Home Malware Programs Adware ShoppingSidekick

ShoppingSidekick

Posted: February 28, 2013

Threat Metric

Threat Level: 2/10
Infected PCs: 10,792
First Seen: February 28, 2013
Last Seen: June 12, 2024
OS(es) Affected: Windows

Shopping Sidekick is an adware program that will display its own pop-up ads on Dell, Amazon, Walmart and other websites that Internet users are visiting. These pop-up advertisements will be illustrated as boxes carrying a variety of coupons that are available or as underlined keywords, which when clicked will show a pop-up advertisement that claims it is sent to web users by Shopping Sidekick. Shopping Sidekick is an add-on for Internet Explorer, Mozilla Firefox and Google Chrome that is mainly added when web users install other free applications. When PC users install these free applications, they will also install Shopping Sidekick on their computers. Some of the software products that are known to come bundled with Shopping Sidekick involve 1ClickDownload, Yontoo and FBPhotoZoom. When installed, whenever PC users will browse Expedia, Best Buy, Facebook or any other similar websites, Shopping Sidekick will display a box, which contains related ads, keyword suggestions, and sponsored links in the right top part of the hacked web browser.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%PROGRAMFILES%\Shopping Sidekick Plugin\Shopping Sidekick Plugin.dll File name: Shopping Sidekick Plugin.dll
Size: 637.95 KB (637952 bytes)
MD5: a3059269a6255b88a76baf580f94748d
Detection count: 5,600
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES%\Shopping Sidekick Plugin
Group: Malware file
Last Updated: June 10, 2021
%PROGRAMFILES%\Excellent Coupons\Excellent Coupons.dll File name: Excellent Coupons.dll
Size: 704.39 KB (704392 bytes)
MD5: 3d5afce2acf6041013b8022489416bdd
Detection count: 42
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES%\Excellent Coupons
Group: Malware file
Last Updated: February 28, 2013

More files

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{RegistryKeys}Software\AppDataLow\Software\Excellent CouponsSOFTWARE\AppDataLow\Software\Shopping SidekickSOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011501158}SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110011501158}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011501158}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110011501158}HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}Shopping Sidekick

Additional Information

The following directories were created:
%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\glaepndckebjplpebopahpolmmgidagl%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_glaepndckebjplpebopahpolmmgidagl_0%LOCALAPPDATA%\Shopping Sidekick%LOCALAPPDATA%\Shopping Sidekick-BrowserExtensionUninstall%LOCALAPPDATA%\Updater12755%PROGRAMFILES%\Excellent Coupons%PROGRAMFILES(x86)%\Excellent Coupons
Loading...