ADW_MICROWINSEARCH

April 25, 2014

ALIASES:

Trojan.Dropper (Symantec); P2P-Worm.Win32.Palevo.hegz (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt); The file is signed by an untrusted certificate, issued by: Generic.EA9. (AVG)

PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

OVERALL RISK RATING:

REPORTED INFECTION:

SYSTEM IMPACT RATING:

INFORMATION EXPOSURE:

Threat Type: Adware
Destructiveness: No
Encrypted:
In the wild: Yes

OVERVIEW

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

TECHNICAL DETAILS

File Size:

1,086,285 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

25 Apr 2014

Arrival Details

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This adware creates the following folders:

%User Temp%\is-GP58O.tmp
%User Temp%\is-HVBI1.tmp
%User Temp%\is-HVBI1.tmp\_isetup
%System%\MicrowindowSearch
%User Temp%\_ir_tu2_temp_0
%User Temp%\_ir_tu2_temp_0\_tu_DATUP_0
%User Temp%\is-ESJLE.tmp
%User Temp%\is-8CKSA.tmp
%User Temp%\is-8CKSA.tmp\_isetup
%System%\AppCompat
%System%\AppCompat\catroot
%User Temp%\is-A9FFC.tmp
%User Temp%\is-FSIPT.tmp
%User Temp%\is-FSIPT.tmp\_isetup
%User Profile%\Microsoft\FoxPlugin
%User Profile%\FoxPlugin\Tools
%User Profile%\Tools\img
%User Temp%\_ir_tu2_temp_1

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %System% is the Windows system folder, which is usually C:\Windows\System32.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Autostart Technique

This adware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MicrowindowSearch = "%System%\MicrowindowSearch\MicrowindowSearch.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MicrowindowSearch = "%System%\MicrowindowSearch\MicrowindowSearch.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
catroot = "%System%\AppCompat\catroot\catrootsz.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Fox-Corn = "%User Profile%\Tools\upenkr.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Fox-Corn = "%User Profile%\Tools\upenkr.exe"

Other System Modifications

This adware deletes the following files:

%User Temp%\nsm1.tmp
%System Root%\DEL_NS~1.CMD
%Program Files%\MICROW~1.EXE
%User Temp%\IRW18.tmp
%System%\MicrowindowSearch\IRT1A.tmp
%User Temp%\IRW1C.tmp
%User Temp%\IRW20.tmp
%System%\MicrowindowSearch\MICROWINDOWSEARCH.EXE
%User Temp%\IRW29.tmp
%System%\WindowServiceNT.exe
%User Temp%\IRW2B.tmp
%User Temp%\IRW2E.tmp
%User Temp%\IRW30.tmp
%User Temp%\IRW33.tmp
%System%\foxinst.exe
%User Temp%\IRW5C.tmp
%User Temp%\IRW77.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).. %System% is the Windows system folder, which is usually C:\Windows\System32.)

It adds the following registry keys:

HKEY_CURRENT_USER\SOFTWARE\AppDataLow\
MicrowindowSearch

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
MicrowindowSearch_is1

HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\
catroot

HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\
Enkr

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Fox-Corn_is1

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A1-CA93-46BB-9D4A-DBD498CB8944}

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A2-F93E-4C0B-87D5-490AEF45ADD3}

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A3-57A6-49EA-B96B-1428070E5924}

HKEY_CURRENT_USER\SoftwareMicrosoftWindowsCurrentVersionRun

It adds the following registry entries:

HKEY_CURRENT_USER\Software\AppDataLow\
MicrowindowSearch
Version = "1.0.0.1"

HKEY_CURRENT_USER\Software\AppDataLow\
MicrowindowSearch
RealTime = "Yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MicrowindowSearch_is1
Inno Setup: Setup Version = "5.5.0 (a)"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MicrowindowSearch_is1
Inno Setup: App Path = "%System%\MicrowindowSearch"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MicrowindowSearch_is1
InstallLocation = "%System%\MicrowindowSearch"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MicrowindowSearch_is1
Inno Setup: Icon Group = "MicrowindowSearch"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MicrowindowSearch_is1
Inno Setup: User = "Wilbert"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MicrowindowSearch_is1
Inno Setup: Language = "default"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MicrowindowSearch_is1
DisplayName = "MicrowindowSearch"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MicrowindowSearch_is1
UninstallString = "%System%\MicrowindowSearch\unins000.exe "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MicrowindowSearch_is1
QuietUninstallString = "%System%\MicrowindowSearch\unins000.exe /SILENT"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MicrowindowSearch_is1
DisplayVersion = "1.0.0.1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MicrowindowSearch_is1
Publisher = "MicrowindowSearch Inc."

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MicrowindowSearch_is1
NoModify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MicrowindowSearch_is1
NoRepair = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MicrowindowSearch_is1
InstallDate = "20140425"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MicrowindowSearch_is1
MajorVersion = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MicrowindowSearch_is1
MinorVersion = "0"

HKEY_CURRENT_USER\Software\AppDataLow\
MicrowindowSearch
GUID = "{DD82EDBC-8C08-4232-94E4-D42D0BFE3D66}"

HKEY_CURRENT_USER\Software\AppDataLow\
MicrowindowSearch
partnerID = "MicrowindowSearch"

HKEY_CURRENT_USER\Software\AppDataLow\
MicrowindowSearch
ActiveDate = "2014-04-25"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\ApplicationSpecialManagement
Description = "ÇÒ´ç, °Ô½Ã, Á¦°Å "

HKEY_CURRENT_USER\Software\AppDataLow\
MicrowindowSearch
Version = "1.0.0.2"

HKEY_CURRENT_USER\Software\AppDataLow\
MicrowindowSearch
UpdateTime = "20140425"

HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\
catroot
Ver = "1.0.0.0"

HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\
catroot
g = "{E7AC4460-72F0-4925-83FF-AD50AAEECE65}"

HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\
catroot
PID = "B"

HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\
catroot
aDay = "2014-04-25"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\AppCatroots
Description = "ÀÌ ¿ë¿ëÇÁ·Î±×·¥Àº Áö¼ÓÀûÀ¸·Î ½Ã½ºÅÛ ¼º´ÉÀ» À¯ÁöÇÕ´Ï´Ù."

HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\
catroot
UpDay = "20140425"

HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\
Enkr
partnerID = "enkr_03"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fox-Corn_is1
Inno Setup: Setup Version = "5.5.0 (a)"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fox-Corn_is1
Inno Setup: App Path = "%User Profile%\FoxPlugin\Tools"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fox-Corn_is1
InstallLocation = "%User Profile%\FoxPlugin\Tools"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fox-Corn_is1
Inno Setup: Icon Group = "Fox-Corn"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fox-Corn_is1
Inno Setup: User = "Wilbert"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fox-Corn_is1
Inno Setup: Language = "default"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fox-Corn_is1
DisplayName = "Foxcorn Plugin"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fox-Corn_is1
DisplayIcon = "%User Profile%\Tools\Foxcorn.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fox-Corn_is1
UninstallString = "%User Profile%\Tools\unins000.exe "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fox-Corn_is1
QuietUninstallString = "%User Profile%\Tools\unins000.exe /SILENT"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fox-Corn_is1
DisplayVersion = "1.0.0.8"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fox-Corn_is1
Publisher = "Fox-Corn."

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fox-Corn_is1
URLInfoAbout = "Fox-Corn"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fox-Corn_is1
NoModify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fox-Corn_is1
NoRepair = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fox-Corn_is1
InstallDate = "20140425"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fox-Corn_is1
MajorVersion = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fox-Corn_is1
MinorVersion = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow
fox = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\
Enkr
UpdateTime = "01:08:32"

HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\
Enkr
InstallTime = "2014042501"

HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\
Enkr
Version = "1.0.0.8"

HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\
Enkr
GUID = "{3B9AC289-91AA-4408-BF6E-1F07765338DD}"

HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\
Enkr
InstallTime = "2014-04-25_01:08:32"

HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\
Enkr
a = "07197EF1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A1-CA93-46BB-9D4A-DBD498CB8944}
ButtonText = "G¸¶ÄÏ ÀÌµ¿"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A1-CA93-46BB-9D4A-DBD498CB8944}
ToolTip = "G¸¶ÄÏ ÀÌµ¿"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A1-CA93-46BB-9D4A-DBD498CB8944}
ClSid = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A1-CA93-46BB-9D4A-DBD498CB8944}
Default Visible = "Yes"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A1-CA93-46BB-9D4A-DBD498CB8944}
Exec = "http://cl.{BLOCKED}lick.com/?dts_code=100378071220364954000060391200000000000"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A1-CA93-46BB-9D4A-DBD498CB8944}
HotIcon = "%User Profile%\img\g.ico"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A1-CA93-46BB-9D4A-DBD498CB8944}
Icon = "%User Profile%\img\g.ico"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A2-F93E-4C0B-87D5-490AEF45ADD3}
ButtonText = "¿Á¼Ç ÀÌµ¿"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A2-F93E-4C0B-87D5-490AEF45ADD3}
ToolTip = "¿Á¼Ç ÀÌµ¿"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A2-F93E-4C0B-87D5-490AEF45ADD3}
ClSid = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A2-F93E-4C0B-87D5-490AEF45ADD3}
Default Visible = "Yes"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A2-F93E-4C0B-87D5-490AEF45ADD3}
Exec = "http://cl.{BLOCKED}lick.com/?dts_code=100002701220364954000060391200000000000"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A2-F93E-4C0B-87D5-490AEF45ADD3}
HotIcon = "%User Profile%\img\a.ico"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A2-F93E-4C0B-87D5-490AEF45ADD3}
Icon = "%User Profile%\img\a.ico"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A3-57A6-49EA-B96B-1428070E5924}
ButtonText = "11¹ø°¡ ÀÌµ¿"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A3-57A6-49EA-B96B-1428070E5924}
ToolTip = "11¹ø°¡ ÀÌµ¿"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A3-57A6-49EA-B96B-1428070E5924}
ClSid = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A3-57A6-49EA-B96B-1428070E5924}
Default Visible = "Yes"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A3-57A6-49EA-B96B-1428070E5924}
Exec = "http://cl.{BLOCKED}lick.com/?dts_code=100924491220364954000060391200000000000"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A3-57A6-49EA-B96B-1428070E5924}
HotIcon = "%User Profile%\img\11.ico"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Extensions\{000000A3-57A6-49EA-B96B-1428070E5924}
Icon = "%User Profile%\img\11.ico"

HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\
Enkr
e = "s"

HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\
Enkr
ActiveDate = "2014-04-25"

HKEY_CURRENT_USER\SoftwareMicrosoftWindowsCurrentVersionRun
Fox-Corn = "%User Profile%\Tools\upenkr.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\
Enkr
UpdateTime = "01:08:55"

It deletes the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
MicrowindowSearch_is1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MicrowindowSearch_is1

HKEY_LOCAL_MACHINE\Software\AppDataLow\
xprefund

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Fox-Corn_is1

Dropping Routine

This adware drops the following files:

