PUA.Win32.AskToolbar.CRXN

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Löscht Dateien, so dass Programme und Anwendungen nicht ordnungsgemäß ausgeführt werden.

Diese Malware hat keine Verbreitungsroutine.

Diese Malware hat keine Backdoor-Routine.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Ordner hinzu:

• %User Temp%\is-{Random}.tmp
• %User Temp%\is-{Random}.tmp\_isetup
• %Program Files%\Glary Undelete
• %Application Data%\GlarySoft
• %Program Files%\Glary Undelete\languages
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Glary Undelete
• %Program Files%\AskBarDis
• %Program Files%\AskBarDis\bar
• %Program Files%\AskBarDis\bar\Settings
• %Program Files%\AskBarDis\bar\bin
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\chrome
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\defaults
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\defaults\preferences
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\META-INF
• %Program Files%\Mozilla Firefox\components

(Hinweis: %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Local\Temp unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).. %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.. %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Schleust die folgenden Dateien ein:

• %User Temp%\is-{Random}.tmp\is-{Random}.tmp
• %User Temp%\is-{Random}.tmp\_isetup\_RegDLL.tmp
• %User Temp%\is-{Random}.tmp\_isetup\_shfoldr.dll
• %User Temp%\is-{Random}.tmp\toolbar.bmp
• %User Temp%\is-{Random}.tmp\License.rtf
• %Program Files%\Glary Undelete\unins000.dat
• %Program Files%\Glary Undelete\is-{Random}.tmp
• %Application Data%\GlarySoft\is-{Random}.tmp
• %Program Files%\Glary Undelete\languages\is-{Random}.tmp
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Glary Undelete\Glary Undelete.lnk
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Glary Undelete\Home Page.lnk
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Glary Undelete\Uninstall Glary Undelete.lnk
• %Desktop%\Glary Undelete.lnk
• %Application Data%\Microsoft\Internet Explorer\Quick Launch\Glary Undelete.lnk
• %Desktop%\Glary Utilities Freeware.lnk
• %Program Files%\Glary Undelete\settings.ini
• %User Temp%\is-{Random}.tmp\askBarSetup.exe.tmp
• %User Temp%\is-{Random}.tmp\psvince.dll
• %User Temp%\is-{Random}.tmp\FFExtInstallPath.exe
• %Program Files%\AskBarDis\unins000.dat
• %Program Files%\AskBarDis\is-{Random}.tmp
• %Program Files%\AskBarDis\bar\Settings\is-{Random}.tmp
• %Program Files%\AskBarDis\bar\bin\is-{Random}.tmp
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\is-{Random}.tmp
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\chrome\is-{Random}.tmp
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\defaults\preferences\is-{Random}.tmp
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\META-INF\is-{Random}.tmp
• %Program Files%\Mozilla Firefox\components\is-{Random}.tmp
• %User Temp%\is-{Random}.tmp\JSXPCOMInstaller.exe
• %User Temp%\is-{Random}.tmp\GenerateConfig.exe
• %Program Files%\AskBarDis\bar\Settings\config.dat
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\defaults\preferences\config.dat
• %Program Files%\Glary Undelete\unins000.exe
• %Program Files%\Glary Undelete\askBarSetup.exe
• %Application Data%\GlarySoft\gufav.ico
• %Program Files%\Glary Undelete\undelete.exe
• %Program Files%\Glary Undelete\lockdll.dll
• %Program Files%\Glary Undelete\help.chm
• %Program Files%\Glary Undelete\license.txt
• %Program Files%\Glary Undelete\languages\english.lng
• %Program Files%\Glary Undelete\languages\chinese.lng
• %Program Files%\Glary Undelete\languages\hungarian.lng
• %Program Files%\Glary Undelete\languages\russian.lng
• %Program Files%\Glary Undelete\languages\polish.lng
• %Program Files%\Glary Undelete\languages\turkish.lng
• %Program Files%\Glary Undelete\languages\Chinese(Traditional).lng
• %Program Files%\Glary Undelete\languages\italian.lng
• %Program Files%\Glary Undelete\languages\french.lng
• %Program Files%\Glary Undelete\languages\spanish.lng
• %Program Files%\Glary Undelete\languages\ptbr.lng
• %Program Files%\Glary Undelete\languages\Korean.lng
• %Program Files%\Glary Undelete\languages\dutch.lng
• %Program Files%\Glary Undelete\languages\German.lng
• %Program Files%\Glary Undelete\languages\japanese.lng
• %Program Files%\AskBarDis\unins000.exe
• %Program Files%\AskBarDis\bar\bin\askBar.dll
• %Program Files%\AskBarDis\bar\bin\askPopStp.dll
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\chrome.manifest
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\chrome.manifest.dev
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\install.rdf
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\install.rdf.bak
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\chrome\ajtoolbar.jar
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\defaults\preferences\ask.gif
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\defaults\preferences\ask.src
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\defaults\preferences\config.dat.bak
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\defaults\preferences\snipit.js
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\META-INF\manifest.mf
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\META-INF\zigbert.rsa
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\META-INF\zigbert.sf
• %Program Files%\Mozilla Firefox\components\AskSearch.js
• %Program Files%\AskBarDis\bar\bin\psvince.dll
• %Program Files%\AskBarDis\bar\Settings\config.dat.bak

