BrowserModifier:Win32/TogiraSP

The latest version of this application is not detected by our objective criteria, and is not considered unwanted software.

Installation

This threat can be installed at the same time as third-party software installation programs.

Behavior

Changes your homepage and search provider

Older versions of this software try to change your homepage or default search provider. If you change these settings the application reverts your changes each time you restart your PC.

We have seen it make the following change to the registry in order to change your homepage:

In subkey: HKCU\Software\Microsoft\Internet Explorer\Main
From: "<your default homepage>"
To:  hxxps://<variable language>.search.yahoo.com/?type={random}&fr=spigot-yhp-ie

Creates browser extensions

Some variants might create a browser extension, such as the following:

Creates an uninstaller

Some variants might create an uninstaller. It might look like the following:

Additional information

• A timeline of consent and control provides an overview of Microsoft's BrowserModifier detection criteria.
• Detection changes: search protection code provides an overview of Microsoft's detection criteria update for browser search protection functionality.

Analysis by Michael Johnson