McAfee > Theat Center > PUP Detail Page

Characteristics

McAfee(R) AVERT recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application. If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software. Please contact the software vendor for further information.

See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.

Distribution

This is not a virus or a trojan. It is detected as a "potentially unwanted program." It is a direct-marketing adware application that may insert new links into web page content during browsing. The main component is a DLL installed as a Browser Helper Object in Internet Explorer.

No company name or other authorship identification could be found in any file properties. An entry titled "Words Text 1.0" is created in the Add/Remove Programs control panel when register.exe is executed (along with performing registration and setup of the necessary registry keys to engage the DLL as a BHO). Reports indicate new links redirecting to searchmeup.com or other search engines (multiple variants may exist).

No license agreement is displayed on execution of register.exe.

Privacy

A privacy policy is not displayed during installation. The origin and author are unknown, so it is not known whether any applicable policy might be available online.

System Changes

General defaults for typical path variables (although they may be different, they usually are not):
%WinDir% = \WINDOWS (Windows 9x/ME/XP), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM32 (Windows 9x/ME/XP), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

Files Added

• searcher.dll (148 KB)
  MD5: 7F3653D34CFD30DB96C4FB85A9E5F07E
• register.exe (28 KB)
  MD5: 4D9289F27591A6F971CFF54E63169137

Registry

The following registry keys are created:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
  \Uninstall\Words Text 1.0
  
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
  \Explorer\Browser Helper Objects\{6D9F42B8-B7E5-4BB9-9A13-CAE53D44196E}
  
• HKEY_CLASSES_ROOT\TypeLib\{B2E71425-63E3-481E-A04F-2242128D60AA}
  
• HKEY_CLASSES_ROOT\searcher.class_searcher.1
  
• HKEY_CLASSES_ROOT\searcher.class_searcher
  
• HKEY_CLASSES_ROOT\Interface\{54C87CED-A811-440A-8A6F-B0E1E9C568B9}
  
• HKEY_CLASSES_ROOT\CLSID\{6D9F42B8-B7E5-4BB9-9A13-CAE53D44196E}
  

Network Impact

Possible additional overhead in bandwidth due to download of content or link data.

Removal

Aliases

Aliases

N/A