(Hinweis: %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Local\Temp unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).. %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.. %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).. %Desktop% ist der Ordner 'Desktop' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Desktop unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Desktop unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Desktop unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\Desktop unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Fügt die folgenden Prozesse hinzu:

• %User Temp%\is-{Random}.tmp\is-{Random}.tmp /SL4 ${Random} "{Malware Path}\{Malware File Name}.{Malware File Extension}" {Random}
• %Program Files%\Glary Undelete\undelete.exe
• %Program Files%\Glary Undelete\askBarSetup.exe /tbr /sa /verysilent toolbar=GLS
• %User Temp%\is-{Random}.tmp\askBarSetup.exe.tmp /SL5="$Random,%Program Files%\Glary Undelete\askBarSetup.exe" /tbr /sa /verysilent toolbar=GLS
• %User Temp%\is-{Random}.tmp\FFExtInstallPath.exe
• %System%\regsvr32.exe /s "%Program Files%\AskBarDis\bar\bin\askBar.dll"
• %System%\regsvr32.exe /s "%Program Files%\AskBarDis\bar\bin\askPopStp.dll"
• %System%\regsvr32.exe /s "%Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\chrome.manifest"
• %System%\regsvr32.exe /s "%Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\chrome.manifest.dev"
• %System%\regsvr32.exe /s "%Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\install.rdf"
• %System%\regsvr32.exe /s "%Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\install.rdf.bak"
• %System%\regsvr32.exe /s "%Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\chrome\ajtoolbar.jar"
• %System%\regsvr32.exe /s "%Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\defaults\preferences\ask.gif"
• %System%\regsvr32.exe /s "%Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\defaults\preferences\ask.src"
• %System%\regsvr32.exe /s "%Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\defaults\preferences\config.dat"
• %System%\regsvr32.exe /s "%Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\defaults\preferences\config.dat.bak"
• %System%\regsvr32.exe /s "%Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\defaults\preferences\snipit.js"
• %System%\regsvr32.exe /s "%Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\META-INF\manifest.mf"
• %System%\regsvr32.exe /s "%Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\META-INF\zigbert.rsa"
• %System%\regsvr32.exe /s "%Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\META-INF\zigbert.sf"
• %User Temp%\is-{Random}.tmp\JSXPCOMInstaller.exe
• %User Temp%\is-{Random}.tmp\GenerateConfig.exe "%Program Files%\AskBarDis\bar\Settings\config.dat" "%Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\defaults\preferences\config.dat"

(Hinweis: %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Local\Temp unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).. %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.. %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).. %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Andere Systemänderungen

Löscht die folgenden Dateien:

