Seekeen.com

Posted: January 31, 2012

Seekeen.com is a search engine that provides advertisements and other types of revenue-enhancing results instead of sorting results according to their relevance. Along with this poor search functionality, Seekeen.com has also been confirmed to be promoted as a destination site by browser hijackers like the OneStepSearch toolbar and to distribute PC threats by its own power, as well. Accordingly, SpywareRemove.com malware researchers recommend that you avoid Seekeen.com or any site that resembles Seekeen.com (such as Sukoku.com) and remove Seekeen.com-related browser hijackers with reliable anti-malware software, which will allow you to resume browsing the web without redirect attacks or other forms of interference.

Seekeen.com: A Search Engine That Doesn't Bother to Do Much Searching

Although Seekeen.com uses an eye-pleasing template that makes Seekeen.com look like a helpful and streamlined search engine, search results from Seekeen.com are more likely to display advertisements than anything else. In addition, since Seekeen.com has been noted to distribute malicious software as well as be promoted by such software itself, SpywareRemove.com malware researchers suggest that you treat any contact with Seekeen.com as a good justification for scanning your PC with an anti-malware product of your choice. Seekeen.com can also be considered a clone of Sukoku.com, which uses an identical format and can present the same dangers to your PC as Seekeen.com would offer.

Some attacks that Seekeen.com may place your PC at risk for include:

The promotion of scamware or fake security products that use inaccurate warning pop-ups.
Phishing scams that try to steal personal information, such as your e-mail address, under false pretenses.
The automatic installation of other PC threats via drive-by-download scripts.

Seeking an End to Seekeen.com's Appearances in Your Browser

In addition to its own advertisement-and-malware-promoting hijinks, Seekeen.com has also been linked to browser redirect attacks that are caused by the OneStepSearch toolbar (also known as BrowserModifier:Win32/OneStepSearch.C, Adware.SaveNow and Adware-OneStep), an add-on for Internet Explorer. OneStepSearch, much like Seekeen.com, pretends to be a harmless search utility but actually forces your browser to load Seekeen.com and related sites, such as Sukoku.com, without your consent. This type of browser hijacker for Seekeen.com is often installed in the form of a toolbar product or as part of a bundle with other programs.

Because browser hijackers that promote Seekeen.com are known to launch and run automatically, you should assume that they're actively engaged in attacking your PC unless you've taken steps, such as booting into Safe Mode, to prevent this. SpywareRemove.com malware experts also recommend that you delete browser hijackers for Seekeen.com with appropriate anti-malware utilities, even though malicious toolbars like OneStepSearch will often include (incomplete) removal tools of their own. Using an included removal tool may leave components of the PC threat on your computer or allow undesirable changes to your browser's settings to remain, and risks exposing you to Seekeen.com again in the future.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%AppData%[trojan name]toolbarversion.xml

File name: %AppData%[trojan name]toolbarversion.xml
Mime Type: unknown/xml

%Temp%[trojan name]toolbar-manifest.xml

File name: %Temp%[trojan name]toolbar-manifest.xml
Mime Type: unknown/xml

%AppData%[trojan name]toolbarcouponsmerchants2.xml

File name: %AppData%[trojan name]toolbarcouponsmerchants2.xml
Mime Type: unknown/xml

%AppData%[trojan name]toolbardtx.ini

File name: %AppData%[trojan name]toolbardtx.ini
Mime Type: unknown/ini

%AppData%[trojan name]toolbarcouponscategories.xml

File name: %AppData%[trojan name]toolbarcouponscategories.xml
Mime Type: unknown/xml

%AppData%[trojan name]toolbarcouponsmerchants.xml

File name: %AppData%[trojan name]toolbarcouponsmerchants.xml
Mime Type: unknown/xml

%AppData%[trojan name]toolbarguid.dat

File name: %AppData%[trojan name]toolbarguid.dat
File type: Data file
Mime Type: unknown/dat

%AppData%[trojan name]toolbarlog.txt

File name: %AppData%[trojan name]toolbarlog.txt
Mime Type: unknown/txt

%AppData%[trojan name]toolbarpreferences.dat

File name: %AppData%[trojan name]toolbarpreferences.dat
File type: Data file
Mime Type: unknown/dat

%AppData%[trojan name]toolbaruninstallIE.dat

File name: %AppData%[trojan name]toolbaruninstallIE.dat
File type: Data file
Mime Type: unknown/dat

%AppData%[trojan name]toolbaruninstallStatIE.dat

File name: %AppData%[trojan name]toolbaruninstallStatIE.dat
File type: Data file
Mime Type: unknown/dat

%AppData%[trojan name]toolbarstat.log

File name: %AppData%[trojan name]toolbarstat.log
Mime Type: unknown/log

%AppData%[trojan name]toolbarstats.dat

File name: %AppData%[trojan name]toolbarstats.dat
File type: Data file
Mime Type: unknown/dat

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{99079a25-328f-4bd4-be04-00955acaa0a7} "[trojan name] Toolbar"HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}VersionIndependentProgID "[trojan name]IEHelper.UrlHelper" HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{99079a25-328f-4bd4-be04-00955acaa0a7}InprocServer32 "C:PROGRA~1WINDOW~4ToolBar[trojan name]dtx.dll"HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A40DC6C5-79D0-4ca8-A185-8FF989AF1115} "UrlHelper Class"HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}ProgID "[trojan name]IEHelper.UrlHelper.1"HKEY_LOCAL_MACHINESOFTWAREClasses[trojan name]IEHelper.DNSGuardCurVerHKEY_LOCAL_MACHINESOFTWAREClasses[trojan name]IEHelper.DNSGuardCLSIDHKEY_LOCAL_MACHINESOFTWAREClasses[trojan name]IEHelper.DNSGuardHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{99079a25-328f-4bd4-be04-00955acaa0a7} "[trojan name] Toolbar"HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar "[trojan name] Toolbar"HKEY_LOCAL_MACHINESOFTWAREClasses[trojan name]IEHelper.DNSGuard.1