Home Malware Programs Browser Hijackers Clickforms.ru

Clickforms.ru

Posted: June 23, 2016

Threat Metric

Threat Level: 5/10
Infected PCs: 75
First Seen: June 23, 2016
Last Seen: November 13, 2021
OS(es) Affected: Windows


Clickforms.ru is a page that you probably will not come across while browsing the Web since its owners are not using any sorts of advertising to popularize it. In fact, this domain may not be used to host any valuable or at least interesting content, and opening the page manually will not lead you anywhere. However, this does not mean that Clickforms.ru doesn't have a purpose. The owners of this domain may use small pieces of software called browser hijackers to modify the system of users so that they'll be redirected to Clickforms.ru automatically whenever they launch their Web browser. These hijackers usually require the user's permission to modify their browser's behavior, and this is why they may often use fraudulent and misleading tricks to be authorized by the user.

The peculiar thing about the Clickforms.ru is that it may not tamper with the browser's settings directly. Instead, this hijacker may create three '.bat' files, which contain an obfuscated command that opens the user's favorite Web browser with modified properties, therefore redirecting them to Clickforms.ru. In addition to doing this, the hijacker also may replace the default browser shortcuts with new ones that open the matching '.bat' file instead of the original browser executable.

Judging by the names of the files 'chrome.bat.exe,' 'firefox.bat.exe,' 'iexplore.bat.exe,' 'launcher.bat.exe' (the last one has an Opera icon), the Clickforms.ru hijacker may be compatible with all major Web browsers. Users who were unlucky to agree to have this software on their computers may have the unenjoyable experience of being redirected to Clickforms.ru whenever they launch their Web browser. When they reach the Clickforms.ru page, it will refer them to a 3rd-party website or advertisements that may promote various offers, sites, and services automatically. If this is an issue you are experiencing currently, then you need to run an anti-malware scanner as soon as possible, since this is the only guaranteed way to remove all of the hijacker's files that may be responsible for the unwanted redirects.

Technical Details

Additional Information

The following URL's were detected:
n.clickforms.ru
Loading...