• %User Temp%\is-{Random}.tmp\is-{Random}.tmp
• %Program Files%\Glary Undelete\is-{Random}.tmp
• %Application Data%\GlarySoft\is-{Random}.tmp
• %Program Files%\Glary Undelete\languages\is-{Random}.tmp
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Glary Undelete\Glary Undelete.lnk
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Glary Undelete\Home Page.lnk
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Glary Undelete\Uninstall Glary Undelete.lnk
• %Desktop%\Glary Undelete.lnk
• %Application Data%\Microsoft\Internet Explorer\Quick Launch\Glary Undelete.lnk
• %Desktop%\Glary Utilities Freeware.lnk
• %User Temp%\is-{Random}.tmp\License.rtf
• %User Temp%\is-{Random}.tmp\toolbar.bmp
• %User Temp%\is-{Random}.tmp\_isetup\_RegDLL.tmp
• %User Temp%\is-{Random}.tmp\_isetup\_shfoldr.dll
• %User Temp%\is-{Random}.tmp\askBarSetup.exe.tmp
• %Program Files%\AskBarDis\is-{Random}.tmp
• %Program Files%\AskBarDis\bar\Settings\is-{Random}.tmp
• %Program Files%\AskBarDis\bar\bin\is-{Random}.tmp
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\is-{Random}.tmp
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\chrome\is-{Random}.tmp
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\defaults\preferences\is-{Random}.tmp
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\META-INF\is-{Random}.tmp
• %Program Files%\Mozilla Firefox\components\is-{Random}.tmp
• %User Temp%\is-{Random}.tmp\FFExtInstallPath.exe
• %User Temp%\is-{Random}.tmp\GenerateConfig.exe
• %User Temp%\is-{Random}.tmp\JSXPCOMInstaller.exe
• %User Temp%\is-{Random}.tmp\psvince.dll
• %Program Files%\AskBarDis\bar\Settings\config.dat.bak
• %Program Files%\AskBarDis\bar\Settings\config.dat
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\defaults\preferences\config.dat.bak
• %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}\defaults\preferences\config.dat

(Hinweis: %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Local\Temp unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).. %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.. %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).. %Desktop% ist der Ordner 'Desktop' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Desktop unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Desktop unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Desktop unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\Desktop unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Löscht die folgenden Ordner:

• %User Temp%\is-{Random}.tmp
• %User Temp%\is-{Random}.tmp\_isetup

(Hinweis: %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Local\Temp unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Fügt die folgenden Registrierungseinträge als Teil der Installationsroutine hinzu:

HKEY_CURRENT_USER\Software\AppDataLow\
AskBarDis\bar
FFExtPath = %Application Data%\Mozilla\Firefox\Profiles\{Profile}\extensions\{Random}

HKEY_CURRENT_USER\Software\AppDataLow\
AskBarDis\bar
FFUpgrade = 0

HKEY_CURRENT_USER\Software\AppDataLow\
AskBarDis\bar
HPOParam =

HKEY_CURRENT_USER\Software\AppDataLow\
AskBarDis\bar
Init = 1

HKEY_CURRENT_USER\Software\AppDataLow\
AskBarDis\bar
IsInstalled = 0

HKEY_CURRENT_USER\Software\AppDataLow\
AskBarDis\bar
Maximized = 1

HKEY_CURRENT_USER\Software\AppDataLow\
AskBarDis\bar
SAEnabled = 1

HKEY_CURRENT_USER\Software\AppDataLow\
AskBarDis\bar
Toolbar Name = GLS

HKEY_CURRENT_USER\Software\GlarySoft\
Glary Utilities
Date = {Date}

HKEY_CURRENT_USER\Software\GlarySoft\
Glary Utilities
Language = {Language}.lng

HKEY_CURRENT_USER\Software\GlarySoft\
Glary Utilities
Regcode = ########

HKEY_CURRENT_USER\Software\GlarySoft\
Glary Utilities
Skin = %Program Files%\Glary Undelete\skins\Default\skin.ini

HKEY_CURRENT_USER\Software\GlarySoft\
Glary Utilities\Settings
BackupsDelete = 1

HKEY_CURRENT_USER\Software\GlarySoft\
Glary Utilities\Settings
BackupsMax = 60

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\{GUID}
DisplayName = Ask Search

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\{GUID}
URL = http://{BLOCKED}k.com/toolbarv/askRedirect.jsp?gct=&gc=1&q={searchTerms}&crm=1&toolbar=GLS

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterBarButton.1
(Default) = Bar Button Class

