Adware.2Search

Behavior
Adware.2Search monitors URLs visited by Internet Explorer and displays similar URLs to the user.

Symptoms
Files are detected as Adware.2Search

Transmission
This adware component must be manually installed or installed as a component of another program.

technical details
File names:
getst.exe
main.exe
plugin.dll
svchost.exe
the007guard.ocx
the007installer.exe
007guard.exe
searchinstaller.exe

When Adware.2search is executed, it performs the following actions:

1. Creates some of the following files:

* C:\Program Files\2Search\date.dat
* C:\Program Files\2Search\defaultne.txt
* C:\Program Files\2Search\getst.exe
* C:\Program Files\2Search\main.exe
* C:\Program Files\2Search\plugin.dll
* C:\Program Files\2Search\svchost.exe
* C:\Program Files\2Search\uninstall.exe
* C:\Program Files\The Guard\the007guard.ocx
* C:\Program Files\The Guard\the007installer.exe
* %System%\007guard.exe
* %System%\2searchinstaller.exe

2. Creates one or more of the following registry subkeys:

HKEY_CLASSES_ROOT\Interface\{03BE31FE-6526-4D9C-B197-4A3E5DCFF696}
HKEY_CLASSES_ROOT\TypeLib\{68E774CB-72D1-4A52-B55B-C0B1011E013B}
HKEY_CLASSES_ROOT\CLSID\{4508E20C-ACAD-11D2-9FC0-00550076E06F}
HKEY_CLASSES_ROOT\IEsearch.clsIESpy
HKEY_CLASSES_ROOT\Interface\{0EB61AF8-0B15-48B6-A971-1F206F2E3D5E}
HKEY_CLASSES_ROOT\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}
HKEY_CLASSES_ROOT\TypeLib\{20048BB0-DB68-11CF-9CAF-00AA006CB425}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{20048BB0-DB68-11CF-9CAF-00AA006CB425}
HKEY_CLASSES_ROOT\The007Guard.The007GuardCtrl.1

which registers the007guard.ocx or plugin.dll as a Browser Help Object.

3. Creates one or more of the following registry subkeys:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2search
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2search
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\the guard
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\the guard
HKEY_LOCAL_MACHINE\SOFTWARE\WinRAR SFX\C%%Program Files%The Guard
HKEY_CURRENT_USER\WinRAR SFX\C%%Program Files%The Guard
HKEY_CURRENT_USER\SOFTWARE\WinRAR SFX\C%%Program Files%2search
HKEY_LOCAL_MACHINE\SOFTWARE\WinRAR SFX\C%%Program Files%2search

4. May add the following entry:

"svchost"="C:\Program Files\2search\svchost.exe"

to the registry subkeys:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

5. Monitors Internet Explorer for access to predetermined search engine and auction Web sites.

6. Displays the URLs of the recorded Web sites in Internet Explorer.

To unregister the .dll or ocx file

1. Click Start > Run.

2. Type, or copy and paste, the following text:

regsvr32 /u "C:\Program Files\2Search\plugin.dll"

then click OK.
3. If a dialog box confirming this action appears, click OK.
4. Type, or copy and paste, the following text:

regsvr32 /u "C:\Program Files\The Guard\the007guard.ocx"

then click OK.
5. If a dialog box confirming this action appears, click OK.

To delete the value from the registry
1. Click Start > Run.
2. Type regedit

Then click OK.

3. Navigate to and delete the following subkeys, if present:

HKEY_CLASSES_ROOT\Interface\{03BE31FE-6526-4D9C-B197-4A3E5DCFF696}
HKEY_CLASSES_ROOT\TypeLib\{68E774CB-72D1-4A52-B55B-C0B1011E013B}
HKEY_CLASSES_ROOT\CLSID\{4508E20C-ACAD-11D2-9FC0-00550076E06F}
HKEY_CLASSES_ROOT\IEsearch.clsIESpy
HKEY_CLASSES_ROOT\Interface\{0EB61AF8-0B15-48B6-A971-1F206F2E3D5E}
HKEY_CLASSES_ROOT\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}
HKEY_CLASSES_ROOT\TypeLib\{20048BB0-DB68-11CF-9CAF-00AA006CB425}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{20048BB0-DB68-11CF-9CAF-00AA006CB425}
HKEY_CLASSES_ROOT\The007Guard.The007GuardCtrl.1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2search
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2search
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\the guard
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\the guard
HKEY_LOCAL_MACHINE\SOFTWARE\WinRAR SFX\C%%Program Files%The Guard
HKEY_CURRENT_USER\WinRAR SFX\C%%Program Files%The Guard
HKEY_CURRENT_USER\SOFTWARE\WinRAR SFX\C%%Program Files%2search
HKEY_LOCAL_MACHINE\SOFTWARE\WinRAR SFX\C%%Program Files%2search

4. Navigate to the subkeys:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

5. In the right pane, delete the value, if present:

"svchost"="C:\Program Files\2search\svchost.exe"

6. Exit the Registry Editor.