The joys of file sharing: malware sharing

MyWebSearch, the old familiar toolbar, is still around

The team came across these yesterday on a file-sharing network in a file “Power DVD 8 Cracked.rar.”

It installs, without proper notice, MyWebSearch, FLV Direct Player and other garbage. Adam Thomas found a similar surreptitious install of FLV in April – clearly that was part of an affiliate program scheme in which someone was getting paid each time FLV got installed.

See Sunbelt Blog: “Bot installs adware along with video player”

The MyWebSearch Toolbar is a customizable Internet Explorer search toolbar which installs other tools, including pop-up blockers, screensavers, and cursors. Searches entered into the toolbar search field are directed to MyWebSearch.com. MyWebSearch has been around for five years.

(Click images below to enlarge.)












It does have the URL to an end user licensing agreement buried in its code http://www.stasga.com/view-eula.php which pretty much describes what it’s going to do:

“7. By pressing ‘Accept’ you agree to the terms of the following: You allow us to modify your HTTP packets in your packet filters. This will allow us to modify your URL in your browser. “

For some strange reason, the EULA has no section six.

Thanks Adam,

Tom Kelchner