Adware.Win32.MyWebSearch.GA

This Adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be manually installed by a user.

Arrival Details

This Adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be manually installed by a user.

Installation

This Adware adds the following folders:

• %User Temp%\nsa{random}.tmp
• %AppDataLocal%\SearchFormsOnlineTooltab

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local on Windows Vista, 7, and 8.)

It drops the following files:

• %AppDataLocal%\SearchFormsOnlineTooltab\TooltabExtension.dll
• %User Temp%\nsa{random}.tmp\cancel_blue_1475521919365_1487177690297.bmp
• %User Temp%\nsa{random}.tmp\Install_ENG_1436200260055.bmp
• %User Temp%\nsa{random}.tmp\installerParams
• %User Temp%\nsa{random}.tmp\nsDialogs.dll
• %User Temp%\nsa{random}.tmp\reporting
• %User Temp%\nsa{random}.tmp\secondary_accept.png
• %User Temp%\nsa{random}.tmp\secondary_bg.png
• %User Temp%\nsa{random}.tmp\secondary_decline.png
• %User Temp%\nsa{random}.tmp\SFO_msi_bg-copy_1501864054589.bmp
• %User Temp%\nsa{random}.tmp\SFO_msi_bg-copy_1501864070404.bmp
• %User Temp%\nsa{random}.tmp\System.dll
• %User Temp%\nsl{random}.tmp

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local on Windows Vista, 7, and 8.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

Other System Modifications

This Adware adds the following registry keys:

HKEY_CURRENT_USER\Software\SearchFormsOnline

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Start Page = http://hp.{BLOCKED}y.com/searchformsonline/ttab02/index.html?n=C08C4E8&p2=^CPV^mni000^TTAB02&ptb=F3BC073A-F596-4B07-8E29-91AFF9A64022&coid=09a458dea1854714b4b9926a47429d8b

HKEY_CURRENT_USER\Software\SearchFormsOnline
Start Page = http://hp.{BLOCKED}y.com/searchformsonline/ttab02/index.html?n=C08C4E8&p2=^CPV^mni000^TTAB02&ptb=F3BC073A-F596-4B07-8E29-91AFF9A64022&coid=09a458dea1854714b4b9926a47429d8b

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
SearchFormsOnlineTooltab Uninstall Internet Explorer
DisplayName = SearchFormsOnline Internet Explorer Homepage and New Tab

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
SearchFormsOnlineTooltab Uninstall Internet Explorer
UninstallString = Rundll32.exe "C:\Users\{BLOCKED}r\AppData\Local\SearchFormsOnlineTooltab\TooltabExtension.dll" U uninstall:SearchFormsOnline

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
SearchFormsOnlineTooltab Uninstall Internet Explorer
Publisher = Mindspark Interactive Network, Inc.

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
SearchFormsOnlineTooltab Uninstall Internet Explorer
HelpLink = http://support.{BLOCKED}ark.com/

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
SearchFormsOnlineTooltab Uninstall Internet Explorer
URLInfoAbout = http://support.{BLOCKED}ark.com/

HKEY_CURRENT_USER\Software\SearchFormsOnline
UnInstallSurveyUrl = http://@{downloadDomain}.dl.{BLOCKED}y.com/uninstall.jhtml?surveyUrl=http%3A%2F%2Fwww.research.net%2Fr%2FHYSCVNM%3Fc%3DF3BC073A-F596-4B07-8E29-91AFF9A64022%26ptb%3D^CPV^mni000^TTAB02

Mobile Malware Routine

This Adware accesses the following possibly malicious URL(s):

• http://anx.{BLOCKED}ark.com/anx.gif?anxa=CAPDownloadProcess&anxe=Error&errorCode=-16&errorType=nsisError&errorDetails=&platform=vicinio&anxv=2.7.1.3000&anxd=2018-05-18&coid=&refPartner=^CPV^mni000^TTAB02&refSub=&anxl=en-US&anxr=2077829834&refCobrand=CPV&refCampaign=mni000&refTrack=TTAB02&refCountry=
• http://anx.{BLOCKED}ark.com/anx.gif?anxa=CAPDownloadProcess&anxe=Error&errorCode=-8&errorType=nsisError&errorDetails=1%2Eexe&platform=vicinio&anxv=2.7.1.3000&anxd=2018-05-18&coid=65023ab80e06405a94bb47e84bf0cd64&refPartner=^CPV^mni000^TTAB02&refSub=&anxl=en-US&anxr=-2076664098&refCobrand=CPV&refCampaign=mni000&refTrack=TTAB02&refCountry=
• http://anx.{BLOCKED}ark.com/anx.gif?anxa=CAPDownloadProcess&anxe=InstallerInvoked&platform=vicinio&anxv=2.7.1.3000&anxd=2018-05-18&coid=65023ab80e06405a94bb47e84bf0cd64&refPartner=^CPV^mni000^TTAB02&refSub=&anxl=en-US&anxr=2133614130&refCobrand=CPV&refCampaign=mni000&refTrack=TTAB02&refCountry=
• http://anx.{BLOCKED}ark.com/anx.gif?anxa=CAPDownloadProcess&anxe=Error&errorCode=-13&errorType=nsisError&errorDetails=EmptyPartnerId&platform=vicinio&anxv=2.7.1.3000&anxd=2018-05-18&coid=65023ab80e06405a94bb47e84bf0cd64&refPartner=^CPV^mni000^TTAB02&refSub=&anxl=en-US&anxr=2133698250&refCobrand=CPV&refCampaign=mni000&refTrack=TTAB02&refCountry=
• http://hp.{BLOCKED}y.com/searchformsonline/ttab02/index.html?n=C08C4E8&p2=^CPV^mni000^TTAB02&ptb=152B92C7-33B4-4C3E-96B9-4F34662EAC38&coid=65023ab80e06405a94bb47e84bf0cd64