Adware.Massfav

SUMMARY

Behavior

Adware.Massfav is an adware program that inserts a number of Web links on your Favorites list, and changes some Web browser settings, so it can display advertisements.

Symptoms

The files are detected as Adware.Massfav.

Transmission

This adware program must be manually installed. However, there are programs that have Adware.Massfav within them and that install it as the program itself is installed.

Protection

• Virus Definitions (LiveUpdate™ Weekly) September 24, 2003
• Virus Definitions (Intelligent Updater) September 23, 2003

TECHNICAL DETAILS

When Adware.Massfav is executed, it performs the following actions:

1. Adds Web site links to the Favorite/Bookmark folder of Web browser.
   
   
2. Changes the default Web browser search settings.
   
   
3. Changes the default home page.
   
   
4. Installs a browser toolbar without permission in order to display advertisements.
   
   
5. Creates the following registry key:
   
   HKEY_CURRENT_USERSoftwarehelp vga moveArmy

REMOVAL

---

Note: Removing this adware component from the system will likely cause the program that installed it to not function as intended. The uninstaller generally identifies the programs that will not work after uninstallation.

---

1. Update the virus definitions.
2. Run a full system scan and delete all the files detected as Adware.Massfav.
3. Delete the value from the registry.
4. Delete the websites added to the Internet Explorer Favorites.
5. Reset the Internet Explorer Home page.
6. Reset the Internet Explorer Search page.

For specific details on each of these steps, read the following instructions.

1. Updating the virus definitions
Symantec Security Response fully tests all the virus definitions for quality assurance before they are posted to our servers. There are two ways to obtain the most recent virus definitions:

• Running LiveUpdate, which is the easiest way to obtain virus definitions: These virus definitions are posted to the LiveUpdate servers once each week (usually on Wednesdays), unless there is a major virus outbreak. To determine whether definitions for this threat are available by LiveUpdate, refer to the Virus Definitions (LiveUpdate).
• Downloading the definitions using the Intelligent Updater: The Intelligent Updater virus definitions are posted on U.S. business days (Monday through Friday). You should download the definitions from the Symantec Security Response Web site and manually install them. To determine whether definitions for this threat are available by the Intelligent Updater, refer to the Virus Definitions (Intelligent Updater).
  
  The Intelligent Updater virus definitions are available: Read "How to update virus definition files using the Intelligent Updater" for detailed instructions.

2. Scanning for and deleting the infected files

1. Start Norton AntiVirus and make sure that it is configured to scan all the files. For more information, read the document, "How to configure Norton AntiVirus to scan all files."
2. Run a full system scan.
3. If any files are detected as infected with Adware.Massfav, click Delete.
   
   

3. To delete the value from the registry

Important: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified subkeys only. For instructions refer to the document: How to make a backup of the Windows registry.

1. Click Start > Run.
2. Type regedit
3. Click OK.
   
   
4. Navigate to, and delete the subkey:
   
   HKEY_CURRENT_USERSoftwarehelp vga moveArmy
   
   
5. exit regedit.
   
   

4. To delete the Web sites added to the Internet Explorer Favorites menu

1. Start Microsoft Internet Explorer
2. Click Favorites > Organize Favorites
3. Delete the Favorites added by the threat
   
   

5. To reset the Internet Explorer home page

1. Start Microsoft Internet Explorer.
2. Connect to the Internet, and then go to the page that you want to set as your home page.
3. Click Tools > Internet Options.
4. In the Home page section of the General tab, click Use Current > OK.

For additional information, or if this procedure does not work, read the Microsoft® Knowledge Base article: Home Page Setting Changes Unexpectedly, or You Cannot Change Your Home Page Setting, Article ID 320159.

6. To reset the Internet Explorer Search page

Follow the instructions for your version of Windows.

Windows 98/Me/2000
1. Start Microsoft Internet Explorer.
2. Click the Search button on the toolbar.
3. In the Search pane, click Customize.
4. Click Reset.
5. Click Autosearch Settings.
6. Select a search site from the drop-down list, and then click OK.
7. Click OK.

Windows XP
Because Windows XP is set by default to use animated characters in the search, how you do this can vary. Read all the instructions before you start.
1. Start Microsoft Internet Explorer.
2. Click the Search button on the toolbar.
3. Do one of the following:
   • If the pane that opens looks similar to the following picture, click the word Customize and proceed to step h:
     
     
     
     
     
   • If the pane that opens has the words "Search Companion" at the top, and the center looks similar to the following picture, click the Change preferences link and proceed with step d.
     
     
     
     
     
4. Click the Change Internet search behavior link.
5. Under "Internet Search Behavior," click With Classic Internet Search.
6. Click OK. Then close Internet Explorer. (Close the program for the change to take effect.)
7. Start Internet Explorer. When the search pane opens, it should look similar to the following picture:
   
   
   
   
   
   Click the word Customize, and then proceed with the next step.
   
   
8. In the Search pane, click Customize.
9. Click Reset.
10. Click Autosearch Settings.
11. Select a search site from the drop-down list, and then click OK.
12. Click OK.
13. Do one of the following:
    • If you were using (or want to continue using) the "Classic Internet Search" panel, stop here (or proceed with the next section).
    • If you want to go back to the "Search Companion" search (it usually has an animated character at the button), proceed with step n.
      
      
14. Click the word Customize again.
15. In the "Customize Search Settings" window, click Use Search Companion > OK.
16. Close Internet Explorer. The next time you open it, it will again use the Search Companion.