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterBarButton.1\CLSID
(Default) = {GUID}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterBarButton
(Default) = Bar Button Class

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterBarButton\CLSID
(Default) = {GUID}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterBarButton\CurVer
(Default) = AskIBar.PopSwatterBarButton.1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterSettingsControl.1
(Default) = Settings Class

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterSettingsControl.1\CLSID
(Default) = {GUID}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterSettingsControl
(Default) = Settings Class

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterSettingsControl\CLSID
(Default) = {GUID}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterSettingsControl\CurVer
(Default) = AskIBar.PopSwatterSettingsControl.1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskToolBar.SettingsPlugin.1
(Default) = Ask Toolbar Settings Plugin

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskToolBar.SettingsPlugin.1\CLSID
(Default) = {GUID}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskToolBar.SettingsPlugin
(Default) = Ask Toolbar Settings Plugin

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskToolBar.SettingsPlugin\CLSID
(Default) = {GUID}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskToolBar.SettingsPlugin\CurVer
(Default) = AskToolBar.SettingsPlugin.1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}
(Default) = Ask Toolbar

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}
(Default) = Ask Toolbar Quick View

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}
(Default) = Ask Toolbar Settings

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}
{Default} = AskBar BHO

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}
(Default) = askBar Installer2

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}
(Default) = Bar Button Class

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}
(Default) = PopupBlocker Server Class

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}
(Default) = Settings Class

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\InprocServer32
(Default) = %Program Files%\AskBarDis\bar\bin\askBar.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\InprocServer32
(Default) = %Program Files%\AskBarDis\bar\bin\askPopStp.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\InprocServer32
(Default) = %System%\shdocvw.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\InprocServer32
ThreadingModel = Apartment

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\Instance
CLSID = {GUID}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\Instance\
InitPropertyBag
Url = res://%Program Files%\ASKBAR~1\bar\bin\askBar.dll/105

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\MiscStatus
(Default) = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\MiscStatus\
1
(Default) = 131473

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\ProgID
(Default) = AskIBar.PopSwatterBarButton.1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\ProgID
(Default) = AskIBar.PopSwatterSettingsControl.1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\ProgID
(Default) = AskToolBar.SettingsPlugin.1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\TreatAs
(Default) = {GUID}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\TreatLib
(Default) = {GUID}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\VersionIndependentProgID
(Default) = AskIBar.PopSwatterBarButton

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\VersionIndependentProgID
(Default) = AskIBar.PopSwatterSettingsControl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\VersionIndependentProgID
(Default) = AskToolBar.SettingsPlugin

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\Version
(Default) = 1.0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID}
(Default) = IAskIPopSwatterSettings

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID}
(Default) = IAskISettings

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID}
(Default) = IAskIPopSwatterSettingsEvent

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID}
(Default) = IAskISettingsEvent

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID}\ProxyStubClsid32
(Default) = {GUID}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID}\ProxyStubClsid
(Default) = {GUID}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID}\TypeLib
(Default) = {GUID}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID}\TypeLib
Version = 1.0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID}\1.0
(Default) = PopSwatter Control 1.0 Type Library

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID}\1.0
(Default) = Toolbar 1.0 Type Library

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID}\1.0\
0\win32
(Default) = %Program Files%\AskBarDis\bar\bin\askBar.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID}\1.0\
0\win32
(Default) = %Program Files%\AskBarDis\bar\bin\askPopStp.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID}\1.0\
FLAGS
(Default) = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID}\1.0\
HELPDIR
(Default) = %Program Files%\AskBarDis\bar\bin\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Toolbar
{GUID} = \x00

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{GUID}
(Default) = AskBar BHO

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
Display Name = Ask Toolbar

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
Display Version = 4.1.0.2

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
HelpLink = http://{BLOCKED}sk.com/en/toolbar/toolbarv/faq.html

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
Inno Setup: App Path = %Program Files%\AskBarDis

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
Inno Setup: Icon Group = (Default)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
Inno Setup: Setup Version = 5.2.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
Inno Setup: User = {Username}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
InstallDate = {Installation Date}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
InstallLocation = %Program Files%\AskBarDis\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
NoModify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
NoRepair = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
Publisher = Ask.com

