F-Secure Virus Descriptions : GetNet

F-Secure Anti-Virus detects Backdoor.GetNet in a browser plugin that was created by iGetNet to aid Internet search. The plugin can be downloaded from www.igetnet.com website by clicking 'Try Demo' button.

Originally detection of this plugin was added because the plugin's behaviour is malware-like: it is installed to user's system without confirmation and without showing a licence agreement, it can by itself download and run files on user's computer.

Technical Information

The GetNet plugin is distributed inside an installation package that is downloaded and activated on a computer when a user clicks certain area on IGetNet website. The installer drops the main plugin's file to a hard drive without showing any licence agreement or asking confimation from a user. The GetNet plugin's main file is dropped to Windows System folder as Winstart001.exe file and the special Registry key is created to make sure that the plugin's file is started during every Windows session:

 [HKEY_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\Run]
 "WinStart001.exe" = "%WinSysDir%\WinStart001.exe -b"