Threat Explorer

The Threat Explorer is a comprehensive resource consumers can turn to for daily, accurate, up-to-date information on the latest threats, risks and vulnerabilities.

Adware.Netword

Adware.Netword

Updated:
April 26, 2006
Risk Impact:
High
Systems Affected:
Windows

Behavior

Adware.Netword is an Internet Explorer toolbar that contacts a Web site on the netword.com domain to track advertisements.

Antivirus Protection Dates

  • Initial Rapid Release version October 02, 2014 revision 022
  • Latest Rapid Release version October 02, 2014 revision 022
  • Initial Daily Certified version April 26, 2006
  • Latest Daily Certified version September 28, 2010 revision 036
  • Initial Weekly Certified release date April 26, 2006
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Adware.Netword is an Internet Explorer toolbar that contacts a Web site on the netword.com domain to track advertisements.

Once executed, it creates the following files:
%Program Files%\NW Search\iedropper.js
%Program Files%\NW Search\nwsearch.dll
%Program Files%\NW Search\uninst.exe

It then ceates the following registry entry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\"{A16BC1B1-E582-11d4-8757-005004603000}" = "Netword"

It also creates the following registry subkeys:
HKEY_CLASSES_ROOT\CLSID\{A16BC1B1-E582-11d4-8757-005004603000}
HKEY_CLASSES_ROOT\Interface\{6FCCD5A1-8823-476D-B7DE-FEB13D46D9BD}
HKEY_CLASSES_ROOT\Interface\{A16BC1B2-E582-11D4-8757-005004603000}
HKEY_CLASSES_ROOT\NWSearch.NWToolBand
HKEY_CLASSES_ROOT\NWSearch.NWToolBand.1
HKEY_CLASSES_ROOT\TypeLib\{A16BC1B3-E582-11D4-8757-005004603000}
HKEY_CURRENT_USER\Software\Netword
HKEY_LOCAL_MACHINE\SOFTWARE\NetWord Agent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A16BC1B1-E582-11d4-8757-005004603000}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Netword Agent
HKEY_LOCAL_MACHINE\SOFTWARE\NetWord Agent

When the following search pages are accessed, it contacts a Web site on the netword.com domain to track advertisements:
http://aolsearch.aol.com/aol/search ?
http://information.com/search/index.html ?
http://kevdb.infospace.com/home/white-pages/kevdb ?
http://maps.infospace.com/home/kevmap ?
http://msxml.infospace.com/home/search/web/
http://mysearch.myway.com/jsp/
http://sbgw.search.aol.com/kw/exec ?
http://search.aol.com/aolcom/search ?
http://search.aol.com/dirsearch.adp ?
http://search.ebay.com/search/search.dll ?
http://search.lycos.com/default.asp ?
http://search.msn.com/results.asp ?
http://search.msn.com/results.aspx ?
http://search.netscape.com/ns/search ?
http://search.netscape.com/nscp_results.adp ?
http://search.yahoo.com/bin/search ?
http://search.yahoo.com/search ?
http://shopping.yahoo.com/search
http://web.ask.com/web ?
http://www.altavista.com/web/results ?
http://www.amazon.com/exec/obidos/search-handle-form/
http://www.google.com/search ?
http://www.highbeam.com/library/search.asp ?
http://www.information.com/search/index.html ?
http://www.infospace.com/home/white-pages/message.htm ?
http://www.looksmart.com/r_search ?
http://www.websearch.com/search/results.aspx ?
http://yp.netscape.com/main.adp ?
http://ypng.infospace.com/home/yellow-pages/redir.htm ?

Writeup By: Takayoshi Nakayama