Viviband Toolbar is a spyware program disguised as a toolbar add-on for your browser.  It was first discovered on January 9 of 2007.  It was created by SINA Inc. and is distributed by the website, http://vivi.sina.com.cn/.

Viviband Toolbar is installed on your computer manually by an ActiveX installer.  It may also be bundled with other ad-supported freewares, which may also be spyware or adware.  It resets your browser’s home page to http://vivi.sina.com.cn/ and redirects all searches to that website.

It uploads user data and browsing information to its server.  It does this supposedly in order to deliver contextual advertising.  There is, however, much potential for abuse.

The activity of Viviband Toolbar can seriously slow down your computer’s performance.  It can also potentially cause your Internet browser to freeze or crash.  Any supposed benefits it offers are not worth compromising the functionality of your computer, or your privacy.

If you are infected with this program, you should remove it immediately with SpyZooka.  While there are other means to remove Viviband Toolbar, SpyZooka has proven to consistently and completely remove this threat from your computer.

Also Known As:
Adware.Win32. Viviband Toolbar,
Adware-Viviband Toolbar

Spyware Type:
Toolbar
Browser Hijacker
Data Miner

Associated Files:
%windir%\Downloaded Program Files\vivimin.dll
%windir%\Downloaded Program Files\vivimin.inf
%windir%\Downloaded Program Files\vivimin0.dll
%systemdrive%\temp\_viviurl.log
%systemdrive%\temp\~df1026.tmp
%systemdrive%\temp\jet3.tmp
%windir%\system32\catroot2\tmp.edb
HKEY_CURRENT_USER\Software\Maxthon\Plugin\Toolbar\{15DDE989-CD45-4561-BF99-D22C0D5C2B85}

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\ÊղشËÒ³µ½ÐÂÀËViVi

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{15DDE989-CD45-4561-BF99-D22C0D5C2B85}

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{15DDE989-CD45-4561-BF99-D22C0D5C2B85}\iexplore

HKEY_CURRENT_USER\Software\SinaVivi

HKEY_CURRENT_USER\Software\SinaVivi\Collect

HKEY_CURRENT_USER\Software\SinaVivi\Common

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{15DDE989-CD45-4561-BF99-D22C0D5C2B85}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{15DDE989-CD45-4561-BF99-D22C0D5C2B85}\Contains

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{15DDE989-CD45-4561-BF99-D22C0D5C2B85}\Contains\Files

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{15DDE989-CD45-4561-BF99-D22C0D5C2B85}\DownloadInformation

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{15DDE989-CD45-4561-BF99-D22C0D5C2B85}\InstalledVersion

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{15DDE989-CD45-4561-BF99-D22C0D5C2B85}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/vivimin.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sinavivi

Key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{15DDE989-CD45-4561-BF99-D22C0D5C2B85}\iexplore
Value Added : Count = “6”

Key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{15DDE989-CD45-4561-BF99-D22C0D5C2B85}\iexplore
Value Added : Time = “D7 07 04 00 01 00 02 00 0B 00 00 00 1C 00 71 02”

Key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{15DDE989-CD45-4561-BF99-D22C0D5C2B85}\iexplore
Value Added : Type = “2”

Key:
HKEY_CURRENT_USER\Software\SinaVivi\Collect
Value Added : classid = “ÆäËû”

Key:
HKEY_CURRENT_USER\Software\SinaVivi\Collect
Value Added : grouplist = ” ”

Key:
HKEY_CURRENT_USER\Software\SinaVivi\Collect
Value Added : ispub = “1”

Key:
HKEY_CURRENT_USER\Software\SinaVivi\Collect
Value Added : succ = “2”

Key:
HKEY_CURRENT_USER\Software\SinaVivi\Common
Value Added : comid = “2”

Key:
HKEY_CURRENT_USER\Software\SinaVivi\Common
Value Added : hidebar = “”

Key:
HKEY_CURRENT_USER\Software\SinaVivi\Common
Value Added : installday = “2007-04-02”

Key:
HKEY_CURRENT_USER\Software\SinaVivi\Common
Value Added : update = “16”

Key:
HKEY_CURRENT_USER\Software\SinaVivi\Common
Value Added : viviid = “11976157”

Key:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15DDE989-CD45-4561-BF99-D22C0D5C2B85}\InprocServer32
Value Added : ThreadingModel = “Apartment”

Key:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{58F4C2BC-18AF-4EBC-9678-290B8E60FACB}\TypeLib
Value Added : Version = “1.0”

Key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{15DDE989-CD45-4561-BF99-D22C0D5C2B85}
Value Added : Installer = “MSICD”

Key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{15DDE989-CD45-4561-BF99-D22C0D5C2B85}
Value Added : SystemComponent = “0”

Key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{15DDE989-CD45-4561-BF99-D22C0D5C2B85}\Contains\Files
Value Added : %WINDIR%\Downloaded Program Files\vivimin.dll = “”

Key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{15DDE989-CD45-4561-BF99-D22C0D5C2B85}\DownloadInformation
Value Added : CODEBASE = “http://vivi.sina.com.cn/control/vivi.cab”

Key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{15DDE989-CD45-4561-BF99-D22C0D5C2B85}\DownloadInformation
Value Added : INF = “%WINDIR%\Downloaded Program Files\vivimin.inf”

Key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{15DDE989-CD45-4561-BF99-D22C0D5C2B85}\InstalledVersion
Value Added : LastModified = “Wed, 22 Jun 2005 08:02:25 GMT”

Key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
Value Added : {15DDE989-CD45-4561-BF99-D22C0D5C2B85} = “ÐÂÀËViViÊղؼД

Key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/vivimin.dll
Value Added : .Owner = “{15DDE989-CD45-4561-BF99-D22C0D5C2B85}”

Key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/vivimin.dll
Value Added : {15DDE989-CD45-4561-BF99-D22C0D5C2B85} = “”

Key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls
Value Added : %WINDIR%\Downloaded Program Files\vivimin.dll = “1”

Key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sinavivi
Value Added : DisplayName = “ÐÂÀËViViÊղؼД

Key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sinavivi
Value Added : UninstallString = “regsvr32 /u /s %WINDIR%\DOWNLO~1\vivimin.dll”