Adware AdultLinks Spyware
Type: Adware (Previously called Spyware)
Name: QaBarSystems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
Systems Not Affected: DOS, Linux, Macintosh, Microsoft IIS, OS/2, UNIX, Windows 3.x
This spyware threat can be detected only by free Spyware Scanner software that support expanded threats.
The Spyware's Behavior
The spyware 'AdultLinks' is an adware application that modifies the search feature and adds a toolbar to Internet Explorer. The adware also monitors browsing activities in Internet Explorer.The presence of several links to adult pages will appear in your Internet Explorer.
Your default search page will be changed to dev.ntcor.com.
The spyware/adware can be installed via Web pages. The user would have to agree to the installation.
File names: QaBar.dll; SetupAdultLinks.exe
When the self-extracting .zip Spyware file for the Adware 'AdultLinks' is executed, it will perform..
Copies QaBar.dll to windir\system32\Adds the value
ForceShow = "rundll32.exe C:\windir\system32\qabar.dll ,ForceShowBar"
to the registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft
\Windows\CurrentVersion\RunOnce
Adds the value
SearchAssistant = "dev.ntcor.com/search.html"
to the registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft
\Internet Explorer\Search
which changes the default search page in Internet Explorer.
Adds the value
{965e6b07-6832-4738-bdbe-25f226ba2ab0} = "Adult Links"
to the registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft
\Internet Explorer\Toolbar
which adds a toolbar called AdultLinks to Internet Explorer.
Adds in the following keys:
HKEY_LOCAL_MACHINE\Software\CLASSES
\CLSID\{965e6b07-6832-4738-bdbe-25f226ba2ab0}
HKEY_LOCAL_MACHINE\Software\CLASSES
\CLSID\{dd1bca06-f674-424d-a08e-42da97c4d5dd}
HKEY_LOCAL_MACHINE\Software\CLASSES
\Interface\{6D7D135E-F7C2-4A27-A87C-C0DFEB3A628F}
HKEY_LOCAL_MACHINE\Software\CLASSES
\Interface\{D1320CBB-403D-483D-AE9A-688960A96977}
HKEY_LOCAL_MACHINE\Software\CLASSES
\TypeLib\{D02EE3A0-1881-419F-A5EF-737223463292}
HKEY_LOCAL_MACHINE\Software\CLASSES
\QaBar.1\
HKEY_LOCAL_MACHINE\Software\CLASSES
\QaBar.AdultSearch.1\
HKEY_LOCAL_MACHINE\Software\QcBar\
which allows the spyware to monitor Internet Explorer activities.
Attempts to download a Web page from mainentrypoint.com containing a list of links. The adware will add these links to the Favorites menu in your Internet Explorer.
Deleting the Spyware value from the Registry
Click Start, and then click Run. (The Run dialog box appears.)Type regedit
Then click OK. (The Registry Editor opens.)
Navigate to the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
\Windows\CurrentVersion\RunOnce
In the right pane, if it exists, delete the value:
ForceShow = "rundll32.exe C:\windir\system32\qabar.dll ,ForceShowBar"
Navigate to the key:
HKEY_LOCAL_MACHINE\Software\Microsoft
\Internet Explorer\Search
In the right pane, delete the value:
SearchAssistant = "dev.ntcor.com/search.html"
Navigate to the key:
HKEY_LOCAL_MACHINE\Software\Microsoft
\Internet Explorer\ToolBar
In the right pane, delete the value:
{965e6b07-6832-4738-bdbe-25f226ba2ab0} = "Adult Links"
Navigate to the key:
HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID
In the left pane, delete the keys:
{965e6b07-6832-4738-bdbe-25f226ba2ab0}
{dd1bca06-f674-424d-a08e-42da97c4d5dd}
Navigate to the key:
HKEY_LOCAL_MACHINE\Software
\CLASSES\Interface\
In the left pane, delete the keys:
{6D7D135E-F7C2-4A27-A87C-C0DFEB3A628F}
{D1320CBB-403D-483D-AE9A-688960A96977}
Navigate to the key:
HKEY_LOCAL_MACHINE\Software
\CLASSES\TypeLib\
In the left pane, delete the key:
{D02EE3A0-1881-419F-A5EF-737223463292}
Navigate to the key:
HKEY_LOCAL_MACHINE\Software\CLASSES
In the left pane, delete the keys:
QaBar.1
QaBar.AdultSearch.1
Navigate to the key:
HKEY_LOCAL_MACHINE\Software
In the left pane, delete the key:
QcBar
Exit the Registry Editor.
Reboot your computer.
Scanning for and Deleting the Spyware files
Run your free Spyware Scanner and make sure that it is configured to scan all files.Run a full system spyware scan.
If any files are detected as spyware infected with the Adware AdultLinks, click Delete.
You will find much more on this topic at WorldsLargestNetwork.com
 |
|
|
|
|
WorldsLargestNetwork.com
