McAfee > Theat Center > Virus Detail Page

Overview

Characteristics

This software is not a virus or a Trojan. It is detected as a "potentially unwanted program" (PUP). PUPs are any piece of software that a reasonably security- or privacy-minded computer user may want to be informed of and, in some cases, remove. PUPs are often made by a legitimate corporate entity for some beneficial purpose, but they alter the security state of the computer on which they are installed, or the privacy posture of the user of the system, such that most users will want to be aware of them.

This detection is for the BHO DLL component of the AskToolbar package.

http://vil.nai.com/vil/content/v_146647.htm

The AskToolbar.dll is registered as a 32-bit in-process server DLL and is launched with Internet Explorer as a (Browser Helper Object) BHO everytime IE is loaded.

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{464D5661-3E12-415b-8DF1-8D986745149F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5A074B21-F830-49de-A31B-5BB9D7F6B407}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5A074B23-F830-49de-A31B-5BB9D7F6B407}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5A074B29-F830-49de-A31B-5BB9D7F6B407}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5A074B2B-F830-49de-A31B-5BB9D7F6B407}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5A074B2A-F830-49DE-A31B-5BB9D7F6B407}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5A074B20-F830-49DE-A31B-5BB9D7F6B407}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AskJeevesToolBar.SettingsPlugin
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AskJeevesToolBar.SettingsPlugin.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5A074B21-F830-49de-A31B-5BB9D7F6B407}
HKEY_LOCAL_MACHINE\SOFTWARE\AskBar
HKEY_LOCAL_MACHINE\SOFTWARE\AskBar\bar
The following directories were created during the time of testing:

%ProgramFiles%\AskBar
%Temp%\AskBar\bar
%Temp%\AskBar\bar\Settings
%ProgramFiles%\AskBar\bar
%ProgramFiles%\AskBar\bar\Cache
%ProgramFiles%\AskBar\bar\History
%ProgramFiles%\AskBar\bar\Settings
The following files were created during the time of testing:

%UserProfile%\Desktop\askBar.dll
%Temp%\AskBar\bar\Settings\settings.dat
%Temp%\AskBar\bar\Settings\settings.htm
%ProgramFiles%\AskBar\bar\Cache\00018F1B
%ProgramFiles%\AskBar\bar\Cache\00018F98
%ProgramFiles%\AskBar\bar\Cache\files.ini
%ProgramFiles%\AskBar\bar\History\search

These are general defaults for typical path variables. (Although they may differ, these examples are common.):
%UserProfile% = \Documents and Settings\Administrator
%AllUserProfile% = \Documents and Settings\All Users
%AppData% = \Documents and Settings\Administrator\Application Data
%CommonProgramFiles% = \Program Files\Common Files
%WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

Symptoms

Method of Infection

Removal

Variants

Variants

N/A

All Information

Overview -

Characteristics

Characteristics -

This software is not a virus or a Trojan. It is detected as a "potentially unwanted program" (PUP). PUPs are any piece of software that a reasonably security- or privacy-minded computer user may want to be informed of and, in some cases, remove. PUPs are often made by a legitimate corporate entity for some beneficial purpose, but they alter the security state of the computer on which they are installed, or the privacy posture of the user of the system, such that most users will want to be aware of them.

This detection is for the BHO DLL component of the AskToolbar package.

http://vil.nai.com/vil/content/v_146647.htm

The AskToolbar.dll is registered as a 32-bit in-process server DLL and is launched with Internet Explorer as a (Browser Helper Object) BHO everytime IE is loaded.

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{464D5661-3E12-415b-8DF1-8D986745149F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5A074B21-F830-49de-A31B-5BB9D7F6B407}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5A074B23-F830-49de-A31B-5BB9D7F6B407}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5A074B29-F830-49de-A31B-5BB9D7F6B407}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5A074B2B-F830-49de-A31B-5BB9D7F6B407}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5A074B2A-F830-49DE-A31B-5BB9D7F6B407}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5A074B20-F830-49DE-A31B-5BB9D7F6B407}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AskJeevesToolBar.SettingsPlugin
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AskJeevesToolBar.SettingsPlugin.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5A074B21-F830-49de-A31B-5BB9D7F6B407}
HKEY_LOCAL_MACHINE\SOFTWARE\AskBar
HKEY_LOCAL_MACHINE\SOFTWARE\AskBar\bar
The following directories were created during the time of testing:

%ProgramFiles%\AskBar
%Temp%\AskBar\bar
%Temp%\AskBar\bar\Settings
%ProgramFiles%\AskBar\bar
%ProgramFiles%\AskBar\bar\Cache
%ProgramFiles%\AskBar\bar\History
%ProgramFiles%\AskBar\bar\Settings
The following files were created during the time of testing:

%UserProfile%\Desktop\askBar.dll
%Temp%\AskBar\bar\Settings\settings.dat
%Temp%\AskBar\bar\Settings\settings.htm
%ProgramFiles%\AskBar\bar\Cache\00018F1B
%ProgramFiles%\AskBar\bar\Cache\00018F98
%ProgramFiles%\AskBar\bar\Cache\files.ini
%ProgramFiles%\AskBar\bar\History\search

These are general defaults for typical path variables. (Although they may differ, these examples are common.):
%UserProfile% = \Documents and Settings\Administrator
%AllUserProfile% = \Documents and Settings\All Users
%AppData% = \Documents and Settings\Administrator\Application Data
%CommonProgramFiles% = \Program Files\Common Files
%WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

Symptoms

Symptoms -

Method of Infection

Method of Infection -

Removal -

Removal -

Variants

Variants -

N/A