Home Malware Programs Browser Hijackers CSearch

CSearch

Posted: March 28, 2006

CSearch is a relatively harmless browser hijacker that changes Internet Explorer default search page to searchmain.com site. The spyware can get into the computer along with some ad-supported software.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 csearch.dll

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_CLASSES_ROOTCsearch.BandHKEY_CLASSES_ROOTCsearch.Band.1HKEY_CLASSES_ROOTCsearch.RedirectHKEY_CLASSES_ROOTCsearch.Redirect.1HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternetExplorerMainSearchPage=[siteaddress]HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternetExplorerSearchCustomizeSearch=[siteaddress]HKEY_USERS[User]SoftwareISTechnologiesHKEY_USERS[User]SoftwareMicrosoftInternetExplorerMainSearchPage=[siteaddress]HKEY_USERS[User]SoftwareMicrosoftInternetExplorerSearchUrl(default)=[siteaddress]HKEY_USERS[User]SoftwareMicrosoftSearchAssistantDefaultSearchURL=[siteaddress]
  • The following CLSID's were detected:
    HKEY..\..\{CLSID Path}DEB0BC8B-7405-4B97-9489-89D72C27678AF250A919-FB4B-4120-9F2E-E5FE03FB820209C33C5E-2B76-47FE-B97B-9788235A3876064CB07A-9ECD-46FD-8E10-1D3C5FF218CAD8FA0364-7866-40A7-B340-A6069265AD9F

Related Posts

Loading...