BrowserModifier:Win32/BaiduSobar

Creates a folder in named 'baidu' in the %ProgramFiles% folder

Creates additional subfolders and drops files within those folders:
%ProgramFiles%\baidu\bar\baidubar.dat
%ProgramFiles%\baidu\bar\BaiduBar.dll
%ProgramFiles%\baidu\bar\BDBar_tmp\baidubar.dat
%ProgramFiles%\baidu\bar\BDBar_tmp\img\imglist.bmp
%ProgramFiles%\baidu\bar\BDBar_tmp\img\logo.bmp
%ProgramFiles%\baidu\bar\img\imglist.bmp
%ProgramFiles%\baidu\bar\img\logo.bmp
%ProgramFiles%\baidu\bar\BDBar_tmp\baidubar.dat
%ProgramFiles%\baidu\bar\BDBar_tmp\BaiduBar.dll
%ProgramFiles%\baidu\bar\BDBar_tmp\BaiduBar.dll
%ProgramFiles%\baidu\bar\BDBar_tmp\img\imglist.bmp

Creates .URL files within the %ALLUSERSPROFILE%\Start Menu\Programs folder

Modifies the registry to run BrowserModifier:Win32/BaiduSobar as a browser helper object (BHO):
Adds values:
{77FEF28E-EB96-44FF-B511-3185DEA48697}\InprocServer32\(Default)
{7C76C055-ED6E-4535-A70F-CD476E727F67}\InprocServer32\(Default)
{A7F05EE4-0426-454F-8013-C41E3596E9E9}\InprocServer32\(Default)
{B580CF65-E151-49C3-B73F-70B13FCA8E86}\InprocServer32\(Default)
{FE14F22E-BE14-4F08-A80F-F27BC3A67B2D}\InprocServer32\(Default)
With data: %ProgramFiles%\baidu\bar\BaiduBar.dll      
To subkey: HKEY_CLASSES_ROOT\CLSID\
Adds value: {77FEF28E-EB96-44FF-B511-3185DEA48697}\id
With data: bdbar
To subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
Adds value: {B580CF65-E151-49C3-B73F-70B13FCA8E86}
With data: 0
To subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\

Modifies the registry with settings related to the functionality of BrowserModifier:Win32/BaiduSobar:
Adds values:
version
RunState
With data: 0x0
Adds values:
SearchBoxMode
ShowState
DisplayMode
DisplayLineMode
With data: 0x1
To subkey: HKEY_CURRENT_USER\Software\Baidu\BaiduBar\
Adds values:
AllVoice_State
AllFlash_State
AllPic_State
With data: 0x0
To subkey: HKEY_CURRENT_USER\Software\Baidu\BaiduBar\NoAD\ 

Modifies the registry instructing BrowserModifier:Win32/BaiduSobar to allow advertisements from specific Web sites that may include any of the following strings in the source URL:
*.hao123.com*
*.baidu.com*

Modifies the registry instructing BrowserModifier:Win32/BaiduSobar to disallow advertisements from specific Web sites that may include any of the following strings in the source URL:
*/ad.*        
*/imgad/*        
http://ad[0-9].*        
http://ads.        
*banner.*        
*/advpic*        
*doubleclick.*        
*/ad/*        
*/banner_img/*        
*/adbanners*        
*cnsmin.3721.com/*        
*/adv/*        
*/images_ad/*        
*/ads/*        
*/advlink/*        
*/banner*        
http://ad.*        
*banners/*        
*/adImages/*        
*.swf[a-z]*        
*images.sohu.com/cs/button/*

Modifies the registry to alter search settings used by Internet Explorer:
Adds values:
CustomizeSearch_sb 
SearchAssistant_sb
With data: http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm        
In subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\
Adds values:
CustomizeSearch
SearchAssistant
With data: http://bar.baidu.com/sobar/defaultsearch.html        
To subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\

Downloads a kernel mode driver that protects files and registry keys from being removed