Aze Search Toolbar

· Overview ·
· Origins ·
· Distribution ·
· Operation ·
· Risks ·
· Detection and Removal ·
· Research ·

Overview

Summary:

 Aze Search Toolbar modifies the hosts and hijacks the following Domains to the following IP addresses:

69.50.166.11 www.google.com
69.50.166.11 google.com
69.50.166.11 www.google.co.uk
69.50.166.11 google.co.uk
69.50.166.11 www.google.ca
69.50.166.11 google.ca
69.50.166.11 www.google.es
69.50.166.11 google.es
69.50.166.11 www.google.de
69.50.166.11 google.de
69.50.166.11 www.google.fr
69.50.166.11 google.fr
69.50.166.11 www.google.com.au
69.50.166.11 google.com.au
69.50.166.14 www.yahoo.com
69.50.166.14 yahoo.com
69.50.166.12 www.msn.com
69.50.166.12 msn.com
69.50.166.12 search.msn.com

69.50.166.13 astalavista.com
69.50.166.13 www.astalavista.com
69.50.166.13 astalavista.box.sk
69.50.166.13 cracks.am
69.50.166.13 www.cracks.am
69.50.166.12 go.com
A file is placed in the system root named 'hosts' that has all of this data listed.

Searches performed under these domains have the actual search results supplanted with erroneous information. The results appear to be legitimate, with no indication of change, but when the same search is done on a machine that is not infected, much different results come back. For instance, I did a search using Google for the key word 'PestPatrol' while infected and the top results were http://www.Stop-Sign.com, http://www.softwareoasis.net/442.ht, and http://www.jdoqocy.com/click-1564080-10374065. When this same search was performed on a clean machine the results brought back www.pestpatrol.com, www.pestscan.com, and store.ca.com (all CA PestPatrol domains) as the top three results.

Also, Aze Search Toolbar disables the Google toolbar and does not allow searches to be performed in it. Actually, in some testing, Aze Search Toolbar deleted Google Registry entries for the Toolbar would not be displayed. Furthermore, if Google is reinstalled after Aze, then the Google search functions are disabled. The user will be presented with a bogus 404 page with predetermined 'Associated Searches.' If a user navigates to 69.50.166.12/www.go.com they are presented with an erroneous page that has the MSN icon and look and feel, but all searches are erroneous.

Vendor Notes:

 THE TEXT THAT FOLLOWS IS FROM THE AUTHOR OF AZE SEARCH TOOLBAR: 'When you surf Net hunting for free porn, you simply click on unknown links, visit strange sites and don't think about security. And once you catch undesirable software. If my page is opened arbitrarily by some harmful software it means there are people which do not like you and this is not my guilt.

Homepage removing

Prior to blaming me read the following:
At first, try to fix inproper homepage, searchpage etc. by the newest version of our sofware.We use it in most such cases.

Search for Spyware Remover's.
If there software didn't help you download Remover
To change your home page do the following:
Select in your browser menu Tools -> Internet Options
Type the address of your homepage in the field Address of the HomePage
section e.g. http://microsoft.com or, if you wish see blank page,
about:blank'

Alias:

 Azsearch Toolbar, CoolWebSearch.MWSearch (Microsoft Anti-Spy), SimpleBar Toolbar, ZToolbar

Category:

Hijacker: Any software that resets your browser's settings to point to other sites. Hijacks may reroute your info and address requests through an unseen site, capturing that info. In such hijacks, your browser may behave normally, but be slower.

Search Hijacker: Any software that resets your browser's settings to point to other sites when you perform a search. Hijacks may reroute your info and address requests through an unseen site, capturing that info. In such hijacks, your browser may behave normally, but be slower. Search results when such a hijacker is running will sometimes differ from non-hijacked results.

Similar Pests:

 Hijacker · Search Hijacker

Origins

Author:

 Www.azesearch.com/

Vendor:

 Active-X: Publisher: PLEKS s.r.o.

Date of Origin:

 March, 2005

Distribution

Distribution:

 Aze Search Toolbar is distributed using Active-X from many sites.

Prevalence:
  • Aze Search Toolbar: 0.1%
    • More Info

    Clot Factor:
  • Aze Search Toolbar: 78

    • The "Clot Factor" is a measure of how much a pest "gums up" a machine by adding registry entries, files, and directories. As more objects are placed in a machine, manual removal becomes more difficult and more error-prone.

    Growth:
  • Aze Search Toolbar: Insufficient data to report growth
    		•

    Infection:

    		 Installs the following Active-X component: c:\windows\system32\azesearch.ocx.

    Operation

    General:

    		 BHO: ZToolbar Module

    Advertising:

    		 Yes

    Storage Required:
  • Aze Search Toolbar: at least 529 KB
    		•

    Browser Performance:

    		 Likely to slow performance of Internet Explorer.

    Risks

    Risk:

    		 This pest is HIGH risk, remove immediately.

    Detection and Removal

    Caution!!!:

    		 Caution, do not open Internet Explorer or Explorer (MyComputer, iexplorer.exe or explorer.exe) while PestPatrol is running. It is fine if either is already open when PestPatrol is launched. Aze Search Toolbar has three critical files in system 32 that must be deleted. After deleting with PestPatrol, you will need to reset your homepage. This can be done by opening Internet Explorer clicking Tools > Internet Options > and typing desired homepage URL in the Address field. WARNING: Aze Search Toolbar modifies the hosts file (systemroot\system 32\drivers\etc\hotsts) , see Summary. Be sure to change this.

    Automatic Removal:

    PestPatrol detects this.

    PestPatrol removes this.

    Manual Removal:

    		 Follow these steps to remove Aze Search Toolbar from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.
    Stop Running Processes:

    Kill these running processes with Task Manager:

    Unregister DLLs:

    Unregister these DLLs with Regsvr32, then reboot:

    Clean Registry:

    Remove these registry items (if present) with RegEdit:

    Remove Files:

    Remove these files (if present) with Windows Explorer:

    Remove Directories:

    Remove these directories (if present) with Windows Explorer:

    Restore Settings:

    After following the instructions above, you will still need to restore your original settings and prevent this from happening again. Here''s how.

    Research

    File Analyses:

    More Info:
  • AllTheWeb, AltaVista, AOL Search, Ask Jeeves, Google, HotBot, Lycos, LookSmart, MSN, Yahoo!
    		•

    Research By:
  • Benjamin Googins
  • PestPatrol's Pest Research Center
    		•

    Last Revised:

    		 April 25, 2005