%Program Files%\MicrowindowSearch_setup.exe
%User Temp%\is-GP58O.tmp\MicrowindowSearch_setup.tmp
%User Temp%\is-HVBI1.tmp\_isetup\_RegDLL.tmp
%User Temp%\is-HVBI1.tmp\_isetup\_shfoldr.dll
%Program Files%\del_bat.cmd
%System%\MicrowindowSearch\unins000.dat
%System%\MicrowindowSearch\is-AU3ET.tmp
%System%\is-N9TQF.tmp
%System%\MicrowindowSearch\is-L2NSH.tmp
%System%\MicrowindowSearch\is-C3HG3.tmp
%System%\MicrowindowSearch\is-UGE06.tmp
%User Temp%\_ir_tu2_temp_0\_TUProjDT.dat
%User Temp%\_ir_tu2_temp_0\32_2.ico
%System%\MicrowindowSearch\MicrowindowSearch.ts3
%User Temp%\_ir_tu2_temp_0\_tu_DATUP_0\MicrowindowSearch.ts2
%System%\MicrowindowSearch\MicrowindowSearch.dat
%System%\MicrowindowSearch\MicrowindowSearch.exe
%System%\MicrowindowSearch\MicrowindowSearch Update Log.txt
%System%\WindowServiceNT.exe_tmp
%System%\ctsins.exe_tmp
%System%\foxinst.exe_tmp
%User Profile%\Documents\catins2.exe
%System%\$$336699.bat
%User Profile%\Documents\enkr_03.exe
%User Temp%\is-ESJLE.tmp\catins2.tmp
%User Temp%\is-8CKSA.tmp\_isetup\_RegDLL.tmp
%User Temp%\is-8CKSA.tmp\_isetup\_shfoldr.dll
%User Profile%\Documents\del_bat.cmd
%System%\AppCompat\catroot\unins000.dat
%System%\AppCompat\catroot\is-MNJB6.tmp
%System%\AppCompat\catroot\is-N5JKU.tmp
%System%\AppCompat\catroot\is-G751S.tmp
%System%\AppCompat\catroot\is-FSJFR.tmp
%System%\AppCompat\catroot\is-J1ONT.tmp
%User Temp%\is-A9FFC.tmp\enkr_03.tmp
%User Temp%\_ir_tu2_temp_0\162.ico
%User Temp%\is-FSIPT.tmp\_isetup\_RegDLL.tmp
%User Temp%\is-FSIPT.tmp\_isetup\_shfoldr.dll
%User Profile%\Tools\unins000.dat
%User Profile%\Tools\is-BBALM.tmp
%User Profile%\Tools\is-A30PU.tmp
%User Profile%\Tools\is-R0HDD.tmp
%User Profile%\Tools\is-7TM5T.tmp
%User Profile%\Tools\is-UUEKN.tmp
%User Profile%\img\is-R9K40.tmp
%User Profile%\img\is-RJFAO.tmp
%User Profile%\img\is-O0UFO.tmp
%Favorites%\G¸¶ÄÏ ÀÌµ¿.URL
%Favorites%\¿Á¼Ç ÀÌµ¿.URL
%Favorites%\11¹ø°¡ ÀÌµ¿.URL
%User Profile%\Tools\upenkr.dat
%User Temp%\_ir_tu2_temp_1\_TUProjDT.dat
%User Temp%\_ir_tu2_temp_1\ico.ico

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %System% is the Windows system folder, which is usually C:\Windows\System32.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Favorites% is the current user's Favorites folder, which is usually C:\Documents and Settings\{user name}\Favorites on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Favorites on Windows Vista and 7.)

Other Details

This adware connects to the following possibly malicious URL:

http://update.{BLOCKED}tsz.com/setup/catins2.exe
http://update.{BLOCKED}s.com/setup/enkr_03.exe
http://update.{BLOCKED}s.com/upenkr.ts2
http://update.{BLOCKED}s.kr/MicrowindowSearch/MicrowindowSearch.ts1
http://update.{BLOCKED}s.kr/MicrowindowSearch/MicrowindowSearch.ts3
http://update.{BLOCKED}s.kr/MicrowindowSearch/MicrowindowSearch.ts2
http://update.{BLOCKED}s.kr/MicrowindowSearch/download/WindowServiceNT.exe
http://update.{BLOCKED}s.kr/analysis/up.php?{random characters}
http://update.{BLOCKED}s.kr/download/ctsins.exe
http://update.{BLOCKED}s.kr/download/foxinst.exe
http://update.{BLOCKED}s.kr/catrootsz.ts1
http://update.{BLOCKED}s.kr/upenkr.ts1

It deletes itself after execution.

This report is generated via an automated analysis system.

SOLUTION

Minimum Scan Engine:

9.300

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Restart in Safe Mode

[ Learn More ]

Step 3

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_CURRENT_USER\SOFTWARE\AppDataLow
- MicrowindowSearch

In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- MicrowindowSearch_is1

In HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow
- catroot

In HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow
- Enkr

In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- Fox-Corn_is1

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions
- {000000A1-CA93-46BB-9D4A-DBD498CB8944}

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions
- {000000A2-F93E-4C0B-87D5-490AEF45ADD3}

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions
- {000000A3-57A6-49EA-B96B-1428070E5924}

In HKEY_CURRENT_USER
- SoftwareMicrosoftWindowsCurrentVersionRun

Step 4

Delete this registry value

[ Learn More ]

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- MicrowindowSearch = "%System%\MicrowindowSearch\MicrowindowSearch.exe"

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- MicrowindowSearch = "%System%\MicrowindowSearch\MicrowindowSearch.exe"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- catroot = "%System%\AppCompat\catroot\catrootsz.exe"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- Fox-Corn = "%User Profile%\Tools\upenkr.exe"

