Detection added	Jan 13 2006 22:06 GMT
Description added	Nov 30 2006
Behavior	not-a-virus:AdWare

• Technical details
• Payload
• Removal instructions

This non-malicious advertizing program installs Mirar Toolbar in Internet Explorer.

It is a Windows PE EXE file. It is written in Microsoft Visual C++. It is not packed in any way. The file is 376,832 bytes in size. The size of the file which is installed may vary.

Installation

Once launched, the program will create the following files in the Windows system directory without the user’s knowledge or consent:

• %System%\WinNB57.dll (303 104 bytes. This file will be detected by Kaspersky Anti-Virus as not-a-virus:AdWare.Win32.Mirar.b)
• %System%\WinDmy.dll (32,768 bytes. This file will be detected by Kaspersky Anti-Virus as not-a-virus:AdWare.Win32.Mirar.a)

This will lead to Mirar Toolbar being installed in Internet Explorer.

When Internet Explorer is launched, the program will add Mirar Toolbar:

1. Delete the following files:
   %System%\WinNB57.dll
   %System%\WinDmy.dll
2. Delete the original program file (the location will depend on how the program originally penetrated the victim machine).
3. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).