Toolbar.MyWebSearch

Létrehozva: 2008-09-09, 11:23:58

Utolsó frissítés: 2009-11-09, 19:31:47

Platform: Win32

Típus: alkalmazás

Méret: 24576

Dátum: 2005-11

Veszélyeztetett operációs rendszer(ek): Windows 95, Windows 98, Windows Me, Windows NT, Windows 2000, Windows Server 2003, Windows XP

Nem veszélyeztetett operációs rendszer(ek): Windows 3.xx, DOS, Linux, Unix, Solaris, MacOS, Mac OS X, OS2

Elnevezések:

A különböző vírusvédelmek az egyes vírusokat, férgeket eltérő névvel illethetik. Előfordulhat, hogy egy vírusvédelmi rendszer egy adott károkozó program különböző példányait különböző neveken azonosítja, de az is elképzelhető, hogy különböző vírusokat, férgeket illet azonos néven. Az alábbi lista tájékoztató jelleggel mutatja a legelterjedtebb vírusvédelmek elnevezését, mely természetesen még az adott vírusvédelmi rendszer különböző verziója esetén is más és más lehet.

A Win32/Toolbar.MyWebSearch alkalmazás elnevezései az egyes vírusvédelmek szerint:

vírusvédelem	elnevezés
Avast	Win32:Adware-gen
Avira	ADSPY/Mywebsearch.24576
BitDefender	Adware.Toolbar.MyWebSearch.AC
F-PROT	W32/Adware.AMJ
Fortinet	W32/MyWebSearch
F-Secure	AdTool.Win32.MyWebSearch.i

vírusvédelem	elnevezés
Ikarus	not-a-virus:AdWare.Win32.MyWebSearch.i
Kaspersky	not-a-virus:AdTool.Win32.MyWebSearch.i
McAfee	potentially unwanted program MWS
NOD32 (ESET)	Win32/Toolbar.MyWebSearch
Panda	Application/MyWebSearch
Sophos	MyWebSearch

Telepítés:

Az interneten vagy lokális hálózaton terjedő kártevők elsődleges célja, hogy egy másik számítógépet fertőzzenek meg. A megtámadott számítógép működésébe, annak operációs rendszerébe általában úgy épülnek be, hogy az egy esetleges újraindítást (boot-olást) követően is aktivízálja a kártevő kódját. Ezt általában úgy érik el, hogy a kártevő kódját tartalmazó fájl(oka)t hoznak létre vagy meglévő fájl(oka)t módosítanak, illetve beállítanak néhány bejegyzést a rendszerleíró adatbázisban, ami arra utasítja az induló operációs rendszert, hogy a frissen elhelyezett kártékony kódot is el kell indítani. Emellett - nem közvetlenül az újraindítás érdekében - más területeken (könyvtárakban) is létrehoznak magukból másolatot. Ennek kettős célja van: Egyrészt egy esetleges vírusirtást követően egy eldugott helyen megmaradhatnak a fertőzött állományok, másrészt helyi hálózatokban, megosztott könyvtárakban, peer-to-peer hálózatokban is képes terjedni. Kihasználhatják továbbá a Windows alapértelmezés szerinti beállítását is, miszerint egy létrehozott AUTORUN.INF nevű fájllal el lehet érni, hogy egy meghajtó megnyitásakor is aktivizálódjon a kártékony kód.

A Win32/Toolbar.MyWebSearch alkalmazás az alábbi fájlokat hozza létre:

\MyWebSearch\
\MyWebSearch\SrcAstt\
\MyWebSearch\SrcAstt\1.bin\
\MyWebSearch\SrcAstt\1.bin\MWSSRCAS.DLL
\MyWebSearch\bar\
teljes lista...

A Win32/Toolbar.MyWebSearch alkalmazás a rendszerleíró adatbázisba az alábbi bejegyzéseket hozza létre, illetve módosítja (ha már létezik):

[HKEY_CLASSES_ROOT\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}\InprocServer32] "@"="C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL"
[HKEY_CLASSES_ROOT\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}\InprocServer32] "@"="C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}\InprocServer32] "@"="C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}\InprocServer32] "@"="C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive\bar\Switches] "mwsSrcAs.dll"="1"
teljes lista...

