Quick Links: SpywareGuide Greynets Blog | SpywareGuide Product Database | SpywareGuide Company Database | SpywareGuide Categories
Search SpywareGuide Database & Site
Security Email Alerts & Updates
SpywareGuide powered by FaceTime Security Labs
Full Name:
SubSearch Websearch   Read More
Type: Adware
Also Known as: HighTraffic Qual Net QualNet e2d e2g
SG Index: 4 [Explain]
Removal tools: List of products that detect/remove/protect against SubSearch:
  • Control IM and P2P use, block spyware and other malware: RTGuardian
  • Endpoint Spyware Remediation: Greynet Enterprise Manager
  • IM, P2P control, malware prevention and web filtering in single appliance: Unified Security Gateway
  • Category Description: Program that delivers advertisements on your PC.

    Note that many websites have their own advertising, unrelated to adware.

    Adware is any software application in which advertising is displayed while the program is running. The authors of these applications include additional code that delivers the ads, which can be viewed through pop-up windows or through a bar that appears on a computer screen and sometimes through text links or in integrated search results. Adware may or may not track personal information. It may also gather information anonymously or in aggregate only. Users should check the EULA and Privacy policy to ensure if the adware on their machines conforms to their standards.
    Official Description: HighTraffic is an Internet Explorer Browser Helper Object which opens advertising.

    It detects when you are using a search engine, and opens its own 'enhanced results' sidebar containing paid links. This is styled to look a bit like the search engine you are using at the time.
    Comment: SubSearch/HighTraffic was the original version from December 2002. Its controlling server is www.hightrafficads.com. There are two subvariants, /A (from 11th December) and /B (17th December) which seem to vary only in their class ID.

    SubSearch/v2 is a version rewritten as a single DLL, from January 2003. Its controlling server is www.popunder.info (with www.cpcads.com apparently acting as a backup). It opens a characteristic 'Enhanced Search' with sponsored links when you use any other search engine.

    SubSearch/v21 and SubSearch/v22 are updates to v2. v22 adds an explorer-bar-search hijacker pointed at www.dothesearch.com.

    Currently there is no unique ID or cookie being used to track search usage.

    It can be directed by any web page to download any file and write it anywhere to the filesystem, including over other program files which may then get run.
    Information URL: http://www.hightrafficads.com/
       
    Manual removal: Open a DOS command prompt window (from Start->Programs->Accessories) and enter the following commands:

    cd "%WinDir%\System"
    regsvr32 /u BHO2.dll
    regsvr32 /u MSNIE.dll
    Restart Windows and you should be able to delete the BHO2.dll and MSNIE.dll files in the System folder. (The System folder can be found in the Windows folder; it is called 'System32' on Windows NT/2000/XP, and just 'System' on Windows 95/98/Me.)

    Properties:
  •  Autostarts/Stays Resident
  •  Changes browser
  •  Connects to the internet
  •  Shows Advertisements
  •  Stealth Tactics
  • Click here to leave feedback for this product

    Help with the BUST!
    Click here and give us what details you have and let our international research team take it from there. If you desire your report will remain anonymous.
    Recent Blog Posts
  • A Year In Security
  • Youtube Comment Bot Spams In Waves
  • VGA Awards Trailers Used As Bait For Spam Offers
  • Fake Visa Electronic Report Serves Up Zbot Data Stealer
  • Banned Console Owners Beat The System - With Stickers
  • Spot The Hack
  • The Futility Of EULAs
  • Auto Whaler Spears Phishers
  • Fake Porn Grabbers Snag Nothing But Malware
  • Console DDoS Botnets - A Thriving Industry
  • Recent Modifications
    2009-12-10  cardstatement.exe
    2009-12-10  Katien.n
    2009-11-30  CoolWebSearch
    2009-11-17  Mob.Blockcheck
    2009-11-11  Fresh Bar
    2009-11-6  OnlineRegistryScan.org
    2009-11-6  PaintBrush
    2009-11-6  Pic Hunter
    2009-11-4  Gumblar
    2009-11-4  Adware.Verticity
     

    Site EULA | Site Map | Contact Us | About Us | Site and Spyware FAQ | Advertise | RSS Feeds  | Link To Us | SpywareGuide Japan Japanese

    © Copyright 2007, FaceTime Communications, Inc. All rights reserved.