Adware Searchq
Type: Adware (Spyware was a generalized term used in the past)
Publisher: search-q.comSystems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
Systems Not Affected: DOS, Linux, Macintosh, Microsoft IIS, OS/2, UNIX, Windows 3.x
This spyware threat can be detected only by spyware scanning software that support expanded threats.
The Aware's Behavior
Adware 'Searchq' is an adware program that downloads and displays advertisements. It works as a Browser Helper Object.The spyware files on the system are detected as Adware under the filename(s) 'Searchq'. You should be able to see connections to search-q.com through monitoring your firewall.
File names:
ccHelp.hta; wwHelp.hta; cc96629.dll; cc96629.ico
When Searchq's Adware is executed, it performs the following actions:
Drops a copy of itself to the system folder.Contacts its home server to check for an updated version.
Downloads cc96629.dll to the system folder and registers the .dll.
Creates the following registry keys:
HKEY_LOCAL_MACHINES\SOFTWARE
\Microsoft\ccHelp\cid
HKEY_LOCAL_MACHINES\SOFTWARE
\Microsoft\ccHelp\vNum
HKEY_LOCAL_MACHINES\SOFTWARE
\Microsoft\ccHelp\dvNum
HKEY_LOCAL_MACHINES\SOFTWARE
\Microsoft\ccHelp\drDate
HKEY_LOCAL_MACHINES\SOFTWARE
\Microsoft\ccHelp\rCount
HKEY_LOCAL_MACHINES\SOFTWARE
\Microsoft\ccHelp\svNum
HKEY_LOCAL_MACHINES\SOFTWARE
\Microsoft\ccHelp\sdvNum
The adware may drop a copy of itself to the Internet Explorer Temporary Files folder as cc96629[1].ico.
Downloads and executes the wwHelp.hta portion of the spyware's software, which will begin to display advertisements.
*Make sure you Run a full system spyware scan and delete all the files detected as Adware under the filename(s) 'Searchq', then Delete the spyware value that was added to the registry.
Scanning for and deleting the Spyware and Adware files
Run your free spyware scanner and make sure that it is configured to scan all files.Run a full system scan.
If any files are detected as spyware infected with the Adware 'Searchq', Delete them.
Deleting the Spyware value from the Registry
Deleting the Spyware value from the Registry is done to make sure that all the keys are removed. They may not be there if the uninstaller removed the keys properly.Click Start, and then click Run. (The Run dialog box appears.)
Type regedit
Then click OK. (The Registry Editor opens.)
Navigate to and delete these keys:
HKEY_LOCAL_MACHINES\SOFTWARE
\Microsoft\ccHelp\cid
HKEY_LOCAL_MACHINES\SOFTWARE
\Microsoft\ccHelp\vNum
HKEY_LOCAL_MACHINES\SOFTWARE
\Microsoft\ccHelp\dvNum
HKEY_LOCAL_MACHINES\SOFTWARE
\Microsoft\ccHelp\drDate
HKEY_LOCAL_MACHINES\SOFTWARE
\Microsoft\ccHelp\rCount
HKEY_LOCAL_MACHINES\SOFTWARE
\Microsoft\ccHelp\svNum
HKEY_LOCAL_MACHINES\SOFTWARE
\Microsoft\ccHelp\sdvNum
Exit the Registry Editor.
You will find much more on this topic at WorldsLargestNetwork.com
 |
|
|
|
|
WorldsLargestNetwork.comFree Spyware Scanner
PC Speed Boost
Create Website Easily
Computer Monitoring Software
Internet Education
Anti Spy Software
Stop Pop Ups
Scan PC for Spyware
Pop-up Eliminator
