Threat Explorer

The Threat Explorer is a comprehensive resource consumers can turn to for daily, accurate, up-to-date information on the latest threats, risks and vulnerabilities.

Adware.Massfav

Adware.Massfav

Updated:
February 13, 2007
Risk Impact:
Medium
Systems Affected:
Windows

Behavior


Adware.Massfav is an adware program that inserts a number of Web links on your Favorites list, and changes some Web browser settings, so it can display advertisements.

Symptoms


The files are detected as Adware.Massfav.

Behavior


This adware program must be manually installed. However, there are programs that have Adware.Massfav within them and that install it as the program itself is installed.

Antivirus Protection Dates

  • Initial Rapid Release version October 02, 2014 revision 022
  • Latest Rapid Release version February 04, 2015 revision 007
  • Initial Daily Certified version September 23, 2003
  • Latest Daily Certified version February 04, 2015 revision 017
  • Initial Weekly Certified release date September 24, 2003
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

When Adware.Massfav is executed, it performs the following actions:
  1. Adds Web site links to the Favorite/Bookmark folder of Web browser.

  2. Changes the default Web browser search settings.

  3. Changes the default home page.

  4. Installs a browser toolbar without permission in order to display advertisements.

  5. Creates the following registry key:

    HKEY_CURRENT_USER\Software\help vga moveArmy





Note: Removing this adware component from the system will likely cause the program that installed it to not function as intended. The uninstaller generally identifies the programs that will not work after uninstallation.
  1. Update the virus definitions.
  2. Run a full system scan and delete all the files detected as Adware.Massfav.
  3. Delete the value from the registry.
  4. Delete the websites added to the Internet Explorer Favorites.
  5. Reset the Internet Explorer Home page.
  6. Reset the Internet Explorer Search page.


For specific details on each of these steps, read the following instructions.

1. Updating the virus definitions
Symantec Security Response fully tests all the virus definitions for quality assurance before they are posted to our servers. There are two ways to obtain the most recent virus definitions:
  • Running LiveUpdate, which is the easiest way to obtain virus definitions: These virus definitions are posted to the LiveUpdate servers once each week (usually on Wednesdays), unless there is a major virus outbreak. To determine whether definitions for this threat are available by LiveUpdate, refer to the Virus Definitions (LiveUpdate).
  • Downloading the definitions using the Intelligent Updater: The Intelligent Updater virus definitions are posted on U.S. business days (Monday through Friday). You should download the definitions from the Symantec Security Response Web site and manually install them. To determine whether definitions for this threat are available by the Intelligent Updater, refer to the Virus Definitions (Intelligent Updater).

    The Intelligent Updater virus definitions are available: Read "How to update virus definition files using the Intelligent Updater" for detailed instructions.

2. Scanning for and deleting the infected files
  1. Start Norton AntiVirus and make sure that it is configured to scan all the files. For more information, read the document, "How to configure Norton AntiVirus to scan all files."
  2. Run a full system scan.
  3. If any files are detected as infected with Adware.Massfav, click Delete.

3. To delete the value from the registry
    Important: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified subkeys only. For instructions refer to the document: How to make a backup of the Windows registry.
    1. Click Start > Run.
    2. Type regedit
    3. Click OK.

    4. Navigate to, and delete the subkey:

      HKEY_CURRENT_USER\Software\help vga moveArmy

    5. exit regedit.

4. To delete the Web sites added to the Internet Explorer Favorites menu
    1. Start Microsoft Internet Explorer
    2. Click Favorites > Organize Favorites
    3. Delete the Favorites added by the threat

5. To reset the Internet Explorer home page 6. To reset the Internet Explorer Search page
    Follow the instructions for your version of Windows.

    Windows 98/Me/2000
    1. Start Microsoft Internet Explorer.
    2. Click the Search button on the toolbar.
    3. In the Search pane, click Customize.
    4. Click Reset.
    5. Click Autosearch Settings.
    6. Select a search site from the drop-down list, and then click OK.
    7. Click OK.

    Windows XP
    Because Windows XP is set by default to use animated characters in the search, how you do this can vary. Read all the instructions before you start.
    1. Start Microsoft Internet Explorer.
    2. Click the Search button on the toolbar.
    3. Do one of the following:
      • If the pane that opens looks similar to the following picture, click the word Customize and proceed to step h:




      • If the pane that opens has the words "Search Companion" at the top, and the center looks similar to the following picture, click the Change preferences link and proceed with step d.




    4. Click the Change Internet search behavior link.
    5. Under "Internet Search Behavior," click With Classic Internet Search.
    6. Click OK. Then close Internet Explorer. (Close the program for the change to take effect.)
    7. Start Internet Explorer. When the search pane opens, it should look similar to the following picture:





      Click the word Customize, and then proceed with the next step.

    8. In the Search pane, click Customize.
    9. Click Reset.
    10. Click Autosearch Settings.
    11. Select a search site from the drop-down list, and then click OK.
    12. Click OK.
    13. Do one of the following:
      • If you were using (or want to continue using) the "Classic Internet Search" panel, stop here (or proceed with the next section).
      • If you want to go back to the "Search Companion" search (it usually has an animated character at the button), proceed with step n.

    14. Click the word Customize again.
    15. In the "Customize Search Settings" window, click Use Search Companion > OK.
    16. Close Internet Explorer. The next time you open it, it will again use the Search Companion.