[HKEY_CLASSES_ROOT\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}\InprocServer32] "@"="C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL"
[HKEY_CLASSES_ROOT\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}\InprocServer32] "@"="C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}\InprocServer32] "@"="C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}\InprocServer32] "@"="C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive\bar\Switches] "mwsSrcAs.dll"="1"
[HKEY_CLASSES_ROOT\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL"
[HKEY_CLASSES_ROOT\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL"
[HKEY_CLASSES_ROOT\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL"
[HKEY_CLASSES_ROOT\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}\Instance\InitPropertyBag] "Url"="C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL"
[HKEY_CLASSES_ROOT\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL"
[HKEY_CLASSES_ROOT\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}\Instance\InitPropertyBag] "Url"="res://C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL/105"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "My Web Search Bar"="rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MyWebSearch Email Plugin"="C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MyWebSearch Plugin"="rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall] "UninstallString"="rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsbar.dll,O "
[HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch\bar] "UninstallString"="\"C:\Program Files\MyWebSearch\bar\1.bin\m3highin.exe\" mwsbar.dll,O"
[HKEY_CLASSES_ROOT\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}] "@"="MyWebSearch Search Assistant BHO"
[HKEY_CLASSES_ROOT\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}] "@"="MyWebSearch Settings"
[HKEY_CLASSES_ROOT\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}\ProgID] "@"="MyWebSearchToolBar.SettingsPlugin.1"
[HKEY_CLASSES_ROOT\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}\VersionIndependentProgID] "@"="MyWebSearchToolBar.SettingsPlugin"
[HKEY_CLASSES_ROOT\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL"
[HKEY_CLASSES_ROOT\CLSID\{25560540-9571-4D7B-9389-0F166788785A}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL"
[HKEY_CLASSES_ROOT\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL"
[HKEY_CLASSES_ROOT\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}] "@"="MyWebSearch HTML"
[HKEY_CLASSES_ROOT\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL"
[HKEY_CLASSES_ROOT\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}\ProgID] "@"="MyWebSearch.HTMLPanel.1"
[HKEY_CLASSES_ROOT\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}\VersionIndependentProgID] "@"="MyWebSearch.HTMLPanel"
[HKEY_CLASSES_ROOT\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}] "@"="MyWebSearch Toolbar Plugin"
[HKEY_CLASSES_ROOT\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}\ProgID] "@"="MyWebSearchToolBar.ToolbarPlugin.1"
[HKEY_CLASSES_ROOT\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}\VersionIndependentProgID] "@"="MyWebSearchToolBar.ToolbarPlugin"
[HKEY_CLASSES_ROOT\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL"
[HKEY_CLASSES_ROOT\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}] "@"="MyWebSearch Skin Settings"
[HKEY_CLASSES_ROOT\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL"
[HKEY_CLASSES_ROOT\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}] "@"="MyWebSearch Pseudo Transparent Plugin"
[HKEY_CLASSES_ROOT\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL"
[HKEY_CLASSES_ROOT\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}\ProgID] "@"="MyWebSearch.PseudoTransparentPlugin.1"
[HKEY_CLASSES_ROOT\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}\VersionIndependentProgID] "@"="MyWebSearch.PseudoTransparentPlugin"
[HKEY_CLASSES_ROOT\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}] "@"="MyWebSearch Popup Menu Plugin"
[HKEY_CLASSES_ROOT\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL"
[HKEY_CLASSES_ROOT\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL"
[HKEY_CLASSES_ROOT\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL"
[HKEY_CLASSES_ROOT\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL"
[HKEY_CLASSES_ROOT\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL"
[HKEY_CLASSES_ROOT\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL"
[HKEY_CLASSES_ROOT\CLSID\{A9571378-68A1-443d-B082-284F960C6D17}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL"
[HKEY_CLASSES_ROOT\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL"
[HKEY_CLASSES_ROOT\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}\ProgID] "@"="MyWebSearch.OutlookAddin.1"
[HKEY_CLASSES_ROOT\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}\VersionIndependentProgID] "@"="MyWebSearch.OutlookAddin"
[HKEY_CLASSES_ROOT\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL"
[HKEY_CLASSES_ROOT\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL"
[HKEY_CLASSES_ROOT\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL"