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
QuietUninstallString = "%Program Files%\AskBarDis\unins000.exe" /SILENT

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
UninstallString = "%Program Files%\AskBarDis\unins000.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
URLInfoAbout = http://www.{BLOCKED}k.com

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
URLUpdateInfo = http://{BLOCKED}k.com/toolbarv/download.html

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
DisplayName = Glary Undelete 1.5.0.232

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
HelpLink = http://www.{BLOCKED}oft.com

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
Inno Setup: Setup Path = %Program Files%\Glary Undelete

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
Inno Setup: Deselected Tasks =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
Inno Setup: Icon Group = Glary Undelete

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
Inno Setup: Selected Tasks = desktopicon,quicklaunchicon

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
Inno Setup: Setup Version = 5.1.11

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
Inno Setup: User = {Username}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
InstallDate = {Installation Date}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
Install Location = %Program Files%\Glary Undelete\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
NoModify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
NoRepair = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
Publisher = GlarySoft.com

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
QuietUninstallString = "%Program Files%\Glary Undelete\unins000.exe" /SILENT

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
UninstallString = "%Program Files%\Glary Undelete\unins000.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
URLInfoAbout = http://www.{BLOCKED}oft.com

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
URLUpdateInfo = http://www.{BLOCKED}oft.com

Fügt die folgenden Registrierungsschlüssel als Teil der Installationsroutine hinzu:

HKEY_CLASSES_ROOT
AskIBar.PopSwatterBarButton =

HKEY_CLASSES_ROOT
AskIBar.PopSwatterBarButton.1 =

HKEY_CLASSES_ROOT
AskIBar.PopSwatterSettingsControl =

HKEY_CLASSES_ROOT
AskIBar.PopSwatterSettingsControl.1 =

HKEY_CLASSES_ROOT
AskToolBar.SettingsPlugin =

HKEY_CLASSES_ROOT
AskToolBar.SettingsPlugin.1 =

HKEY_CLASSES_ROOT\CLSID
{GUID} =

HKEY_CLASSES_ROOT\CLSID\{GUID}
TreatAs =

HKEY_CURRENT_USER\Software\AppDataLow
AskBarDis =

HKEY_CURRENT_USER\Software\AppDataLow\
AskBarDis
bar =

HKEY_CURRENT_USER\Software\AppDataLow\
AskBarDis\bar
FFExtPath =

HKEY_CURRENT_USER\Software\AppDataLow\
AskBarDis\bar
FFUpgrade =

HKEY_CURRENT_USER\Software\AppDataLow\
AskBarDis\bar
HPOParam =

HKEY_CURRENT_USER\Software\AppDataLow\
AskBarDis\bar
Init =

HKEY_CURRENT_USER\Software\AppDataLow\
AskBarDis\bar
IsInstalled =

HKEY_CURRENT_USER\Software\AppDataLow\
AskBarDis\bar
Maximized =

HKEY_CURRENT_USER\Software\AppDataLow\
AskBarDis\bar
SAEnabled =

HKEY_CURRENT_USER\Software\AppDataLow\
AskBarDis\bar
ToolbarName =

HKEY_CURRENT_USER\Software\Classes\
CLSID
{GUID} =

HKEY_CURRENT_USER\SOFTWARE
GlarySoft =

HKEY_CURRENT_USER\SOFTWARE\GlarySoft
Glary Utilities =

HKEY_CURRENT_USER\SOFTWARE\GlarySoft\
Glary Utilities
Date =

HKEY_CURRENT_USER\SOFTWARE\GlarySoft\
Glary Utilities
Language =

HKEY_CURRENT_USER\SOFTWARE\GlarySoft\
Glary Utilities
Regcode =

HKEY_CURRENT_USER\SOFTWARE\GlarySoft\
Glary Utilities
Settings =

HKEY_CURRENT_USER\SOFTWARE\GlarySoft\
Glary Utilities\Settings
BackupsDelete =

HKEY_CURRENT_USER\SOFTWARE\GlarySoft\
Glary Utilities\Settings
BackupsMax =

HKEY_CURRENT_USER\SOFTWARE\GlarySoft\
Glary Utilities
Skin =

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\DefaultScope
{GUID} =

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\DefaultScope\
{GUID}
DisplayName =

