Home Malware Programs Browser Plugins MWSearch

MWSearch

Posted: March 28, 2006

MWSearch is a simple Internet Explorer search toolbar related to the morwillsearch.com domain. It offers a web search service, but also may show undesirable commercial advertisements. MWSearch doesn't have dangerous payload. It runs every time the user opens Internet Explorer.

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_CLASSES_ROOTMWSearch.StockBarHKEY_CLASSES_ROOTMWSearch.StockBar.1HKEY_CLASSES_ROOTMWSearch.cfgwrHKEY_CLASSES_ROOTMWSearch.cfgwr.1HKEY_CLASSES_ROOTMWSearch.tbactivatorHKEY_CLASSES_ROOTMWSearch.tbactivator.1HKEY_LOCAL_MACHINESOFTWAREMWSearchCoMWSearchHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallMWSearch
  • The following CLSID's were detected:
    HKEY..\..\{CLSID Path}84C94803-B5EC-4491-B2BE-7B113E013B77F4394F24-163D-430B-B5AF-B68B56031B99DCFAB192-4A0E-4720-8E24-70D5F0CB8C396DEEE498-08CC-43F0-BCA0-DBB5A25C9501FFF5092F-7172-4018-827B-FA5868FB0478D7BF3304-138B-4DD5-86EE-491BB6A2286CA6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB
Loading...