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- Fox-Corn = "%User Profile%\Tools\upenkr.exe"

In HKEY_CURRENT_USER\Software\AppDataLow\MicrowindowSearch
- Version = "1.0.0.1"

In HKEY_CURRENT_USER\Software\AppDataLow\MicrowindowSearch
- RealTime = "Yes"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MicrowindowSearch_is1
- Inno Setup: Setup Version = "5.5.0 (a)"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MicrowindowSearch_is1
- Inno Setup: App Path = "%System%\MicrowindowSearch"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MicrowindowSearch_is1
- InstallLocation = "%System%\MicrowindowSearch"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MicrowindowSearch_is1
- Inno Setup: Icon Group = "MicrowindowSearch"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MicrowindowSearch_is1
- Inno Setup: User = "Wilbert"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MicrowindowSearch_is1
- Inno Setup: Language = "default"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MicrowindowSearch_is1
- DisplayName = "MicrowindowSearch"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MicrowindowSearch_is1
- UninstallString = "%System%\MicrowindowSearch\unins000.exe "

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MicrowindowSearch_is1
- QuietUninstallString = "%System%\MicrowindowSearch\unins000.exe /SILENT"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MicrowindowSearch_is1
- DisplayVersion = "1.0.0.1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MicrowindowSearch_is1
- Publisher = "MicrowindowSearch Inc."

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MicrowindowSearch_is1
- NoModify = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MicrowindowSearch_is1
- NoRepair = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MicrowindowSearch_is1
- InstallDate = "20140425"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MicrowindowSearch_is1
- MajorVersion = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MicrowindowSearch_is1
- MinorVersion = "0"

In HKEY_CURRENT_USER\Software\AppDataLow\MicrowindowSearch
- GUID = "{DD82EDBC-8C08-4232-94E4-D42D0BFE3D66}"

In HKEY_CURRENT_USER\Software\AppDataLow\MicrowindowSearch
- partnerID = "MicrowindowSearch"

In HKEY_CURRENT_USER\Software\AppDataLow\MicrowindowSearch
- ActiveDate = "2014-04-25"

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ApplicationSpecialManagement
- Description = "ÇÒ´ç, °Ô½Ã, Á¦°Å "

In HKEY_CURRENT_USER\Software\AppDataLow\MicrowindowSearch
- Version = "1.0.0.2"

In HKEY_CURRENT_USER\Software\AppDataLow\MicrowindowSearch
- UpdateTime = "20140425"

In HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\catroot
- Ver = "1.0.0.0"

In HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\catroot
- g = "{E7AC4460-72F0-4925-83FF-AD50AAEECE65}"

In HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\catroot
- PID = "B"

In HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\catroot
- aDay = "2014-04-25"

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AppCatroots
- Description = "ÀÌ ¿ë¿ëÇÁ·Î±×·¥Àº Áö¼ÓÀûÀ¸·Î ½Ã½ºÅÛ ¼º´ÉÀ» À¯ÁöÇÕ´Ï´Ù."

In HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\catroot
- UpDay = "20140425"

In HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\Enkr
- partnerID = "enkr_03"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fox-Corn_is1
- Inno Setup: Setup Version = "5.5.0 (a)"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fox-Corn_is1
- Inno Setup: App Path = "%User Profile%\FoxPlugin\Tools"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fox-Corn_is1
- InstallLocation = "%User Profile%\FoxPlugin\Tools"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fox-Corn_is1
- Inno Setup: Icon Group = "Fox-Corn"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fox-Corn_is1
- Inno Setup: User = "Wilbert"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fox-Corn_is1
- Inno Setup: Language = "default"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fox-Corn_is1
- DisplayName = "Foxcorn Plugin"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fox-Corn_is1
- DisplayIcon = "%User Profile%\Tools\Foxcorn.exe"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fox-Corn_is1
- UninstallString = "%User Profile%\Tools\unins000.exe "

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fox-Corn_is1
- QuietUninstallString = "%User Profile%\Tools\unins000.exe /SILENT"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fox-Corn_is1
- DisplayVersion = "1.0.0.8"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fox-Corn_is1
- Publisher = "Fox-Corn."

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fox-Corn_is1
- URLInfoAbout = "Fox-Corn"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fox-Corn_is1
- NoModify = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fox-Corn_is1
- NoRepair = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fox-Corn_is1
- InstallDate = "20140425"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fox-Corn_is1
- MajorVersion = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fox-Corn_is1
- MinorVersion = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow
- fox = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\Enkr
- UpdateTime = "01:08:32"

In HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\Enkr
- InstallTime = "2014042501"

In HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\Enkr
- Version = "1.0.0.8"

In HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\Enkr
- GUID = "{3B9AC289-91AA-4408-BF6E-1F07765338DD}"

In HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\Enkr
- InstallTime = "2014-04-25_01:08:32"

In HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\Enkr
- a = "07197EF1"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A1-CA93-46BB-9D4A-DBD498CB8944}
- ButtonText = "G¸¶ÄÏ ÀÌµ¿"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A1-CA93-46BB-9D4A-DBD498CB8944}
- ToolTip = "G¸¶ÄÏ ÀÌµ¿"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A1-CA93-46BB-9D4A-DBD498CB8944}
- ClSid = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A1-CA93-46BB-9D4A-DBD498CB8944}
- Default Visible = "Yes"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A1-CA93-46BB-9D4A-DBD498CB8944}
- Exec = "http://cl.{BLOCKED}lick.com/?dts_code=100378071220364954000060391200000000000"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A1-CA93-46BB-9D4A-DBD498CB8944}
- HotIcon = "%User Profile%\img\g.ico"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A1-CA93-46BB-9D4A-DBD498CB8944}
- Icon = "%User Profile%\img\g.ico"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A2-F93E-4C0B-87D5-490AEF45ADD3}
- ButtonText = "¿Á¼Ç ÀÌµ¿"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A2-F93E-4C0B-87D5-490AEF45ADD3}
- ToolTip = "¿Á¼Ç ÀÌµ¿"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A2-F93E-4C0B-87D5-490AEF45ADD3}
- ClSid = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A2-F93E-4C0B-87D5-490AEF45ADD3}
- Default Visible = "Yes"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A2-F93E-4C0B-87D5-490AEF45ADD3}
- Exec = "http://cl.{BLOCKED}lick.com/?dts_code=100002701220364954000060391200000000000"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A2-F93E-4C0B-87D5-490AEF45ADD3}
- HotIcon = "%User Profile%\img\a.ico"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A2-F93E-4C0B-87D5-490AEF45ADD3}
- Icon = "%User Profile%\img\a.ico"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A3-57A6-49EA-B96B-1428070E5924}
- ButtonText = "11¹ø°¡ ÀÌµ¿"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A3-57A6-49EA-B96B-1428070E5924}
- ToolTip = "11¹ø°¡ ÀÌµ¿"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A3-57A6-49EA-B96B-1428070E5924}
- ClSid = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A3-57A6-49EA-B96B-1428070E5924}
- Default Visible = "Yes"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A3-57A6-49EA-B96B-1428070E5924}
- Exec = "http://cl.{BLOCKED}lick.com/?dts_code=100924491220364954000060391200000000000"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A3-57A6-49EA-B96B-1428070E5924}
- HotIcon = "%User Profile%\img\11.ico"

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{000000A3-57A6-49EA-B96B-1428070E5924}
- Icon = "%User Profile%\img\11.ico"

In HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\Enkr
- e = "s"

In HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\Enkr
- ActiveDate = "2014-04-25"

In HKEY_CURRENT_USER\SoftwareMicrosoftWindowsCurrentVersionRun
- Fox-Corn = "%User Profile%\Tools\upenkr.exe"

In HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\Enkr
- UpdateTime = "01:08:55"

To delete the registry value this malware/grayware created:

Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
MicrowindowSearch = "%System%\MicrowindowSearch\MicrowindowSearch.exe"
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
MicrowindowSearch = "%System%\MicrowindowSearch\MicrowindowSearch.exe"
Again In the right panel, locate and delete the entry:
catroot = "%System%\AppCompat\catroot\catrootsz.exe"
Again In the right panel, locate and delete the entry:
Fox-Corn = "%User Profile%\Tools\upenkr.exe"
Again In the right panel, locate and delete the entry:
Fox-Corn = "%User Profile%\Tools\upenkr.exe"
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>AppDataLow>MicrowindowSearch
In the right panel, locate and delete the entry:
Version = "1.0.0.1"
Again In the right panel, locate and delete the entry:
RealTime = "Yes"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>MicrowindowSearch_is1
In the right panel, locate and delete the entry:
Inno Setup: Setup Version = "5.5.0 (a)"
Again In the right panel, locate and delete the entry:
Inno Setup: App Path = "%System%\MicrowindowSearch"
Again In the right panel, locate and delete the entry:
InstallLocation = "%System%\MicrowindowSearch"
Again In the right panel, locate and delete the entry:
Inno Setup: Icon Group = "MicrowindowSearch"
Again In the right panel, locate and delete the entry:
Inno Setup: User = "Wilbert"
Again In the right panel, locate and delete the entry:
Inno Setup: Language = "default"
Again In the right panel, locate and delete the entry:
DisplayName = "MicrowindowSearch"
Again In the right panel, locate and delete the entry:
UninstallString = "%System%\MicrowindowSearch\unins000.exe "
Again In the right panel, locate and delete the entry:
QuietUninstallString = "%System%\MicrowindowSearch\unins000.exe /SILENT"
Again In the right panel, locate and delete the entry:
DisplayVersion = "1.0.0.1"
Again In the right panel, locate and delete the entry:
Publisher = "MicrowindowSearch Inc."
Again In the right panel, locate and delete the entry:
NoModify = "1"
Again In the right panel, locate and delete the entry:
NoRepair = "1"
Again In the right panel, locate and delete the entry:
InstallDate = "20140425"
Again In the right panel, locate and delete the entry:
MajorVersion = "1"
Again In the right panel, locate and delete the entry:
MinorVersion = "0"
Again In the right panel, locate and delete the entry:
GUID = "{DD82EDBC-8C08-4232-94E4-D42D0BFE3D66}"
Again In the right panel, locate and delete the entry:
partnerID = "MicrowindowSearch"
Again In the right panel, locate and delete the entry:
ActiveDate = "2014-04-25"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>ApplicationSpecialManagement
In the right panel, locate and delete the entry:
Description = "ÇÒ´ç, °Ô½Ã, Á¦°Å "
Again In the right panel, locate and delete the entry:
Version = "1.0.0.2"
Again In the right panel, locate and delete the entry:
UpdateTime = "20140425"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>AppDataLow>catroot
In the right panel, locate and delete the entry:
Ver = "1.0.0.0"
Again In the right panel, locate and delete the entry:
g = "{E7AC4460-72F0-4925-83FF-AD50AAEECE65}"
Again In the right panel, locate and delete the entry:
PID = "B"
Again In the right panel, locate and delete the entry:
aDay = "2014-04-25"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>AppCatroots
In the right panel, locate and delete the entry:
Description = "ÀÌ ¿ë¿ëÇÁ·Î±×·¥Àº Áö¼ÓÀûÀ¸·Î ½Ã½ºÅÛ ¼º´ÉÀ» À¯ÁöÇÕ´Ï´Ù."
Again In the right panel, locate and delete the entry:
UpDay = "20140425"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>AppDataLow>Enkr
In the right panel, locate and delete the entry:
partnerID = "enkr_03"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>Fox-Corn_is1
In the right panel, locate and delete the entry:
Inno Setup: Setup Version = "5.5.0 (a)"
Again In the right panel, locate and delete the entry:
Inno Setup: App Path = "%User Profile%\FoxPlugin\Tools"
Again In the right panel, locate and delete the entry:
InstallLocation = "%User Profile%\FoxPlugin\Tools"
Again In the right panel, locate and delete the entry:
Inno Setup: Icon Group = "Fox-Corn"
Again In the right panel, locate and delete the entry:
Inno Setup: User = "Wilbert"
Again In the right panel, locate and delete the entry:
Inno Setup: Language = "default"
Again In the right panel, locate and delete the entry:
DisplayName = "Foxcorn Plugin"
Again In the right panel, locate and delete the entry:
DisplayIcon = "%User Profile%\Tools\Foxcorn.exe"
Again In the right panel, locate and delete the entry:
UninstallString = "%User Profile%\Tools\unins000.exe "
Again In the right panel, locate and delete the entry:
QuietUninstallString = "%User Profile%\Tools\unins000.exe /SILENT"
Again In the right panel, locate and delete the entry:
DisplayVersion = "1.0.0.8"
Again In the right panel, locate and delete the entry:
Publisher = "Fox-Corn."
Again In the right panel, locate and delete the entry:
URLInfoAbout = "Fox-Corn"
Again In the right panel, locate and delete the entry:
NoModify = "1"
Again In the right panel, locate and delete the entry:
NoRepair = "1"
Again In the right panel, locate and delete the entry:
InstallDate = "20140425"
Again In the right panel, locate and delete the entry:
MajorVersion = "1"
Again In the right panel, locate and delete the entry:
MinorVersion = "0"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>AppDataLow
In the right panel, locate and delete the entry:
fox = "0"
Again In the right panel, locate and delete the entry:
UpdateTime = "01:08:32"
Again In the right panel, locate and delete the entry:
InstallTime = "2014042501"
Again In the right panel, locate and delete the entry:
Version = "1.0.0.8"
Again In the right panel, locate and delete the entry:
GUID = "{3B9AC289-91AA-4408-BF6E-1F07765338DD}"
Again In the right panel, locate and delete the entry:
InstallTime = "2014-04-25_01:08:32"
Again In the right panel, locate and delete the entry:
a = "07197EF1"
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Extensions>{000000A1-CA93-46BB-9D4A-DBD498CB8944}
In the right panel, locate and delete the entry:
ButtonText = "G¸¶ÄÏ ÀÌµ¿"
Again In the right panel, locate and delete the entry:
ToolTip = "G¸¶ÄÏ ÀÌµ¿"
Again In the right panel, locate and delete the entry:
ClSid = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"
Again In the right panel, locate and delete the entry:
Default Visible = "Yes"
Again In the right panel, locate and delete the entry:
Exec = "http://cl.{BLOCKED}lick.com/?dts_code
Again In the right panel, locate and delete the entry:
HotIcon = "%User Profile%\img\g.ico"
Again In the right panel, locate and delete the entry:
Icon = "%User Profile%\img\g.ico"
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Extensions>{000000A2-F93E-4C0B-87D5-490AEF45ADD3}
In the right panel, locate and delete the entry:
ButtonText = "¿Á¼Ç ÀÌµ¿"
Again In the right panel, locate and delete the entry:
ToolTip = "¿Á¼Ç ÀÌµ¿"
Again In the right panel, locate and delete the entry:
ClSid = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"
Again In the right panel, locate and delete the entry:
Default Visible = "Yes"
Again In the right panel, locate and delete the entry:
Exec = "http://cl.{BLOCKED}lick.com/?dts_code
Again In the right panel, locate and delete the entry:
HotIcon = "%User Profile%\img\a.ico"
Again In the right panel, locate and delete the entry:
Icon = "%User Profile%\img\a.ico"
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Extensions>{000000A3-57A6-49EA-B96B-1428070E5924}
In the right panel, locate and delete the entry:
ButtonText = "11¹ø°¡ ÀÌµ¿"
Again In the right panel, locate and delete the entry:
ToolTip = "11¹ø°¡ ÀÌµ¿"
Again In the right panel, locate and delete the entry:
ClSid = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"
Again In the right panel, locate and delete the entry:
Default Visible = "Yes"
Again In the right panel, locate and delete the entry:
Exec = "http://cl.{BLOCKED}lick.com/?dts_code
Again In the right panel, locate and delete the entry:
HotIcon = "%User Profile%\img\11.ico"
Again In the right panel, locate and delete the entry:
Icon = "%User Profile%\img\11.ico"
Again In the right panel, locate and delete the entry:
e = "s"
Again In the right panel, locate and delete the entry:
ActiveDate = "2014-04-25"
In the left panel, double-click the following:
HKEY_CURRENT_USER>SoftwareMicrosoftWindowsCurrentVersionRun
In the right panel, locate and delete the entry:
Fox-Corn = "%User Profile%\Tools\upenkr.exe"
Again In the right panel, locate and delete the entry:
UpdateTime = "01:08:55"
Close Registry Editor.

Step 5

Search and delete these components

[ Learn More ]

There may be some components that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.

