Home Malware Programs Browser Hijackers SearchQuick.net

SearchQuick.net

Posted: January 25, 2012

SearchQuick.net Screenshot 1SearchQuick.net is a search engine site that delivers advertisements and other forms of content that are traditionally labeled as 'spam' instead of providing the intricate and safe results that a popular search site like Google would proffer. Although SearchQuick.net's results are unlikely to be of any use, SearchQuick.net has been noted to acquire repeated traffic by way of browser redirects from browser hijack-capable PC threats. If your web browser is redirecting itself to SearchQuick.net for no reason, chances are high that your PC is infected by a Trojan, rootkit or malicious toolbar, and SpywareRemove.com malware experts recommend that you immediately scan your computer. Trojans and other PC threats that are capable of browser hijacks may also be a source of other attacks until removed, including pop-ups and password theft.

Don't Be Too Quick to Trust a Redirect to SearchQuick.net

Redirects to SearchQuick.net and similar sites are, in almost all cases, a sign of infection by a browser hijacker. Browser hijackers that promote SearchQuick.net may be present in several forms, including:

  • Browser-specific toolbars or BHOs that are unable to function in other types of web browsers. Although these add-ons may have utilities for their own removal, using these utilities will rarely remove the browser-hijacking component of the PC threat.
  • Rootkits that infect the boot sector of your PC. In most cases, browser hijackers that are delivered in a rootkit format will not show a distinctive memory process or file on your PC, even though they'll be running by default whenever you load your OS by normal methods.
  • Trojans that operate as independent programs, like rootkits, may launch themselves automatically, but unlike rootkits, they are often visible in Task Manager or as separate applications.

Redirects to SearchQuick.net may also be accomplished by changes to Registry and DNS settings; in such cases, you should make sure that these settings changes have been undone even after you've used anti-malware software to delete the guilty PC threat. Failure to do this may allow redirects to SearchQuick.net to continue even if the browser hijacker that's responsible for these changes has been completely removed.

Other Dangers That You May Face from a Browser Hijacker

Because PC threats that are able to redirect your browser to SearchQuick.net may also be able to commit to other types of attacks against your computer, SpywareRemove.com malware researchers discourage attempts to live with redirects or ignore them. Some of the other symptoms of a browser hijacker that you may experience include:

  • Pop-up windows that feature advertisements, fake system scans or phishing scams.
  • Safe websites that are blocked with unusual 'unsafe site' warnings. These warnings may also contain links to other websites like SearchQuick.net.
  • Theft of your personal information due to the browser hijacker monitoring information that's saved in your browser's cached files.
  • Unusual browser settings such as settings that lock your starting page to SearchQuick.net and refuse to be changed.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%Temp%[trojan name]toolbar-manifest.xml File name: %Temp%[trojan name]toolbar-manifest.xml
Mime Type: unknown/xml
%AppData%[trojan name]toolbarversion.xml File name: %AppData%[trojan name]toolbarversion.xml
Mime Type: unknown/xml
%AppData%[trojan name]toolbarcouponsmerchants2.xml File name: %AppData%[trojan name]toolbarcouponsmerchants2.xml
Mime Type: unknown/xml
%AppData%[trojan name]toolbardtx.ini File name: %AppData%[trojan name]toolbardtx.ini
Mime Type: unknown/ini
%AppData%[trojan name]toolbarcouponscategories.xml File name: %AppData%[trojan name]toolbarcouponscategories.xml
Mime Type: unknown/xml
%AppData%[trojan name]toolbarcouponsmerchants.xml File name: %AppData%[trojan name]toolbarcouponsmerchants.xml
Mime Type: unknown/xml
%AppData%[trojan name]toolbarpreferences.dat File name: %AppData%[trojan name]toolbarpreferences.dat
File type: Data file
Mime Type: unknown/dat
%AppData%[trojan name]toolbarstat.log File name: %AppData%[trojan name]toolbarstat.log
Mime Type: unknown/log
%AppData%[trojan name]toolbarguid.dat File name: %AppData%[trojan name]toolbarguid.dat
File type: Data file
Mime Type: unknown/dat
%AppData%[trojan name]toolbarstats.dat File name: %AppData%[trojan name]toolbarstats.dat
File type: Data file
Mime Type: unknown/dat
%AppData%[trojan name]toolbaruninstallIE.dat File name: %AppData%[trojan name]toolbaruninstallIE.dat
File type: Data file
Mime Type: unknown/dat
%AppData%[trojan name]toolbaruninstallStatIE.dat File name: %AppData%[trojan name]toolbaruninstallStatIE.dat
File type: Data file
Mime Type: unknown/dat
%AppData%[trojan name]toolbarlog.txt File name: %AppData%[trojan name]toolbarlog.txt
Mime Type: unknown/txt

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}ProgID "[trojan name]IEHelper.UrlHelper.1"HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{99079a25-328f-4bd4-be04-00955acaa0a7} "[trojan name] Toolbar"HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{99079a25-328f-4bd4-be04-00955acaa0a7}InprocServer32 "C:PROGRA~1WINDOW~4ToolBar[trojan name]dtx.dll"HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}VersionIndependentProgID "[trojan name]IEHelper.UrlHelper"HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A40DC6C5-79D0-4ca8-A185-8FF989AF1115} "UrlHelper Class"HKEY_LOCAL_MACHINESOFTWAREClasses[trojan name]IEHelper.DNSGuard.1HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar "[trojan name] Toolbar"HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{99079a25-328f-4bd4-be04-00955acaa0a7} "[trojan name] Toolbar"HKEY_LOCAL_MACHINESOFTWAREClasses[trojan name]IEHelper.DNSGuardCurVerHKEY_LOCAL_MACHINESOFTWAREClasses[trojan name]IEHelper.DNSGuardCLSIDHKEY_LOCAL_MACHINESOFTWAREClasses[trojan name]IEHelper.DNSGuard
Loading...