Egyrank is an Internet Explorer toolbar that tracks user Internet activity and transfers gathered information to a predefined web server. The threat also changes the web browser's default home and search pages as well as some related settings. Egyrank also enables ActiveX and JavaScript support even if the user disabled it. The program must be manually installed.
egyrank.dll
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMainStart Page=[site address]HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerSearchSearchAssistant=[site address]HKEY_CLASSES_ROOTToolBand.XBTB02205HKEY_CLASSES_ROOTToolBand.XBTB02205.1HKEY_CLASSES_ROOTXBTB02205.IEToolbarHKEY_CLASSES_ROOTXBTB02205.IEToolbar.1HKEY_CLASSES_ROOTXBTB02205.XBTB02205HKEY_CLASSES_ROOTXBTB02205.XBTB02205.1HKEY_CLASSES_ROOTCLSID{06EECACB-F7C6-4ab9-B6AE-2DC4ED4588BB}HKEY_CLASSES_ROOTCLSID{CAE916D2-880A-4198-BB83-9E9DBD9615DC}HKEY_CLASSES_ROOTInterface{3FBB839A-017B-465B-82E6-15D9B8F6E936}HKEY_CLASSES_ROOTInterface{4C5CC6AE-70B0-4EC3-BAD5-BA0708F4432C}HKEY_CLASSES_ROOTTypeLib{088930B5-5537-4AE6-B484-98AAB895FC63}HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06EECACB-F7C6-4ab9-B6AE-2DC4ED4588BB}HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar{CAE916D2-880A-4198-BB83-9E9DBD9615DC}HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebBrowser{CAE916D2-880A-4198-BB83-9E9DBD9615DC}HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks{CAE916D2-880A-4198-BB83-9E9DBD9615DC}HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMainFeatureControlFEATURE_LOCALMACHINE_LOCKDOWNiexplore=0HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExtStats{06EECACB-F7C6-4AB9-B6AE-2DC4ED4588BB}HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExtStats{CAE916D2-880A-4198-BB83-9E9DBD9615DC}HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsUser AgentPost PlatformMister XHKEY_CURRENT_USERSoftwareXBTB02205HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallXBTB02205.XBTB02205Toolbar