Spyware:Win32/WebHancer

During installation, WebHancer creates a folder named webHancer under %ProgramFiles% (typically C:\Program Files). The WebHancer folder contains two subfolders, Programs and SpeedRank. Files dropped to those folders include:

 

sporder.dll
webhdll.dll
whagent.exe
whagent.ini
whiehlpr.dll
whsurvey.exe
whSurvey.ini

whspeedrank.exe

 

To load when Windows is started, WebHancer modifies the registry as follows:

 

WebHancer may also creates the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\webhancer
HKEY_CURRENT_USER\Software\webHancer
HKEY_CLASSES_ROOT\CLSID\{c900b400-cdfe-11d3-976a-00e02913a9e0}
HKEY_CLASSES_ROOT\Interface\{C89435B0-CDFE-11D3-976A-00E02913A9E0}
HKEY_CLASSES_ROOT\TypeLib\{C8CB3870-CDFE-11D3-976A-00E02913A9E0}
HKEY_CLASSES_ROOT\WhIeHelperObj.WhIeHelperObj
HKEY_CLASSES_ROOT\WhIeHelperObj.WhIeHelperObj.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c900b400-cdfe-11d3-976a-00e02913a9e0}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37BC627C-868B-467D-99EF-D9CDBFF28385}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webHancer Agent

WebHancer may integrate as a Winsock layered service provider (LSP). Attempting to remove WebHancer manually is not recommended, as improper removal of an LSP can subsequently prevent the computer from connecting to the Internet.