Name: CWS.Conyc Category: Spyware Alias: CWSConyc, Popup Blocker Advice: Remove Risk: Elevated Risk Elevated threats are usually threats that fall into the range of adware in which data about a user's habits are tracked and sent back to a server for analysis without your consent or knowledge. Description: CWS.Conyc is a Browser Helper Object (BHO) that contacts a Web site when Internet Explorer is started. Creates the following registry entries: HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain "Enable Browser Extensions" = "yes" HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain "Use Search Assistant" = "yes" HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain "Use Search Asst" = "no" HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerSearchUrl "(Default)" = "http://www.v73.us" HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks "{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70}" HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar "{815A82AE-CDEF-11D8-BA48-A6D245798277}" = "Popup Blocker 17.08.04" Modifies the following value: "SearchAssistant" = "http://www.v73.us/search.htm" in the registry key: HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerSearch May create the following file: %Windir%inet10050services.exe May create the value: "xp_system" = "%Windir%inet10050services.exe" in the registry keys: HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun May create the value: "run" = "%Windir%inet10050services.exe" in the registry key: HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWindows Contacts the domain conyc.com to display advertisements when Internet Explorer is started. Type: Spyware - Spyware's primary purpose is to collect demographic and usage information from your computer, usually for advertising purposes. Spyware usually that 'sneaks' onto a system or performs other activities hidden to the user. Spyware programs are usually bundled as a hidden component and downloaded from the Internet. These modules are almost always installed on the system secretively and try to run secretively as well.