Home Malware Programs Browser Hijackers KeenFinder.com

KeenFinder.com

Posted: December 14, 2011

KeenFinder.com Screenshot 1KeenFinder.com is a fake news and search engine site that uses its seemingly-benign appearance as an excuse to direct traffic to self-serving links (such as Pay-Per-Click frauds). As a clone of PrimoSearch.com, KeenFinder.com offers similar dangers to unwary visitors, such as browser hijackers that take over your web browser. If your web browser redirects itself to KeenFinder.com, your PC is infected by a KeenFinder.com-affiliated browser hijacker and SpywareRemove.com malware researchers recommend that you scan your computer immediately to remove this PC threat. However, even a few seconds of non-interactive contact with KeenFinder.com can be a source of additional attacks, and so you should even take accidental contact with KeenFinder.com as a potentially-serious invasion of your computer's security.

Why KeenFinder.com is Keen on Finding Bad Sites for You to Visit

Upon initial inspection, KeenFinder.com looks like an extremely-handy website for finding news articles and other websites. However, any efforts to use KeenFinder.com's features will immediately let you know the same thing that SpywareRemove.com malware researchers have discerned – that KeenFinder.com will only provide links to irrelevant, advertisement-filled and possibly-malicious websites. Visits to KeenFinder.com may also result in drive-by-download attacks that can install anything from tracking cookies to browser hijackers, and KeenFinder.com's affiliates should be considered equally-untrustworthy.

Since traffic is unlikely to come to KeenFinder.com willingly, KeenFinder.com has compensated for this in the same fashion as PrimoSearch.com – by using browser-redirecting Trojans to force traffic to come to itself. Trojans that are capable of redirecting your browser to KeenFinder.com may also block PC security sites, create fake error messages, interfere with your browser's settings or generate pop-ups. The presence of a Trojan that's capable of browser hijacks is also a high-level security risk, since such Trojans often have other functions (such as disabling security software or changing firewall settings).

Dulling KeenFinder.com's Edge for Fraudulent Marketing

Removing a browser hijacker for KeenFinder.com should always entail the usage of good PC security software if you have access to such programs, since KeenFinder.com-affiliated Trojans are likely to conceal files in sensitive locations and may even use the names of normal Windows components. Browser redirects to KeenFinder.com can affect all major brands of web browsers, and you should never try to get rid of a KeenFinder.com-aligned browser hijacker by deleting your web-browsing application.

However, competent security software can delete browser hijackers for KeenFinder.com without any long-term harm for your PC. Using Safe Mode or another technique to disable the Trojan in the first place may be required before all of the infected components can be removed. Until that time, SpywareRemove.com malware researchers warn that you should be careful to avoid any redirects to KeenFinder.com, which can reinfect your PC and force you to restart the disinfection from scratch.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%Temp%KeenFindertoolbar-manifest.xml File name: %Temp%KeenFindertoolbar-manifest.xml
Mime Type: unknown/xml
%AppData%KeenFindertoolbarcouponsmerchants2.xml File name: %AppData%KeenFindertoolbarcouponsmerchants2.xml
Mime Type: unknown/xml
%AppData%KeenFindertoolbarcouponscategories.xml File name: %AppData%KeenFindertoolbarcouponscategories.xml
Mime Type: unknown/xml
%AppData%KeenFindertoolbarcouponsmerchants.xml File name: %AppData%KeenFindertoolbarcouponsmerchants.xml
Mime Type: unknown/xml
%AppData%KeenFindertoolbardtx.ini File name: %AppData%KeenFindertoolbardtx.ini
Mime Type: unknown/ini
%AppData%KeenFindertoolbarguid.dat File name: %AppData%KeenFindertoolbarguid.dat
File type: Data file
Mime Type: unknown/dat
%AppData%KeenFindertoolbarstat.log File name: %AppData%KeenFindertoolbarstat.log
Mime Type: unknown/log
%AppData%KeenFindertoolbarstats.dat File name: %AppData%KeenFindertoolbarstats.dat
File type: Data file
Mime Type: unknown/dat
%AppData%KeenFindertoolbarlog.txt File name: %AppData%KeenFindertoolbarlog.txt
Mime Type: unknown/txt
%AppData%KeenFindertoolbarpreferences.dat File name: %AppData%KeenFindertoolbarpreferences.dat
File type: Data file
Mime Type: unknown/dat
%AppData%KeenFindertoolbaruninstallIE.dat File name: %AppData%KeenFindertoolbaruninstallIE.dat
File type: Data file
Mime Type: unknown/dat
%AppData%KeenFindertoolbaruninstallStatIE.dat File name: %AppData%KeenFindertoolbaruninstallStatIE.dat
File type: Data file
Mime Type: unknown/dat
%AppData%KeenFindertoolbarversion.xml File name: %AppData%KeenFindertoolbarversion.xml
Mime Type: unknown/xml

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINESOFTWAREClassesKeenFinderIEHelper.DNSGuardCLSIDHKEY_LOCAL_MACHINESOFTWAREClassesKeenFinderIEHelper.DNSGuardHKEY_LOCAL_MACHINESOFTWAREClassesKeenFinderIEHelper.DNSGuard.1HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}VersionIndependentProgID "KeenFinderIEHelper.UrlHelper"HKEY_LOCAL_MACHINESOFTWAREClassesKeenFinderIEHelper.DNSGuardCurVerHKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}ProgID "KeenFinderIEHelper.UrlHelper.1?HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A40DC6C5-79D0-4ca8-A185-8FF989AF1115} “UrlHelper Class”HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar “KeenFinder Toolbar”HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{99079a25-328f-4bd4-be04-00955acaa0a7} "KeenFinder KeenFinder Toolbar"HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{99079a25-328f-4bd4-be04-00955acaa0a7}InprocServer32 "C:PROGRA~1WINDOW~4ToolBarKeenFinderdtx.dll"HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{99079a25-328f-4bd4-be04-00955acaa0a7} "KeenFinder Toolbar"
Loading...