[HKEY_CLASSES_ROOT\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL"
[HKEY_CLASSES_ROOT\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}] "@"="MyWebSearch Chat Session Plugin"
[HKEY_CLASSES_ROOT\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL"
[HKEY_CLASSES_ROOT\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}\ProgID] "@"="MyWebSearch.ChatSessionPlugin.1"
[HKEY_CLASSES_ROOT\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}\VersionIndependentProgID] "@"="MyWebSearch.ChatSessionPlugin"
[HKEY_CLASSES_ROOT\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA}] "2"="IMyWebSearchSettings"
[HKEY_CLASSES_ROOT\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}] "@"="_IMyWebSearchSettingsEvents"
[HKEY_CLASSES_ROOT\Interface\{3E720451-B472-4954-B7AA-33069EB53906}] "@"="IMyWebSearchHTMLPanel"
[HKEY_CLASSES_ROOT\Interface\{3E720453-B472-4954-B7AA-33069EB53906}] "@"="_IMyWebSearchHTMLPanelEvents"
[HKEY_CLASSES_ROOT\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}] "@"="IMyWebSearchXMLElement"
[HKEY_CLASSES_ROOT\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}] "@"="IMyWebSearchSkinSettings"
[HKEY_CLASSES_ROOT\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}] "@"="IMyWebSearchPseudoTransparent"
[HKEY_CLASSES_ROOT\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}] "@"="IMyWebSearchPopupMenu"
[HKEY_CLASSES_ROOT\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}] "@"="IMyWebSearchSkinWindow"
[HKEY_CLASSES_ROOT\Interface\{E79DFBC9-5697-4FBD-94E5-5B2A9C7C1612}] "@"="IMyWebSearchChatSession"
[HKEY_CLASSES_ROOT\Interface\{E79DFBCB-5697-4FBD-94E5-5B2A9C7C1612}] "@"="_IMyWebSearchChatSessionEvents"
[HKEY_CLASSES_ROOT\Interface\{F87D7FB5-9DC5-4C8C-B998-D8DFE02E2978}] "@"="IMyWebSearchSearchScope"
[HKEY_CLASSES_ROOT\MyWebSearch.ChatSessionPlugin] "@"="MyWebSearch Chat Session Plugin"
[HKEY_CLASSES_ROOT\MyWebSearch.ChatSessionPlugin\CurVer] "@"="MyWebSearch.ChatSessionPlugin.1"
[HKEY_CLASSES_ROOT\MyWebSearch.ChatSessionPlugin.1] "@"="MyWebSearch Chat Session Plugin"
[HKEY_CLASSES_ROOT\MyWebSearch.HTMLPanel] "@"="MyWebSearch HTML Panel"
[HKEY_CLASSES_ROOT\MyWebSearch.HTMLPanel\CurVer] "@"="MyWebSearch.HTMLPanel.1"
[HKEY_CLASSES_ROOT\MyWebSearch.HTMLPanel.1] "@"="MyWebSearch HTML Panel"
[HKEY_CLASSES_ROOT\MyWebSearch.OutlookAddin] "@"="My Web Search for Outlook"
[HKEY_CLASSES_ROOT\MyWebSearch.OutlookAddin\CurVer] "@"="MyWebSearch.OutlookAddin.1"
[HKEY_CLASSES_ROOT\MyWebSearch.OutlookAddin.1] "@"="My Web Search for Outlook"
[HKEY_CLASSES_ROOT\MyWebSearch.PseudoTransparentPlugin] "@"="MyWebSearch Pseudo Transparent Plugin"
[HKEY_CLASSES_ROOT\MyWebSearch.PseudoTransparentPlugin\CurVer] "@"="MyWebSearch.PseudoTransparentPlugin.1"
[HKEY_CLASSES_ROOT\MyWebSearch.PseudoTransparentPlugin.1] "@"="MyWebSearch Pseudo Transparent Plugin"
[HKEY_CLASSES_ROOT\MyWebSearchToolBar.SettingsPlugin] "@"="MyWebSearch Settings Plugin"
[HKEY_CLASSES_ROOT\MyWebSearchToolBar.SettingsPlugin\CurVer] "@"="MyWebSearchToolBar.SettingsPlugin.1"
[HKEY_CLASSES_ROOT\MyWebSearchToolBar.SettingsPlugin.1] "@"="MyWebSearch Settings Plugin"
[HKEY_CLASSES_ROOT\MyWebSearchToolBar.ToolbarPlugin] "@"="MyWebSearch Toolbar Plugin"
[HKEY_CLASSES_ROOT\MyWebSearchToolBar.ToolbarPlugin\CurVer] "@"="MyWebSearchToolBar.ToolbarPlugin.1"
[HKEY_CLASSES_ROOT\MyWebSearchToolBar.ToolbarPlugin.1] "@"="MyWebSearch Toolbar Plugin"
[HKEY_CLASSES_ROOT\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_CLASSES_ROOT\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL"
[HKEY_CLASSES_ROOT\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_CLASSES_ROOT\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL"
[HKEY_CLASSES_ROOT\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_CLASSES_ROOT\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL"
[HKEY_CLASSES_ROOT\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_CLASSES_ROOT\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL"
[HKEY_CLASSES_ROOT\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_CLASSES_ROOT\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL"
[HKEY_CLASSES_ROOT\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_CLASSES_ROOT\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL"
[HKEY_CLASSES_ROOT\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_CLASSES_ROOT\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL"
[HKEY_CLASSES_ROOT\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_CLASSES_ROOT\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL"
[HKEY_CLASSES_ROOT\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_CLASSES_ROOT\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL"
[HKEY_CLASSES_ROOT\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin"
[HKEY_CLASSES_ROOT\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL"
[HKEY_CLASSES_ROOT\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_CLASSES_ROOT\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL"