%Program Files%\MicrowindowSearch_setup.exe
%User Temp%\is-GP58O.tmp\MicrowindowSearch_setup.tmp
%User Temp%\is-HVBI1.tmp\_isetup\_RegDLL.tmp
%User Temp%\is-HVBI1.tmp\_isetup\_shfoldr.dll
%Program Files%\del_bat.cmd
%System%\MicrowindowSearch\unins000.dat
%System%\MicrowindowSearch\is-AU3ET.tmp
%System%\is-N9TQF.tmp
%System%\MicrowindowSearch\is-L2NSH.tmp
%System%\MicrowindowSearch\is-C3HG3.tmp
%System%\MicrowindowSearch\is-UGE06.tmp
%User Temp%\_ir_tu2_temp_0\_TUProjDT.dat
%User Temp%\_ir_tu2_temp_0\32_2.ico
%System%\MicrowindowSearch\MicrowindowSearch.ts3
%User Temp%\_ir_tu2_temp_0\_tu_DATUP_0\MicrowindowSearch.ts2
%System%\MicrowindowSearch\MicrowindowSearch.dat
%System%\MicrowindowSearch\MicrowindowSearch.exe
%System%\MicrowindowSearch\MicrowindowSearch Update Log.txt
%System%\WindowServiceNT.exe_tmp
%System%\ctsins.exe_tmp
%System%\foxinst.exe_tmp
%User Profile%\Documents\catins2.exe
%System%\336699.bat
%User Profile%\Documents\enkr_03.exe
%User Temp%\is-ESJLE.tmp\catins2.tmp
%User Temp%\is-8CKSA.tmp\_isetup\_RegDLL.tmp
%User Temp%\is-8CKSA.tmp\_isetup\_shfoldr.dll
%User Profile%\Documents\del_bat.cmd
%System%\AppCompat\catroot\unins000.dat
%System%\AppCompat\catroot\is-MNJB6.tmp
%System%\AppCompat\catroot\is-N5JKU.tmp
%System%\AppCompat\catroot\is-G751S.tmp
%System%\AppCompat\catroot\is-FSJFR.tmp
%System%\AppCompat\catroot\is-J1ONT.tmp
%User Temp%\is-A9FFC.tmp\enkr_03.tmp
%User Temp%\_ir_tu2_temp_0\162.ico
%User Temp%\is-FSIPT.tmp\_isetup\_RegDLL.tmp
%User Temp%\is-FSIPT.tmp\_isetup\_shfoldr.dll
%User Profile%\Tools\unins000.dat
%User Profile%\Tools\is-BBALM.tmp
%User Profile%\Tools\is-A30PU.tmp
%User Profile%\Tools\is-R0HDD.tmp
%User Profile%\Tools\is-7TM5T.tmp
%User Profile%\Tools\is-UUEKN.tmp
%User Profile%\img\is-R9K40.tmp
%User Profile%\img\is-RJFAO.tmp
%User Profile%\img\is-O0UFO.tmp
%Favorites%\G¸¶ÄÏ ÀÌµ¿.URL
%Favorites%\¿Á¼Ç ÀÌµ¿.URL
%Favorites%\11¹ø°¡ ÀÌµ¿.URL
%User Profile%\Tools\upenkr.dat
%User Temp%\_ir_tu2_temp_1\_TUProjDT.dat
%User Temp%\_ir_tu2_temp_1\ico.ico

336699.bat
%User Profile%\Documents\enkr_03.exe
%User Temp%\is-ESJLE.tmp\catins2.tmp
%User Temp%\is-8CKSA.tmp\_isetup\_RegDLL.tmp
%User Temp%\is-8CKSA.tmp\_isetup\_shfoldr.dll
%User Profile%\Documents\del_bat.cmd
%System%\AppCompat\catroot\unins000.dat
%System%\AppCompat\catroot\is-MNJB6.tmp
%System%\AppCompat\catroot\is-N5JKU.tmp
%System%\AppCompat\catroot\is-G751S.tmp
%System%\AppCompat\catroot\is-FSJFR.tmp
%System%\AppCompat\catroot\is-J1ONT.tmp
%User Temp%\is-A9FFC.tmp\enkr_03.tmp
%User Temp%\_ir_tu2_temp_0\162.ico
%User Temp%\is-FSIPT.tmp\_isetup\_RegDLL.tmp
%User Temp%\is-FSIPT.tmp\_isetup\_shfoldr.dll
%User Profile%\Tools\unins000.dat
%User Profile%\Tools\is-BBALM.tmp
%User Profile%\Tools\is-A30PU.tmp
%User Profile%\Tools\is-R0HDD.tmp
%User Profile%\Tools\is-7TM5T.tmp
%User Profile%\Tools\is-UUEKN.tmp
%User Profile%\img\is-R9K40.tmp
%User Profile%\img\is-RJFAO.tmp
%User Profile%\img\is-O0UFO.tmp
%Favorites%\G¸¶ÄÏ ÀÌµ¿.URL
%Favorites%\¿Á¼Ç ÀÌµ¿.URL
%Favorites%\11¹ø°¡ ÀÌµ¿.URL
%User Profile%\Tools\upenkr.dat
%User Temp%\_ir_tu2_temp_1\_TUProjDT.dat
%User Temp%\_ir_tu2_temp_1\ico.ico

In the Look In drop-down list, select My Computer then press Enter.

Once located, select the file then press SHIFT+DELETE to delete it.

Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

Click Start>Computer.
In the Search input box, type:
%Program Files%\MicrowindowSearch_setup.exe
%User Temp%\is-GP58O.tmp\MicrowindowSearch_setup.tmp
%User Temp%\is-HVBI1.tmp\_isetup\_RegDLL.tmp
%User Temp%\is-HVBI1.tmp\_isetup\_shfoldr.dll
%Program Files%\del_bat.cmd
%System%\MicrowindowSearch\unins000.dat
%System%\MicrowindowSearch\is-AU3ET.tmp
%System%\is-N9TQF.tmp
%System%\MicrowindowSearch\is-L2NSH.tmp
%System%\MicrowindowSearch\is-C3HG3.tmp
%System%\MicrowindowSearch\is-UGE06.tmp
%User Temp%\_ir_tu2_temp_0\_TUProjDT.dat
%User Temp%\_ir_tu2_temp_0\32_2.ico
%System%\MicrowindowSearch\MicrowindowSearch.ts3
%User Temp%\_ir_tu2_temp_0\_tu_DATUP_0\MicrowindowSearch.ts2
%System%\MicrowindowSearch\MicrowindowSearch.dat
%System%\MicrowindowSearch\MicrowindowSearch.exe
%System%\MicrowindowSearch\MicrowindowSearch Update Log.txt
%System%\WindowServiceNT.exe_tmp
%System%\ctsins.exe_tmp
%System%\foxinst.exe_tmp
%User Profile%\Documents\catins2.exe
%System%\336699.bat
%User Profile%\Documents\enkr_03.exe
%User Temp%\is-ESJLE.tmp\catins2.tmp
%User Temp%\is-8CKSA.tmp\_isetup\_RegDLL.tmp
%User Temp%\is-8CKSA.tmp\_isetup\_shfoldr.dll
%User Profile%\Documents\del_bat.cmd
%System%\AppCompat\catroot\unins000.dat
%System%\AppCompat\catroot\is-MNJB6.tmp
%System%\AppCompat\catroot\is-N5JKU.tmp
%System%\AppCompat\catroot\is-G751S.tmp
%System%\AppCompat\catroot\is-FSJFR.tmp
%System%\AppCompat\catroot\is-J1ONT.tmp
%User Temp%\is-A9FFC.tmp\enkr_03.tmp
%User Temp%\_ir_tu2_temp_0\162.ico
%User Temp%\is-FSIPT.tmp\_isetup\_RegDLL.tmp
%User Temp%\is-FSIPT.tmp\_isetup\_shfoldr.dll
%User Profile%\Tools\unins000.dat
%User Profile%\Tools\is-BBALM.tmp
%User Profile%\Tools\is-A30PU.tmp
%User Profile%\Tools\is-R0HDD.tmp
%User Profile%\Tools\is-7TM5T.tmp
%User Profile%\Tools\is-UUEKN.tmp
%User Profile%\img\is-R9K40.tmp
%User Profile%\img\is-RJFAO.tmp
%User Profile%\img\is-O0UFO.tmp
%Favorites%\G¸¶ÄÏ ÀÌµ¿.URL
%Favorites%\¿Á¼Ç ÀÌµ¿.URL
%Favorites%\11¹ø°¡ ÀÌµ¿.URL
%User Profile%\Tools\upenkr.dat
%User Temp%\_ir_tu2_temp_1\_TUProjDT.dat
%User Temp%\_ir_tu2_temp_1\ico.ico
Once located, select the file then press SHIFT+DELETE to delete it.
Repeat the said steps for all files listed.
*Note: Read the following Microsoft page if these steps do not work on Windows 7.

Step 6

Search and delete these folders

[ Learn More ]

Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result.

%User Temp%\is-GP58O.tmp
%User Temp%\is-HVBI1.tmp
%User Temp%\is-HVBI1.tmp\_isetup
%System%\MicrowindowSearch
%User Temp%\_ir_tu2_temp_0
%User Temp%\_ir_tu2_temp_0\_tu_DATUP_0
%User Temp%\is-ESJLE.tmp
%User Temp%\is-8CKSA.tmp
%User Temp%\is-8CKSA.tmp\_isetup
%System%\AppCompat
%System%\AppCompat\catroot
%User Temp%\is-A9FFC.tmp
%User Temp%\is-FSIPT.tmp
%User Temp%\is-FSIPT.tmp\_isetup
%User Profile%\Microsoft\FoxPlugin
%User Profile%\FoxPlugin\Tools
%User Profile%\Tools\img
%User Temp%\_ir_tu2_temp_1

Step 7

Restart in normal mode and scan your computer with your Trend Micro product for files detected as ADW_MICROWINSEARCH. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 8

Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again.

%User Temp%\nsm1.tmp
%System Root%\DEL_NS~1.CMD
%Program Files%\MICROW~1.EXE
%User Temp%\IRW18.tmp
%System%\MicrowindowSearch\IRT1A.tmp
%User Temp%\IRW1C.tmp
%User Temp%\IRW20.tmp
%System%\MicrowindowSearch\MICROWINDOWSEARCH.EXE
%User Temp%\IRW29.tmp
%System%\WindowServiceNT.exe
%User Temp%\IRW2B.tmp
%User Temp%\IRW2E.tmp
%User Temp%\IRW30.tmp
%User Temp%\IRW33.tmp
%System%\foxinst.exe
%User Temp%\IRW5C.tmp
%User Temp%\IRW77.tmp

Step 9

Restore these deleted registry keys/values from backup

*Note: Only Microsoft-related keys/values will be restored. If the malware/grayware also deleted registry keys/values related to programs that are not from Microsoft, please reinstall those programs on your computer.

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall
- MicrowindowSearch_is1

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
- MicrowindowSearch_is1

In HKEY_LOCAL_MACHINE\Software\AppDataLow
- xprefund

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall
- Fox-Corn_is1

Did this description help? Tell us how we did.

ADW_MICROWINSEARCH

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

ADW_MICROWINSEARCH

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

The Americas

Middle East & Africa

Europe

Asia & Pacific