PUA.Win32.MyWebSearch.IZ.component

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It modifies the user's Internet Explorer home page into a certain website. This action allows the malware to point to a website which may contain malware, putting the affected computer at greater risk of malware infection.

It connects to certain websites to send and receive information. It redirects browsers to certain sites. However, as of this writing, the said sites are inaccessible.

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application drops the following files:

• %User Temp%\nso{random}.tmp\nsDialogs.dll
• %User Temp%\nso{random}.tmp\System.dll
• %User Temp%\nso{random}.tmp\reporting
• %User Temp%\nso{random}.tmp\HeadlineAlley_msi_bg-copy_{random}.bmp
• %User Temp%\nso{random}.tmp\cancel_blue_{random}.bmp
• %User Temp%\nso{random}.tmp\Install_ENG_{random}.bmp
• %User Temp%\nso{random}.tmp\installerParams
• %User Temp%\nso{random}.tmp\HeadlineAlley_msi_bg-copy_{random}.bmp
• %AppDataLocal%\HeadlineAlleyTooltab\TooltabExtension.dll

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other System Modifications

This Potentially Unwanted Application adds the following registry entries:

HKEY_CURRENT_USER\Software\HeadlineAlley
Start Page = https://hp.{BLOCKED}y.com/headlinealley/ttab02/index.html?n={random}&p2=^Z5^mni000^TTAB02&ptb={randomly generated ID}&coid={randomly generated ID}

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\TabbedBrowsing
NewTabPageShow = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
HeadlineAlleyTooltab Uninstall Internet Explorer
DisplayName = HeadlineAlley Internet Explorer Homepage and New Tab

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
HeadlineAlleyTooltab Uninstall Internet Explorer
UninstallString = Rundll32.exe "%AppDataLocal%\HeadlineAlleyTooltab\TooltabExtension.dll" U uninstall:HeadlineAlley

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
HeadlineAlleyTooltab Uninstall Internet Explorer
Publisher = Mindspark Interactive Network, Inc.

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
HeadlineAlleyTooltab Uninstall Internet Explorer
HelpLink = http://support.{BLOCKED}rk.com/

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
HeadlineAlleyTooltab Uninstall Internet Explorer
URLInfoAbout = http://support.{BLOCKED}rk.com/

HKEY_CURRENT_USER\Software\HeadlineAlley
UnInstallSurveyUrl = https://@{downloadDomain}.dl.myway.com/uninstall.jhtml?c={randomly generated ID}&ptb=^Z5^mni000^TTAB02

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Start Page = https://hp.{BLOCKED}y.com/headlinealley/ttab02/index.html?n={random}&p2=^Z5^mni000^TTAB02&ptb={randomly generated ID}&coid={randomly generated ID}

Web Browser Home Page and Search Page Modification

This Potentially Unwanted Application modifies the user's Internet Explorer home page to the following websites:

• https://hp.{BLOCKED}y.com/headlinealley/ttab02/index.html?n={random}&p2=^Z5^mni000^TTAB02&ptb={randomly generated ID}&coid={randomly generated ID}

Other Details

This Potentially Unwanted Application adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
HeadlineAlleyTooltab Uninstall Internet Explorer

HKEY_CURRENT_USER\Software\HeadlineAlley

It connects to the following website to send and receive information:

• https://anx.{BLOCKED}ark.com/anx.gif?anxa=CAPDownloadProcess&anxe=Error&errorCode=&errorType=&errorDetails=&platform=&anxv=
  2.7.1.3000&anxd=2019-11-27&coid=&refPartner=^Z5^mni000^TTAB02
  &refSub=&anxl={language}&anxr={random}&refCobrand=Z5&refCampaign=mni000
  &refTrack=TTAB02&refCountry=
• https://anx.{BLOCKED}ark.com/anx.gif?anxa=CAPDownloadProcess&anxe=Installer
  Invoked&platform=&anxv=2.7.1.3000&anxd=2019-11-
  27&coid={randomly generated ID}
  &refPartner=^Z5^mni000^TTAB02&ref
  Sub=&anxl={language}&anxr=
  {random}&refCobrand=Z5&refCampaign
  =mni000&refTrack=TTAB02&refCountry=
• https://anx.{BLOCKED}ark.com/anx.gif?anxa=CAPDownloadProcess&anxe=Installer
  Finished&tbUID={randomly generated
  ID}&tbVer=&platform=vicinio&anxv=
  2.7.1.3000&anxd=2019-11-27&coid=
  {randomly generated ID}&refPartner=
  ^Z5^mni000^TTAB02&refSub=&anxl=
  {language}&anxr=-2089466527&refCobrand=
  Z5&refCampaign=mni000&refTrack=TTAB02&refCountry=
• https://dp.tb.{BLOCKED}k.com/installerParams.jhtml?coId={randomly generated ID}

It redirects browsers to the following sites:

• https://hp.{BLOCKED}y.com/headlinealley/ttab02/index.html?n={random}&p2=^Z5^mni000^TTAB02&ptb={randomly generated ID}&coid={randomly generated ID}
• https://hp.{BLOCKED}y.com/unsupported/myway/

It does the following:

• It displays the following upon execution:
  
  It does not proceed to installation unless user agrees to make HeadlineAlley its homepage

However, as of this writing, the said sites are inaccessible.