[HKEY_CLASSES_ROOT\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}\1.0\HELPDIR] "@"=C:\Program Files\MyWebSearch\bar\1.bin"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&Search] "@"="http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZWYYYYYYYYHU"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}] "DisplayName"="My Web Search"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}] "URL"="http://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZWYYYYYYYYHU&fl=0&ptb=II0KuYpBfOa22IWxnGLC1g&url=http://edits.mywebsearch.com/toolbaredits/barsearch.jhtml&st=sb&searchfor={searchTerms}"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs] "url1"="http://www.mywebsearch.com/"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "MyWebSearch Email Plugin"="C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe"
[HKEY_CURRENT_USER\Software\MyWebSearch]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}] "@"="MyWebSearch Search Assistant BHO"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}\InprocServer32] "@"="C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}] "@"="MyWebSearch Settings"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}\ProgID] "@"="MyWebSearchToolBar.SettingsPlugin.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}\VersionIndependentProgID] "@"="MyWebSearchToolBar.SettingsPlugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25560540-9571-4D7B-9389-0F166788785A}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}] "@"="MyWebSearch HTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}\ProgID] "@"="MyWebSearch.HTMLPanel.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}\VersionIndependentProgID] "@"="MyWebSearch.HTMLPanel"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}] "@"="MyWebSearch Toolbar Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}\ProgID] "@"="MyWebSearchToolBar.ToolbarPlugin.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}\VersionIndependentProgID] "@"="MyWebSearchToolBar.ToolbarPlugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}] "@"="MyWebSearch Skin Settings"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}] "@"="MyWebSearch Pseudo Transparent Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}\ProgID] "@"="MyWebSearch.PseudoTransparentPlugin.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}\VersionIndependentProgID] "@"="MyWebSearch.PseudoTransparentPlugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}] "@"="MyWebSearch Popup Menu Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9571378-68A1-443d-B082-284F960C6D17}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}\ProgID] "@"="MyWebSearch.OutlookAddin.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}\VersionIndependentProgID] "@"="MyWebSearch.OutlookAddin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}] "@"="MyWebSearch Chat Session Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}\InprocServer32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}\ProgID] "@"="MyWebSearch.ChatSessionPlugin.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}\VersionIndependentProgID] "@"="MyWebSearch.ChatSessionPlugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA}] "@"="IMyWebSearchSettings"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E720451-B472-4954-B7AA-33069EB53906}] "@"="IMyWebSearchHTMLPanel"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E720453-B472-4954-B7AA-33069EB53906}] "@"="_IMyWebSearchHTMLPanelEvents"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}] "@"="IMyWebSearchXMLElement"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}] "@"="IMyWebSearchSkinSettings"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}] "@"="IMyWebSearchPseudoTransparent"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}] "@"="IMyWebSearchPopupMenu"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}] "@"="IMyWebSearchSkinWindow"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E79DFBC9-5697-4FBD-94E5-5B2A9C7C1612}] "@"="IMyWebSearchChatSession"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E79DFBCB-5697-4FBD-94E5-5B2A9C7C1612}] "@"="_IMyWebSearchChatSessionEvents"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F87D7FB5-9DC5-4C8C-B998-D8DFE02E2978}] "@"="IMyWebSearchSearchScope"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWebSearch.ChatSessionPlugin] "@"="MyWebSearch Chat Session Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWebSearch.ChatSessionPlugin\CurVer] "@"="MyWebSearch.ChatSessionPlugin.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWebSearch.ChatSessionPlugin.1] "@"="MyWebSearch Chat Session Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWebSearch.HTMLPanel] "@"="MyWebSearch HTML Panel"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWebSearch.HTMLPanel\CurVer] "@"="MyWebSearch.HTMLPanel.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWebSearch.HTMLPanel.1] "@"="MyWebSearch HTML Panel"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWebSearch.OutlookAddin] "@"="My Web Search for Outlook"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWebSearch.OutlookAddin\CurVer] "@"="MyWebSearch.OutlookAddin.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWebSearch.OutlookAddin.1] "@"="My Web Search for Outlook"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWebSearch.PseudoTransparentPlugin] "@"="MyWebSearch Pseudo Transparent Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWebSearch.PseudoTransparentPlugin\CurVer] "@"="MyWebSearch.PseudoTransparentPlugin.