Trojan.Miuref

Miuref is a browser hijacker that may make changes to your Web browser's settings automatically. Typical activities 'encouraged' by Miuref include click fraud, redirecting you to unwanted sites and even facilitating the distribution of other threats. There may be multiple components to a Miuref attack, and malware experts especially suggest using anti-malware-scanning solutions to remove Miuref, which has been known to coincide with other threats even more hostile than itself. All prominent brands of Windows browsers are, for now, vulnerable to the typical payload of Miuref hijackers.

The Hijacker Whose Hijackings You may Never See

Miuref has taken an all-inclusive philosophy towards installation, and malware researchers have seen Miuref installed by other Trojans (including Onkods and Fareit), installed through Web page exploits, spam e-mail files and by social engineering tactics (such as fake software updates). Although most of its functions target your Web browser, Miuref may include a fairly large set of features within this specialty, including some that may take place without directly alerting the PC's user. These include:

• Installing JavaScript extensions specific to Chrome or Firefox. These extensions may redirect your Web searches to unwanted Web pages as designated by the threat author. Miuref may redirect victims to 'spam' search engines, advertisements or threat-distributing Web pages.
• Internet Explorer also may be attacked, but in a more sophisticated way than extension abuse; by injecting threatening code into its memory process. However, the practical results of search engine hijacks may be consistent between the two methods.
• Miuref also may launch additional, hidden browser instances. In most cases, the purpose of these other Web-browsing processes is to simulate traffic to websites that reward traffic providers on a pay-per-click (or PPC) basis. This click fraud also may generate unwanted advertisements that are visible to the user. However, by default, this attack does not display itself as a visible interference with your Web-browsing activities.
• As with most semi-competent threat packages, Miuref does include functions for updating itself, which may modify its features beyond the scope of this article.
• As a slightly thematically inappropriate inclusion, Miuref also may moonlight as a Trojan downloader and may download and install other threats at will. These downloads raise the possibility for a Miuref infection to spiral into a multiple-threat scenario, with a corresponding increase in security risks.

Closing a Criminal's Easy Path to Web-Surfing Profits

Although half of Miuref's major functions may be fairly difficult to detect, Miuref also is kind enough to display some blatant side effects that are identifiable on sight. Malware researchers often categorize browser hijackers merely as low-level threats, but Miuref's particularly unsafe behavior warrants a classification as a mid to high-level threat, similar to that of any other Trojan downloader. Its potential as a delivery method for new threats certainly is not ignorable, and you always should undertake the removal of all traces of Miuref with proper anti-malware utilities immediately.

Since Miuref targets three specific brands of browsers, PC users who prefer other brands, such as OS X's Safari, may find themselves safest from Miuref attacks. However, even the least-targeted Web browsers are endangered by other browser hijackers, and malware researchers recommend staying responsive to signs of browser hijacks, pop-up attacks and other browser-related threat signs at all times.

Technical Details