Home Malware Programs Browser Hijackers Findamo.com

Findamo.com

Posted: May 29, 2012

Findamo.com Screenshot 1Although Findamo.com dishes up a search engine interface that's suspiciously similar to Google's own template, Findamo.com has some important differences from that reputable search engine. Browser hijackers use various methods to redirect your browser to Findamo.com, which may also include less obvious attacks than redirects (such as stealing personal information or monitoring your web-browsing habits). Findamo.com also has an unusually broad privacy policy that effectively grants Findamo.com access to sensitive information that no one would release to a search engine site willingly. While Findamo.com hasn't been found to host malicious content or promote it, malware researchers still recommend that you use a high level of caution around Findamo.com, and always remove Findamo.com-affiliated PC threats with a quick and in-depth anti-malware scan.

Finding Out the Truth of Findamo.com's Searches

While Findamo.com hasn't yet been indicated to host or directly promote any type of harmful content, Findamo.com is still far from perfect as far as search engine quality is concerned. With a privacy policy that explicitly allows Findamo.com to monitor your searches and track sensitive information that potentially includes login names and passwords, Findamo.com is unlikely to do any good or refrain from using your information in ways that could harm you, your computer or various online accounts. Due to these risks, SpywareRemove.com malware analysts suggest that you avoid inputting sensitive information through your web browser as long as you have a Findamo.com-related PC threat on your computer or have had recent contact with Findamo.com, even if Findamo.com isn't necessarily likely to infect or directly attack your PC.

Findamo.com might have sunk beneath the web's notice if Findamo.com weren't for recently-emerging browser hijack attacks that have been linked to Findamo.com. While the distribution for Findamo.com-related browser hijackers hasn't yet been defined as of the time of this writing, easily-noticed symptoms include having your homepage set to Findamo.com and having an additional search engine toolbar added to your web browser's interface.

Discerning the Path That Leads Away from Findamo.com

PC threats that promote Findamo.com in the above fashion have been emergent as of May 2012. Since various anti-malware products have been found to experience difficulties in completely detecting all components of a Findamo.com-related browser hijacker, SpywareRemove.com malware researchers remind that you should always keep your security software's threat database completely updated for maximum detection and disinfection potency.

Attempting to remove the aforementioned homepage change and search engine may temporarily allow you to free your browser from Findamo.com, but reopening your browser will let the browser hijacker start the nightmare from fresh – unless, of course, the PC threat is removed by an anti-malware program in the meantime. Findamo.com's browser hijacker has confirmed functionality for the Windows 7 64-bit operating system, as well as the Chrome, Internet Explorer and Firefox web browsers.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%AllUsersProfile%\{RANDOM CHARACTERS}\ File name: %AllUsersProfile%\{RANDOM CHARACTERS}\
%AllUsersProfile%\{RANDOM CHARACTERS}\*.lnk File name: %AllUsersProfile%\{RANDOM CHARACTERS}\*.lnk
File type: Shortcut
Mime Type: unknown/lnk

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current\Winlogon\”Shell” = “{RANDOM CHARACTERS}.exe”HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\{RANDOM CHARACTERS}
Loading...