Home Malware Programs Browser Hijackers Trinity

Trinity

Posted: March 28, 2006

Trinity, also identified as Adware.Trinity by some anti-malware companies, is a browser hijacker and adware-based PC threat that attacks your web browser's settings and remains active without your consent. Common symptoms of infection by Trinity include changes to Internet Explorer's homepage, hijacked web searches and the addition of unusual bookmarks. Although Trinity hasn't been noted to have serious attack functions, Trinity lacks any form of beneficial features and should most likely be treated as a minor threat to your PC. Since extremely similar PC threats are often installed in bundles that include other types of software, being observant about potential abuses slipped into software installation routines may help you avoid a Trinity infection.

Trinity – a Deliverer of Ads That Exceeds the Bounds of Common Courtesy

Trinity may be marketed as a search enhancement utility or other type of beneficial add-on during its installation process. Also, Trinity has been noted to promote gambling sites, in addition to creating bookmarks for general-interest topics such as shopping, education and health. However, Trinity's worst functions lie in its browser-hijacking attacks, which use Windows Registry settings to accomplish the following:

  • Change your homepage to disreputable websites such as ireland.rub.to that may attack your PC or promote malicious software.
  • Change your default search engine to equally-suspicious sites such as search.rub.to. In general, SpywareRemove.com malware experts discourage interaction with search engines or associated sites that are promoted by browser hijackers like Trinity.

Knocking This Triple Threat to Your Browser Down a Peg

Trinity attacks have been reported to be specific to Internet Explorer, although SpywareRemove.com malware experts recommend that you delete Trinity with a qualified anti-malware program instead of switching browsers to ignore its attacks. Because Trinity is designed to attack Windows, other operating systems should be safe from Trinity infections, although almost all versions of Windows should be considered to be vulnerable. Since browser hijackers like Trinity can expose you to malicious websites or introduce security vulnerabilities to your PC due to their design, ignoring a Trinity infection can lead to other PC threats and attacks in the future.

Since Trinity may run in the background without being launched, you should use Safe Mode to disable Trinity before you attempt to remove Trinity in a system scan. If you suspect that Trinity is still active even in Safe Mode, you can use Task Manager to verify this and resort to more drastic measures than Safe Mode (such as booting Windows from a removable drive). SpywareRemove.com malware researchers also note that since Trinity was first spotted in 2005, most types of anti-malware scanners should be able to handle Trinity's removal without requiring recent updates or patches.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 ayb.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainSearchBar=[siteaddress]HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainSearchPage=[siteaddress]HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainStartPage=[siteaddress]HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerSearchSearchAssistant=[siteaddress]HKEY_CURRENT_USERSoftwareTrinityAYBHKEY_LOCAL_MACHINESOFTWAREMicrosoftInternetExplorerMainSearchBar=[siteaddress]HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternetExplorerMainSearchPage=[siteaddress]HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternetExplorerSearchSearchAssistant=[siteaddress]

Related Posts

Loading...