT\NN_Bar_Dummy.NN_BarDummy\CLSID
"default"="{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}"
HKEY_CLASSES_ROOT\NN_Bar_Dummy.NN_BarDummy
"default"="NN_BarDummy Class"
HKEY_CLASSES_ROOT\Interface\{6E4C7AFC-9915-4036-B7F9
-8B3F1710788F}\TypeLib
"(default)"="{566DEDE9-9ED8-45DA-9BE6-9B2EEAB17F49}"
HKEY_CLASSES_ROOT\Interface\{6E4C7AFC-9915-4036-B7F9
-8B3F1710788F}\ProxyStubClsid32
"default"="{00020424-0000-0000-C000-000000000046}"
HKEY_CLASSES_ROOT\Interface\{6E4C7AFC-9915-4036-B7F9
-8B3F1710788F}\ProxyStubClsid
"default"="{00020424-0000-0000-C000-000000000046}"
HKEY_CLASSES_ROOT\Interface\{6E4C7AFC-9915-4036-B7F9
-8B3F1710788F}
"default"="INN_WebBand"
HKEY_CLASSES_ROOT\Interface\{54B287F9-FD90-4457-B65E
-CB91560C021D}\TypeLib
"(default)"="{566DEDE9-9ED8-45DA-9BE6-9B2EEAB17F49}"
HKEY_CLASSES_ROOT\Interface\{54B287F9-FD90-4457-B65E
-CB91560C021D}\ProxyStubClsid32
"default"="{00020424-0000-0000-C000-000000000046}"
HKEY_CLASSES_ROOT\Interface\{54B287F9-FD90-4457-B65E
-CB91560C021D}\ProxyStubClsid
"default"="{00020424-0000-0000-C000-000000000046}"
HKEY_CLASSES_ROOT\Interface\{54B287F9-FD90-4457-B65E
-CB91560C021D}
"default"="INN_Bar_Helper"
HKEY_CLASSES_ROOT\Interface\{224302B0-94E9-45C2-9E5B
-BA989EE556E1}\TypeLib
"(default)"="{F8310E7D-4C4D-46A4-A068-B5BB99411CC7}"
HKEY_CLASSES_ROOT\Interface\{224302B0-94E9-45C2-9E5B
-BA989EE556E1}\ProxyStubClsid32
"default"="{00020424-0000-0000-C000-000000000046}"
HKEY_CLASSES_ROOT\Interface\{224302B0-94E9-45C2-9E5B
-BA989EE556E1}\ProxyStubClsid
"default"="{00020424-0000-0000-C000-000000000046}"
HKEY_CLASSES_ROOT\Interface\{224302B0-94E9-45C2-9E5B
-BA989EE556E1}
"default"="INN_BarDummy"
HKEY_CLASSES_ROOT\Interface\{1037B06C-84B7-4240-8D80
-485810A0497D}\TypeLib
"(default)"="{566DEDE9-9ED8-45DA-9BE6-9B2EEAB17F49}"
HKEY_CLASSES_ROOT\Interface\{1037B06C-84B7-4240-8D80
-485810A0497D}\ProxyStubClsid32
"default"="{00020420-0000-0000-C000-000000000046}"
HKEY_CLASSES_ROOT\Interface\{1037B06C-84B7-4240-8D80
-485810A0497D}\ProxyStubClsid
"default"="{00020420-0000-0000-C000-000000000046}"
HKEY_CLASSES_ROOT\Interface\{1037B06C-84B7-4240-8D80
-485810A0497D}
"default"="_INN_WebBandEvents"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B69-F908-4AAB-8D0C-10EA8997F37E}
\TypeLib
"default"="{566DEDE9-9ED8-45DA-9BE6-9B2EEAB17F49}"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B69-F908-4AAB-8D0C-10EA8997F37E}
\InprocServer32
"ThreadingModel"="Apartment"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B69-F908-4AAB-8D0C-10EA8997F37E}
\InprocServer32
"(default)"="C:\WINDOWS\System32\WinNB57.dll"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
\TypeLib
"default"="{566DEDE9-9ED8-45DA-9BE6-9B2EEAB17F49}"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
\Properties
"Ticket"="02813714255679"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
\Properties
"BlockEnable"="1"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
\Properties
"PopupCount"="0"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
\Properties
"ShowType"="1"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
\Properties
"Show3X"="1"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
\Properties
"BuildName"="875455"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
\Properties
"Version"="57"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
\InprocServer32
"ThreadingModel"="Apartment"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
\InprocServer32
"(default)"="C:\WINDOWS\System32\WinNB57.dll"
HKEY_CLASSES_ROOT\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
"default"="Related Page"
HKEY_CLASSES_ROOT\CLSID\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}
\VersionIndependentProgID
"default"="NN_Bar_Dummy.NN_BarDummy"
HKEY_CLASSES_ROOT\CLSID\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}
\TypeLib
"default"="{F8310E7D-4C4D-46A4-A068-B5BB99411CC7}"
HKEY_CLASSES_ROOT\CLSID\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}
\ProgID
"default"="NN_Bar_Dummy.NN_BarDummy.1"
HKEY_CLASSES_ROOT\CLSID\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}
\InprocServer32
"ThreadingModel"="Apartment"
HKEY_CLASSES_ROOT\CLSID\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}
\InprocServer32
"(default)"="C:\WINDOWS\System32\WinDmy.dll"
HKEY_CLASSES_ROOT\CLSID\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}
"default"="NN_BarDummy Class"
The following registry keys are modified:
- HKEY_USERS\S-1-5-21-854245398-1383384898-842925246-500
\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
"{0E5CBF21-D15F-11D0-8301-00AA005B4383}"="(large amount of hex data) - checksum F0C0546122F3AF764B7DCBC26E1147CA"
- HKEY_USERS\S-1-5-21-854245398-1383384898-842925246-500
\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
"ITBarLayout"="(large amount of hex data) - checksum BFBE59250AF8355DADAD5DFC6A0B21B8"
Network Impact
Slowdown due to download of search keyword hijack related data from its own servers. The adware is observed to contact following site.
- net-nucleus.com
Symptoms
Symptoms -
N/A This is not a virus or trojan.
Method of Infection
Method of Infection -
N/A This is not a virus or trojan.
Removal -
Removal -
Instructions on Enabling/Disabling Detection and Removal of Potentially Unwanted Programs
Variants
Variants -
N/A
