Main Menu
Contact Us

Spyware.SearchAssistant Spyware Information

Name: Spyware.SearchAssistant
Category: Spyware
Advice: Remove
Risk: Elevated Risk Elevated threats are usually threats that fall into the range of adware in which data about a user's habits are tracked and sent back to a server for analysis without your consent or knowledge.

Spyware.SearchAssistant is a startpage Trojan.

The dropper component drops and loads a randomly-named DLL in the Windows system folder.

Spyware.SearchAssistant attempts to download and execute files from a remote URL.

Spyware.SearchAssistant modifies a number of registry entries relating to startpage settings including some of the following:
HKCUSoftwareMicrosoftInternet ExplorerMainStart Page
HKCUSoftwareMicrosoftInternet ExplorerMainSearch Page
HKCUSoftwareMicrosoftInternet ExplorerMainSearch Bar
HKCUSOFTWAREMicrosoftInternet ExplorerMainUse Search Asst
HKCUSoftwareMicrosoftInternet ExplorerMainUse Custom Search URL
HKCUSoftwareMicrosoftInternet ExplorerMainHOMEOldSP
HKCUSoftwareMicrosoftInternet ExplorerSearchSearchAssistant
HKLMSOFTWAREMicrosoftInternet ExplorerMainStart Page
HKLMSOFTWAREMicrosoftInternet ExplorerMainSearch Page
HKLMSOFTWAREMicrosoftInternet ExplorerMainSearch Bar
HKLMSOFTWAREMicrosoftInternet ExplorerMainUse Search Asst
HKLMSOFTWAREMicrosoftInternet ExplorerMainUse Custom Search URL
HKLMSOFTWAREMicrosoftInternet ExplorerMainHOMEOldSP
HKLMSOFTWAREMicrosoftInternet ExplorerSearchSearchAssistant

Spyware.SearchAssistant may also attempt to modify the HOSTS file, adding a "#" to the start of lines containing the following strings so as to prevent these lines from being used:

Signatures: process: cmd32.exe: MD5 Hash: ddf73e2bab474431c92... process: loadclean.exe: MD5 Hash: ddf73e2bab474431c92... process: lpzxczxct.exe: MD5 Hash: ae07bfdd263dccdc983... process: izxczxcr.exe: MD5 Hash: 9743417b3cffb9194b0... process: intfsdffdsronsad.exe: MD5 Hash: 0364d4ebecdf1dd1571... process: usxxcxzcb.exe: MD5 Hash: 2db1f7f52a8d383cc72... process: intffdsronsad.exe: MD5 Hash: 1a0a2a38914ccba971e... process: intronsad.exe: MD5 Hash: 0e1446d306246b2726f... process: 125932.exe: MD5 Hash: 0391ad94dbfb30a2b98... process: on-line.exe: MD5 Hash: e67fb55035c9e731fc9... process: ncdi.exe: MD5 Hash: c3c5a7c6fa67aba1422... process: q849975.exe: MD5 Hash: fa2b264322cb654eb21... process: gehh.exe: MD5 Hash: c3c5a7c6fa67aba1422... process: on-line.exe: MD5 Hash: 990a9929800e5d82080... process: on-line.exe: MD5 Hash: e6fb366d559e1181a33... process: loadclean.exe: MD5 Hash: d4a4d3126d360102d2f... process: kckgabfg.exe: MD5 Hash: bebbaaf79b8064aa77d... process: on-line.exe: MD5 Hash: ece95891d5e5e4eaf26... process: on-line.exe: MD5 Hash: e2408a798d9d8b6d5d3... process: q514038.exe: MD5 Hash: d5815aa8831f8388b68... process: q202636.exe: MD5 Hash: abd79dec9e50353e892... process: izxczxcr.exe: MD5 Hash: c055d6f2d50b44489fc... process: loadclean.exe: MD5 Hash: 63b52ffc942d2c185b4... process: q243865.exe: MD5 Hash: dc289aae2ce7d7abb98... process: on-line.exe: MD5 Hash: 7d36b7f3ee6014433a2... process: loadclean.exe: MD5 Hash: 8ac95147d47543e7f01... process: coni.exe: MD5 Hash: 6fb8baec107c4753041... process: q680908.exe: MD5 Hash: 9871fb38305c4bc9ab3... process: q173645.exe: MD5 Hash: 620fd196b2a1a25d5e5... process: jgaf.exe: MD5 Hash: ba6b27119c43c655854... process: godg.exe: MD5 Hash: 83179c8350a0c1ceee5... process: 1c.tmp.exe: MD5 Hash: 5199ebf2c0725c93262... process: 1e.tmp.exe: MD5 Hash: 7afc9e0489102b0c4b4... process: sysdf.exe: MD5 Hash: 7520afe58ddee993eac... process: sysqv32.exe: MD5 Hash: 1aa9f1c045138d63f5f... process: netuo32.exe" : MD5 Hash: ..
Type: Spyware - Spyware's primary purpose is to collect demographic and usage information from your computer, usually for advertising purposes. Spyware usually that 'sneaks' onto a system or performs other activities hidden to the user. Spyware programs are usually bundled as a hidden component and downloaded from the Internet. These modules are almost always installed on the system secretively and try to run secretively as well.

Top Spyware Visited Pages:
IEPlugin - Alias: IMIServer IEPlugin, Webplugin, BHO3Lib, ExplWWW, IExpl, MimarSinan, Win Server, winobject, TrojanDow - 125 visits
Spyware.SearchAssistant - Alias: Troj/StartPa-EI - 95 visits
webHancer - Alias: Customer Companion, Webhancer Customer Companion, SpeedRank - 89 visits
PowerReg Scheduler - 89 visits
CWS.Cassandra - 83 visits
Conducent - Alias: Timesink - 78 visits
C2.Lop - Alias: C2 Media, Lop, LopAdvert, MP3Search, MpAdvert, TrojanClicker.Win32.Rotarran - 77 visits
007.msnnames - Alias: access.ocx, jokes.ocx, StopLiteCtrl, StopLite, 007installer - 76 visits
VX2.LocalNRD - Alias: LocalNRD - 76 visits
Aureate - Alias: Aureate Spy, Radiate - 75 visits

Random Spyware Pages:
MediaTickets CDT - Alias: Adware.CDT, CDT, MediaTickets
WinAd Client - Alias: WinAD
ReplaceSearch - Alias: Replace Search
RemEye - Alias: WinVNC.dr, RemEye 1.0


2006-2008 - Privacy Policy