F-Secure
Tools
Adware:W32/GigaSearch
| Name : | Adware:W32/GigaSearch |
| Detection Names : |
Adware.Win32.Giga |
| Category: | Spyware |
| Type: | Adware |
| Platform: | W32 |
| Author: | GagaBar Module |
| Website: | http://gigasearch.biz |
Summary
This program delivers advertising content to the user. It is usually annoying but harmless, unless it is combined with spyware or trackware.
Details
Registry Modifications
Creates these keys:
• [HKEY_CLASSES_ROOT\CLSID\{C1EA1782-8E6E-4EA4-9800-B68DE41F1A26}]
• [HKEY_CLASSES_ROOT\Interface\{1F080480-802D-468F-AF65-D031EDCBFD4A}]
• [HKEY_CLASSES_ROOT\TypeLib\{79837A1F-9D73-4242-A3C1-9F2312EB8EF2}]
• [HKEY_CLASSES_ROOT\GigaBar.ToolBandObj]
• [HKEY_LOCAL_MACHINE\Software\Classes\GigaBar.ToolBandObj]
• [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar]
"{C1EA1782-8E6E-4EA4-9800-B68DE41F1A26}"="Giga Search"
"{C1EA1782-8E6E-4EA4-9800-B68DE41F1A26}"="Giga Search"
• [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{C1EA1782-8E6E-4EA4-9800-B68DE41F1A26}]
• [HKEY_LOCAL_MACHINE\Software\Classes\Interface\{1F080480-802D-468F-AF65-D031EDCBFD4A}]
• [HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{79837A1F-9D73-4242-A3C1-9F2312EB8EF2}]
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&GigaBar Serach]
• [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\{C1EA1782-8E6E-4EA4-9800-B68DE41F1A26}]
Additional Details
GigaSearch is an adware program that also includes functionality to perform browser hijacking.
It is able to modify the web browser's settings to hijack the browser's main pages and install toolbars, browser plug-ins and browser helper objects (BHO).
Installation
Upon execution, it adds a list of URLs to the Favorites folder and Desktop. Some of which may contain adult contents:
Activity
When the adware is executed, it performs the following actions:
Registry
During installation, the program modifies the following registry subkeys to change Internet Explorer's default settings:
It also adds various registry subkeys (see above).
It is able to modify the web browser's settings to hijack the browser's main pages and install toolbars, browser plug-ins and browser helper objects (BHO).
Installation
Upon execution, it adds a list of URLs to the Favorites folder and Desktop. Some of which may contain adult contents:
• %favorites%\Computers and Privacy
• %favorites%\Real Estate
• %favorites%\Finance
• %favorites%\Sport
• %favorites%\Travel
• %favorites%\Pharmacy
• %favorites%\Gambling
• %favorites%\Dating
• %favorites%\Shopping
Activity
When the adware is executed, it performs the following actions:
• Changes the Internet Explorer startpage to gigasearch.biz
• Hijacks the home page and search page
• Displays pop-up advertisements
• Installs unwanted advertisement shorcuts
• Installs the Giga Search toolbar
Registry
During installation, the program modifies the following registry subkeys to change Internet Explorer's default settings:
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://gigasearch.bin/?206"
"Start Page"="http://gigasearch.bin/?206"
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://gigasearch.bin/?206"
"Search Page"="http://gigasearch.bin/?206"
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser]
"ITBarLayout"=
"ITBarLayout"=
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"ITBarLayout"=
"ITBarLayout"=
It also adds various registry subkeys (see above).