|
SearchV Browser Hijacker Information
| Name: |
SearchV |
| Category: |
Browser Hijacker |
| Advice: |
Remove |
| Risk: |
Elevated Risk
Elevated threats are usually threats that fall into the range of adware in which data about a user's habits are tracked and sent back to a server for analysis without your consent or knowledge. |
| Description:
|
SearchV is an adware based homepage hijacker that sets your Internet Explorer homepage to its controlling server (searchv.com) and generates popup ad windows while you are using Internet Explorer.
SearchV upon installation will run in the background and change some of your computer’s Internet Explorer settings to point to the SearchV web site (http://www SearchV.com), this includes the Internet Explorer home page and search URLS. In addition, SearchV will modify the Window’s host file to add an entry for IP address 209.66.114.130 to point to its server and replace common hosts for known search engines.
When visiting the SearchV home page, SearchV attempts to install and execute a registry file on your computer they hijacks your Internet Explorer settings.
Below are some of the hijacked URLs the SearchV spyware modifies in your registry:
1. HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMainStart Page=http://www.searchv.com/w/
2. HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMainSearch Page=http://www.searchv.com/w/search.html
3. HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMainSearch Bar="http:/www.searchv.com/w/search.html"
4. HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMainUse Search Asst="no"
5. HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerSearchUrl(Default)=http://www.searchv.com/w/
6. HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerSearchSearchAssistant=http://www.searchv.com/w/search.html
7. HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerSearchCustomizeSearch=http://www.searchv.com/w/search.html
8. HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerSearchSearchAssistant=http://www.searchv.com/w/search.html
9. HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerSearchCustomizeSearch=http://www.searchv.com/w/search.html
10. HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerSearchDefault_Search_URL=http://www.searchv.com/w/search.html
11. HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerMainDefault_Page_URL=http://www.searchv.com/w/
12. HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerMainDefault_Search_URL=http://www.searchv.com/w/search.html
13. HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerMainSearch Page=http://www.searchv.com/w/search.html
14. HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerMainStart Page="http://www.searchv.com/"
|
| Signatures:
|
process: belt.exe: MD5 Hash: 9601b60da4f224627bc...
process: msupdater.exe: MD5 Hash: 26b1a8a48404118e157...
process: iebs.exe: MD5 Hash: ...
process: rundllw.exe: MD5 Hash: ...
process: dllreg.exe: MD5 Hash: ...
process: load32.exe: MD5 Hash: ...
process: vxdmgr32.exe: MD5 Hash: ...
process: load32.exe: MD5 Hash: ...
process: vxdmgr32.exe: MD5 Hash: .. |
| Type: |
Browser Hijacker - Spyware's primary purpose is to collect demographic and usage information from your computer, usually for advertising purposes. Spyware usually that 'sneaks' onto a system or performs other activities hidden to the user. Spyware programs are usually bundled as a hidden component and downloaded from the Internet. These modules are almost always installed on the system secretively and try to run secretively as well. |
Top Browser Hijacker Visited Pages:
SuperSpider - Alias: Network Security Guard, Melcosoft - 328 visits
Spyass.com - 68 visits
Tubby - Alias: MakeMeSearch, CoolWebSearch.Tubby, Spyware.Arau, Trojan.Win32.StartPage.ih, Trojan.StartPage-FJ - 55 visits
CrackSpider - Alias: Troj/Favadd-D - 51 visits
CoolWebSearch - Alias: CWS, Cool Web Serach, CoolWwwSearch - 50 visits
SecurityToolbar.DesktopScam - 46 visits
Paytime - 41 visits
Trojan.StartPage - Alias: SearchCentral - 37 visits
Search3 Hijacker - 31 visits
SBSoft - 31 visits
Random Browser Hijacker Pages:
Plus18Point - Alias: Plus18
Adw.Melkosoft.SuperSpider
KeenValue PerfectNav - Alias: PerfectNav, KeenValue.PerfectNav
Coolwebsearch.greg-search
CWS.AboutBlank
AutoSearch - Alias: SafeSearch, MSInfoSys
CoolWebSearch.MSG - Alias: CWS variant, MSG
Gigex SpeedDelivery
Roings Search - Alias: Olanda, internazionale_ver3
SP32 HomePage
|
