Home / malware

PDF

PUA:Win32/MyWebSearch

First posted on 23 June 2016.
Source: Microsoft

Aliases :

There are no other names known for PUA:Win32/MyWebSearch.

Explanation :

Installation

This application can be downloaded from websites that offer third-party software downloads. For example, we have seen it downloaded from:

• ak.imgfarm.com
• ak.dl.safepcrepair.com
• ak.dl.gounzip.com
• ak.dl.premierdownloadmanager.com
• ak.dl.snapmyscreen.com

We have seen this application use the following file names:

• SafePCRepairSetup.SafePCRepair_89.mlkmakbbeomlgkkjjebogagaphdgpkgc.ch.exe
• VideoDownloadConvert.exe
• GoUnzipSetup.GoUnzip_dm.enknlcpanodakgmfgjhndmgjcailkaak.ch.exe
• FromDocToPDF.exe
• MapsGalaxy.exe
• PremierDownloadManagerWrapper.ch.PremierDownloadManager_ag.aabphieoeglldhhckihphcoikecljdnh.ch.exe
• GoUnzipSetup.exe
• SnapMyScreenSetup.SnapMyScreen_bf.pnacmlfckijnmogihjeaojfnfiplhhpj.ch.exe
• Allin1Convert.exe
• InternetSpeedTracker.exe

It can be digitally signed by the following vendors:

• Mindspark Interactive Network
• Fun Web Products
• Starnet Interactive Inc.
• Savvy
• CompuClever Systems Inc.

We have seen this application using product names such as:

• OnlineMapFinder
• Mindspark Interactive Network Installer Plugin
• FromDocToPDF
• GetFormsOnline
• MyTransitGuide

Payload

Exhibits suspicious behaviors

We have observed this application exhibit the following potentially unwanted behavior on PCs:

• Installs programs that start automatically when your PC starts
• Injects into other processes on your system
• Installs extensions into your browsers - often this is used to inject ads, add toolbars, or change how your browser works
• Changes your Internet Explorer proxy auto-configuration setting - we often see this used to inject ads in your browser as you browse the web
• Disables User Access Control (UAC) on your system

Installs other programs

We have seen this application install other software on your PC. Some of these applications might be bundled during the installation process and not intended to be installed. We have seen it installing programs such as:

• GoUnzip Supporting Application
• SafePCRepair
• Premier Download Manager
• SnapMyScreen Supporting Application
• AutoPCBackup Supporting Application
• OnlineMapFinder Internet Explorer Homepage and New Tab
• DownShotFree Supporting Application
• GetFormsOnline Internet Explorer Homepage and New Tab
• VideoDownloadConverter Internet Explorer Homepage and New Tab
• VerifiedVPN 3.0

This description was published using automated analysis.

Last update 23 June 2016

 

TOP