McAfee > Theat Center > PUP Detail Page

Characteristics

McAfee(R) AVERT™ recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application.  If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software.  Please contact the software vendor for further information.

See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.

Distribution

This is not a virus or a trojan.  It is detected as a "Potentially Unwanted Program." (PUP)  It is a direct-marketing application that tracks browsing activity and generates pop-up advertisements while browsing the web. Installation is performed via an ActiveX control ( http://www.slotchbar.com/install/special.html ) Upon installation the software also retrieves and installs many additional third party applications with similar advertising functions.  No license agreement for these additional applications is shown.

Privacy

The application displays a link to the license agreement in the ActiveX control prompt during installation.  The agreement attempts to describe the functionality of the software, however there are inconsistencies in definining the data collection and privacy-impacting activities.  The document establishes IST's broad rights to collect browsing information using the toolbar software (Section 18):

"18. INFORMATION COLLECTION. You understand and grant Integrated Search Technologies permission to assign each copy of the Software an unique software identity code. You also grant Integrated Search Technologies permission to collect and store information of your internet usage habit, including but not limited to information about every web page you view with the full Uniform Resource Locators, and the content of web page. You understand and accept that Uniform Resource Locators and the content of web pages you view may include your personally identifiable information. You grant Integrated Search Technologies permission to collect and store information on which IST toolbar™ buttons you click on, your response to advertising, the search terms you entered on the IST toolbar™ and/or all other information relates to your internet usage habit. Integrated Search Technologies may at times ask you for your personally identifiable information, such as name, address, email address, zip code, telephone number. You hereby grant Integrated Search Technologies permission to distribute your non personally identifiable information to our partners, agents, and/or any third party in Integrated Search Technologies' sole discretion."

It then simultaneously guarantees that the toolbar software will not collect any user browsing data (Section 20):

"20. ADVERTISEMENT APPLICATION. You grant Integrated Search Technologies permission to install an advertisement application licensed to it from a third party. The purpose of the advertisement application is to display an advertisement a limited number of times at a specified time interval; the advertisement application will provide you the opportunity to install software onto your computer and will be automatically uninstalled after its operation is complete. You are granted a personal, non-commercial license to use this software, under the same terms and conditions that apply to Integrated Search Technologies software. The IST toolbar™ Software does not track user data or clickstream data, does not compile a users database nor engage in user profiling. User information is not transferred to our server thus preventing software into your computer. However, we cannot control third party software which may be installed in the IST toolbar™."

System Changes

Files Added

Many links are added to the user's favorites folder in the following subfolders (may vary):
C:\Documents and Settings\(user name)\F avorites\Adult Sites\
C:\Documents and Settings\(user name) \Favorites\Free Adult Content\

The following directly related files are also added:

C:\Program Files\ISTbar\istbar.dll
Size: 88,576 bytes
MD5: 0xA45256881903BFB0AE81280493DDFFE0 (UPX packed)
         0xBBE5F4CF746FBF6F8E24210C8618B1A5 (unpacked)

C:\Program Files\ISTbar\navmain.bmp
Size: 6,200 bytes

C:\Program Files\ISTbar\search.bmp
Size: 1,456 bytes

C:\Program Files\ISTbar\xml_istbar.php
Size: 13,057 bytes

NOTE: Many other files are also added (and may vary) that are associated with separate third party applications which may or may not also be Potentially Unwanted Programs.

Registry Changes (most significant/high-level)

Keys Added:

HKEY_CURRENT_USER\Software\IST
HKEY_CURRENT_USER\Software\ISTbar
HKEY_CLASSES_ROOT\CLSID\{5F1ABCDB-A875-46c1-8345-B72A4567E486}
HKEY_CLASSES_ROOT\Interface\{DC065FA6-08F9-4C50-99DC-275D16CFC5BD}
HKEY_CLASSES_ROOT\Pugi.PugiObj
HKEY_CLASSES_ROOT\Pugi.PugiObj.1
HKEY_CLASSES_ROOT\TypeLib\{89A10D64-83BF-41A4-86A3-7AAF1F8F3D1B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
ISTbarISTbar

Values Added:

HKEY_CURRENT_USER\Software\IST "account_id"
Data: (varies)

HKEY_CLASSES_ROOT\CLSID\{5F1ABCDB-A875-46c1-8345-B72A4567E486}\InprocServer32 "(Default)"
Data: C:\PROGRA~1\ISTbar\istbar.dll

HKEY_CLASSES_ROOT\Interface\{DC065FA6-08F9-4C50-99DC-275D16CFC5BD}\TypeLib "(Default)"
Data: {89A10D64-83BF-41A4-86A3-7AAF1F8F3D1B}

HKEY_CLASSES_ROOT\TypeLib\{89A10D64-83BF-41A4-86A3-7AAF1F8F3D1B}\1.0\0\win32 "(Default)"
Data: C:\Program Files\ISTbar\istbar.dll

Network Impact

Additional overhead in bandwidth due to download of additional software and updates, as well as advertising content.

Removal

Aliases

Aliases

N/A