Spyware.Vipsearcher

Behavior
Spyware.Vipsearcher is an Internet Explorer Browser Helper Object. It monitors browsing patterns and sends URL information to a remote server.

Symptoms
One or more files are detected as Spyware.Vipsearcher.

Transmission
Spyware.Vipsearcher must be manually installed.

technical details
File names:
miamore32.dll

When Spyware.Vipsearcher is installed, it performs the following actions:

1. Creates the following registry entries:

HKEY_CLASSES_ROOT\CLSID\{1559C6FD-8BDE-476E-98C7-871E59193FCE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1559C6FD-8BDE-476E-98C7-871E59193FCE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\lindow

2. Attempts to access the following web sites:

* http://[domain removed].net/inf/gl.php
* http://[domain removed].com/gtest/miamore32.php

and saves files as the following:

* %Windir%\qwe.log
* %Windir%\qw.log

These files contain encrypted URL that is used by Spyware.Vipsearcher.

Note: %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

3. Monitors user's web browsing pattern and stores them in following registry entry:

HKEY_CURRENT_USERS\Software\Microsoft\lindow

REMOVAL INSTRUCTIONS
See: http://securityresponse.symantec.com/avcenter/venc/data/spyware.vipsearcher.html