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\DefaultScope\
{GUID}
URL =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes
AskIBar.PopSwatterBarButton.1 =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterBarButton.1
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterBarButton.1
CLSID =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterBarButton.1\CLSID
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes
AskIBar.PopSwatterBarButton =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterBarButton
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterBarButton
CLSID =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterBarButton\CLSID
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterBarButton
CurVer =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterBarButton\CurVer
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes
AskIBar.PopSwatterSettingsControl.1 =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterSettingsControl.1
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterSettingsControl.1
CLSID =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterSettingsControl.1\CLSID
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes
AskIBar.PopSwatterSettingsControl =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterSettingsControl
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterSettingsControl
CLSID =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterSettingsControl\CLSID
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterSettingsControl
CurVer =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskIBar.PopSwatterSettingsControl\CurVer
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes
AskToolBar.SettingsPlugin.1 =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskToolBar.SettingsPlugin.1
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskToolBar.SettingsPlugin.1
CLSID =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskToolBar.SettingsPlugin.1\CLSID
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes
AskToolBar.SettingsPlugin =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskToolBar.SettingsPlugin
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskToolBar.SettingsPlugin
CLSID =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskToolBar.SettingsPlugin\CLSID
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskToolBar.SettingsPlugin
CurVer =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AskToolBar.SettingsPlugin\CurVer
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID
{GUID} =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}
Control =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}
Implemented Categories =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\Implemented Categories
{GUID} =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}
InprocServer32 =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\InprocServer32
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\InprocServer32
ThreadingModel =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}
Instance =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\Instance
CLSID =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\Instance
InitPropertyBag =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\Instance\
InitPropertyBag
Url =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}
MiscStatus =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\MiscStatus
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\MiscStatus
1 =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\MiscStatus\
1
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}
ProgID =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\ProgID
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}
Programmable =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}
TreatAs =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\TreatAs
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}
TypeLib =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\TypeLib
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}
Version =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}
VersionIndependentProgID =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\VersionIndependentProgID
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\Version
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface
{GUID} =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID}
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID}
ProxyStubClsid =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID}
ProxyStubClsid32 =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID}\ProxyStubClsid32
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID}\ProxyStubClsid
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID}
TypeLib =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID}\TypeLib
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{GUID}\TypeLib
Version =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib
{GUID} =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID}
1.0 =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID}\1.0
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID}\1.0
0 =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID}\1.0\
0
win32 =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID}\1.0\
0\win32
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID}\1.0
FLAGS =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID}\1.0\
FLAGS
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID}\1.0
HELPDIR =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID}\1.0\
HELPDIR
(Default) =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Toolbar
{GUID} =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects
{GUID} =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{GUID}
(Default) =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall
Ask Toolbar_is1 =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
DisplayName =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
DisplayVersion =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
HelpLink =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
Inno Setup: App Path =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
Inno Setup: Icon Group =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
Inno Setup: Setup Version =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
Inno Setup: User =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
InstallDate =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
InstallLocation =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
NoModify =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
NoRepair =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
Publisher =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
QuietUninstallString =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
UninstallString =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
URLInfoAbout =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Ask Toolbar_is1
URLUpateInfo =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall
Glary Undelete_is1 =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
DisplayName =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
HelpLink =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
Inno Setup: App Path =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
Inno Setup: Deselected Tasks =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
Inno Setup: Icon Group =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
Inno Setup: Selected Tasks =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
Inno Setup: Setup Version =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
Inno Setup: User =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
InstallDate =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
InstallLocation =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
NoModify =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
NoRepair =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
Publisher =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
QuietUninstallString =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
UninstallString =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
URLInfoAbout =

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Glary Undelete_is1
URLUpdateInfo =

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Andere Details

Es macht Folgendes:

• It contains pre-populated checkboxes to install browser extension:
  
• It may change the default search website to the following URL:
  • http://{BLOCKED}k.com/toolbarv/askRedirect.jsp?gct=&gc=1&q={searchTerms}&crm=1&toolbar=GLS