PremiumSearch installs a malicious Browser Helper Object (BHO) on the user's computer. The infection starts when it installs a fake 'Google' toolbar (which does not come from Google but has been created by a third party) and redirects to the PremiumSearch search engine. PremiumSearch also modifies the HOSTS file, which maps domain names that include Google.com, MSN.com, and Yahoo.com to an IP address hosting spoofed versions of those search engines. Users are redirected from other pages containing pirated software or pornography.
actsie4.exeusbhdctl.exeb1dc153079.exe45dd6cc479.exe
utipwfubknk.dll