IdentifyPlaces.com

Posted: April 30, 2012

IdentifyPlaces.com is a search engine site that's promoted by browser-redirecting PC threats as a form of easy traffic revenue. Although IdentifyPlaces.com hasn't been indicated to have any malicious characteristics in and of itself, SpywareRemove.com malware analysts recommend deleting IdentifyPlaces.com-aligned browser hijackers as soon as you experience their symptoms, since such attacks are often accompanied by other functions that can decrease your PC's security. Anti-malware scans from appropriate programs are ideal for deleting PC threats that are responsible for IdentifyPlaces.com redirects, since such scans can also detect and remove related system changes to your Hosts file and other OS components without risking any damage to your computer.

Denoting the Ties Between IdentifyPlaces.com and Real PC Threats

At the time of this writing, IdentifyPlaces.com hasn't been identified as a malicious site and doesn't have a history of enabling attacks against your PC or distributing harmful software. Other than reports of search results that are focused on providing advertisements and other types of irrelevant links, IdentifyPlaces.com can't be considered harmful to your computer, but this hasn't stopped PC threats from promoting IdentifyPlaces.com themselves. Because redirects to IdentifyPlaces.com are symptoms of various PC threats rather than being clearly identified as a characteristic of a single type of browser hijacker, SpywareRemove.com malware researchers recommend that you stay alert for various IdentifyPlaces.com redirect methods, including:

Having your homepage locked to IdentifyPlaces.com – regardless of any changes you make to these settings.
Being redirected to IdentifyPlaces.com after you try to navigate to an unrelated site such as a search engine.
Being redirected to IdentifyPlaces.com immediately after using a search engine or clicking on a search result.
Seeing pop-ups for IdentifyPlaces.com or similar sites that occur for no obvious reason.

Ending IdentifyPlaces.com Redirects Without Any Harm Done to Your PC in the Process

IdentifyPlaces.com redirects may or may not be specific to a particular type of web browser or confine themselves to triggering off of a particular website. Regardless of its specific attributes, however, a string of IdentifyPlaces.com redirect attacks will always be linked to PC threats that can also be capable of other attacks, including security and privacy-reducing ones. Hence, SpywareRemove.com malware researchers encourage you to take all necessary measures to delete any IdentifyPlaces.com-redirecting PC threat once you have a hint of its presence on your computer.

Because browser hijackers that promote IdentifyPlaces.com may inject their code into normal processes and have a high chance of changing various system files and settings without your consent, anti-malware software is always recommended for dealing with IdentifyPlaces.com-related browser hijackers. Incomplete or improper removal of such PC threats may not only fail to stop redirects to IdentifyPlaces.com but may also leave your computer in a prolonged state of vulnerability to future attacks.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%AppData%[trojan name]toolbarstat.log

File name: %AppData%[trojan name]toolbarstat.log
Mime Type: unknown/log

%AppData%[trojan name]toolbardtx.ini

File name: %AppData%[trojan name]toolbardtx.ini
Mime Type: unknown/ini

%AppData%[trojan name]toolbarlog.txt

File name: %AppData%[trojan name]toolbarlog.txt
Mime Type: unknown/txt

%AppData%[trojan name]toolbarpreferences.dat

File name: %AppData%[trojan name]toolbarpreferences.dat
File type: Data file
Mime Type: unknown/dat

%AppData%[trojan name]toolbarguid.dat

File name: %AppData%[trojan name]toolbarguid.dat
File type: Data file
Mime Type: unknown/dat

%AppData%[trojan name]toolbarstats.dat

File name: %AppData%[trojan name]toolbarstats.dat
File type: Data file
Mime Type: unknown/dat

%AppData%[trojan name]toolbaruninstallIE.dat

File name: %AppData%[trojan name]toolbaruninstallIE.dat
File type: Data file
Mime Type: unknown/dat

%AppData%[trojan name]toolbaruninstallStatIE.dat

File name: %AppData%[trojan name]toolbaruninstallStatIE.dat
File type: Data file
Mime Type: unknown/dat

%Temp%[trojan name]toolbar-manifest.xml

File name: %Temp%[trojan name]toolbar-manifest.xml
Mime Type: unknown/xml

%AppData%[trojan name]toolbarversion.xml

File name: %AppData%[trojan name]toolbarversion.xml
Mime Type: unknown/xml

%AppData%[trojan name]toolbarcouponscategories.xml

File name: %AppData%[trojan name]toolbarcouponscategories.xml
Mime Type: unknown/xml

%AppData%[trojan name]toolbarcouponsmerchants.xml

File name: %AppData%[trojan name]toolbarcouponsmerchants.xml
Mime Type: unknown/xml

%AppData%[trojan name]toolbarcouponsmerchants2.xml

File name: %AppData%[trojan name]toolbarcouponsmerchants2.xml
Mime Type: unknown/xml

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{CLSID Path}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}ProgID "[trojan name]IEHelper.UrlHelper.1"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115} "UrlHelper Class"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}InprocServer32 "C:PROGRA~1WINDOW~4ToolBar[trojan name]dtx.dll"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7} "[trojan name] Toolbar"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}VersionIndependentProgID "[trojan name]IEHelper.UrlHelper"HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Classes[trojan name]IEHelper.DNSGuardHKEY_LOCAL_MACHINE\SOFTWARE\Classes[trojan name]IEHelper.DNSGuard.1HKEY_LOCAL_MACHINE\SOFTWARE\Classes[trojan name]IEHelper.DNSGuardCurVerHKEY_LOCAL_MACHINE\SOFTWARE\Classes[trojan name]IEHelper.DNSGuardCLSIDHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{99079a25-328f-4bd4-be04-00955acaa0a7} "[trojan name] Toolbar"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar "[trojan name] Toolbar"