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWebSearch.PseudoTransparentPlugin.1] "@"="MyWebSearch Pseudo Transparent Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWebSearchToolBar.SettingsPlugin] "@"="MyWebSearch Settings Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWebSearchToolBar.SettingsPlugin\CurVer] "@"="MyWebSearchToolBar.SettingsPlugin.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWebSearchToolBar.SettingsPlugin.1] "@"="MyWebSearch Settings Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWebSearchToolBar.ToolbarPlugin] "@"="MyWebSearch Toolbar Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWebSearchToolBar.ToolbarPlugin\CurVer] "@"="MyWebSearchToolBar.ToolbarPlugin.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWebSearchToolBar.ToolbarPlugin.1] "@"="MyWebSearch Toolbar Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}\1.0\0\win32] "@"="C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}\1.0\HELPDIR] "@"="C:\Program Files\MyWebSearch\bar\1.bin"
[HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive\Email-IM\0] "AppName"="MyWebSearch Email Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive\Email-IM\0] "Path"="C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive\Email-IM\0] "Toolbar"="07B18EA9-A523-4961-B6BB-170DE4475CCA"
[HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive\Outlook] "MyWebSearch.OutlookAddin"="{07B18EA9-A523-4961-B6BB-170DE4475CCA}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products] "JpegConversionLib"="C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products\MSNMessenger] "DLLDir"="C:\Program Files\MyWebSearch\bar\1.bin\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products\MSNMessenger] "DLLFile"="F3REPROX.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}\DownloadInformation] "CODEBASE"="http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/MyWebSearchInitialSetup1.0.0.15-3.cab"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}] "AppName"="m3impipe.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}] "AppPath"="C:\Program Files\MyWebSearch\bar\1.bin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}] "AppName"="m3SkPlay.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}] "AppPath"="C:\Program Files\MyWebSearch\bar\1.bin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127}] "AppName"="m3medint.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127}] "AppPath"="C:\Program Files\MyWebSearch\bar\1.bin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7}] "AppName"="m3SlSrch.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7}] "AppPath"="C:\Program Files\MyWebSearch\bar\1.bin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}] "AppName"="m3SrchMn.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}] "C:\Program Files\MyWebSearch\bar\1.bin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}] "URL"="http://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZWYYYYYYYYHU&fl=0&ptb=II0KuYpBfOa22IWxnGLC1g&url=http://edits.mywebsearch.com/toolbaredits/barsearch.jhtml&st=sb&searchfor={searchTerms}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin] "Description"="My Web Search Outlook Container"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin] "FriendlyName"="Fun Tools"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}] "@"="MyWebSearch Search Assistant BHO"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\sources] "f3PopularScreensavers"="C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch\MWSOEPLG]
[HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch\SearchAssistant]
[HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch\SkinTools]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MYWEBSEARCHSERVICE]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MYWEBSEARCHSERVICE\0000]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MYWEBSEARCHSERVICE\0000\Control]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MyWebSearchService]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MyWebSearchService\Enum]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_MYWEBSEARCHSERVICE]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_MYWEBSEARCHSERVICE\0000]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\MyWebSearchService]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MYWEBSEARCHSERVICE]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MYWEBSEARCHSERVICE\0000]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MYWEBSEARCHSERVICE\0000\Control]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MyWebSearchService]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MyWebSearchService\Enum]
[HKEY_USERS\S-1-5-21-1060284298-1770027372-839522115-1003\Software\Microsoft\Internet Explorer\MenuExt\&Search]
[HKEY_USERS\S-1-5-21-1060284298-1770027372-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}]
[HKEY_USERS\S-1-5-21-1060284298-1770027372-839522115-1003\Software\Microsoft\Internet Explorer\TypedURLs]
vissza...

