Have you ever gone to your favorite search engine to look something up and spotted a mysterious search pane on the side of your browser window? This new search pane offers search results that are similar to what you are searching for, but it doesn't quite seem to fit. If you have noticed this search pane, then chances are you have an advertising parasite known as Subsearch.
SubSearch is a Browser Helper Object from AdScholar.com that integrates into Internet Explorer. It detects when you are using a search engine, and opens its own "enhanced results" sidebar containing results paid for by advertisers. The Subsearch pane changes its appearance to resemble whichever search engine site you are using at the moment.
Subsearch also spawns unwanted pop up windows when Internet Explorer is opened initially.
Subsearch is installed in one of two ways. The original variant is installed using ActiveX drive by methods. Once that is installed, a backdoor updater routine downloads and installs newer versions. All of this is done without user intervention, or indeed without the user's knowledge.
In addition, one variant of Subsearch contains a rather serious security vulnerability. According to Andrew Clover of doxdesk.com, "the Subsearch/v2 variant can be directed by any web page to download any file and write it anywhere to the file system, including over other program files which may then get run."
It is highly recommended that you remove this parasite as soon as possible. Spybot S&D and Ad-aware both can remove Subsearch.
This article is located at http://www.spywareinfoforum.info/articles/subsearch/
Links:
http://www.doxdesk.com/parasite/SubSearch.html Doxdesk's SubSearch information page
http://www.spywareinfoforum.info/articles/bho/ BHO article at SWI
http://security.kolla.de/ Spybot
http://www.lavasoft.de/ Ad-aware