Egy, a számítógépeket támadó vírus, féreg az elindulást követő aktivizálódás érdekében szolgáltatást (service) is létrehozhat. A szolgáltatások paramétereit is természetesen tartalmazza a rendszerleíró adatbázis (registry). A szolgáltatásokat a Windows XP alatt a Vezérlőpult/Felügyeleti eszközök/Szolgáltatások alatt tekinthetjük meg. A vírusok, férgek a szolgáltatásokat le is állíthatják.

A Win32/Toolbar.MyWebSearch alkalmazás MyWebSearchService néven hoz létre szervizt.

A létrehozott szerviz a(z) C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe elérési útra hivatkozik.

Hátsóajtó

A vírusok, férgek egyre gyakrabban nyitnak hátsóajtót a megtámadott számítógépen. Ezzel teljes mértékben átvehetik a számítógép felügyeletét, a támadó azt csinál a számítógépen, amit csak akar: alkalmazásokat futtathat, állíthat le, állományokat tölthet le/fel, jelszavakat, hozzáférési kódokat tulajdoníthat el.

A(z) http://www.mywebsearch.com weboldalhoz csatlakozik.

Tevékenységek

Minden vírus, féreg azt csinál, amit akar, illetve amit a programozó beleprogramozott. Egyes vírusok, férgek tevékenységüket (büntető rutinjukat) valamilyen eseményhez, legtöbbször valamilyen időponthoz kötik.

feltétel	a telepítés során
tevékenység	az Internet Explorer böngészőben egy új eszköztárat (toolbar) hoz létre