TROJ_SRCHSUTE.AD

December 08, 2014

Analysis by: Cris Nowell Pantanilla

PLATFORM:

Windows

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

INFORMATION EXPOSURE:

Threat Type: Trojan
Destructiveness: No
Encrypted: No
In the wild: Yes

OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

TECHNICAL DETAILS

File Size:

8,244,624 bytes

File Type:

, EXE

Memory Resident:

Yes

Initial Samples Received Date:

27 Jun 2014

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

%Application Data%\systemk\coordinator.cfg
%Application Data%\systemk\general.cfg
%Application Data%\systemk\S-1-5-32.cfg
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\searchplugins\default-search.xml
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\chrome.manifest
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF.xpt
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF10.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF11.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF12.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF13.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF14.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF15.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF16.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF17.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF18.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF19.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF2.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF20.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF21.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF22.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF23.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF24.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF25.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF26.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF27.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF28.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF29.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF4.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF5.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF6.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF7.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF8.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\components\SystemKHlpFF9.dll
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\DnsBHO.js
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\Error404BHO.js
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\MainBHO.js
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\NativeHelper.js
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\NewTabBHO.js
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\overlay.js
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\overlay.xul
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\RelatedSearch.js
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\RequestPreserver.js
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\SearchBHO.js
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\content\SettingManager.js
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\{EB25CAE0-E5F3-E993-3950-E055FE755242}\install.rdf
%User Temp%\followXXXXa01336
%User Temp%\nsj38\Helper.dll
%User Temp%\nsj38\LinkeyDeals.exe
%User Temp%\nsj38\Uninstall.exe
%User Temp%\nsj38.tmp\registry.dll
%User Temp%\nsq40\insthlp.dll
%User Temp%\nsz7\Helper.dll
%User Temp%\nsz7\nshB.tmp\extensions.sqlite
%User Temp%\nsz7\nshB.tmp\ffExtension.exe
%User Temp%\nsz7\nshB.tmp\install.rdf
%User Temp%\nsz7\nshB.tmp\mediabar.exe
%User Temp%\nsz7\nshB.tmp\pack.exe
%User Temp%\nsz7\nshB.tmp\Search_Results.xml
%User Temp%\nsz7\nshB.tmp\Search_Results.xml.old
%User Temp%\nsz7\nshB.tmp\SettingsManagerMediaBar.exe
%User Temp%\nsz7\Starter.exe
%User Temp%\nsz7\tbicon.exe
%Program Files%\Linkey\Helper.dll
%Program Files%\Linkey\IEExtension
%Program Files%\Linkey\IEExtension\iedll.dll
%Program Files%\Linkey\IEExtension\iedll64.dll
%Program Files%\Linkey\log.log
%Program Files%\Linkey\module.dll
%Program Files%\Linkey\module64.dll
%Program Files%\Linkey\Uninstall.exe
%Program Files%\LinkeyDeals\insthlp.dll
%Program Files%\LinkeyDeals\LinkeyDealsUninst.exe
%Program Files%\LinkeyDeals\msilnk.dll
%Program Files%\LinkeyDeals\msilnk.exe
%Program Files%\Settings Manager\systemk\favicon.ico
%Program Files%\Settings Manager\systemk\Helper.dll
%Program Files%\Settings Manager\systemk\Internet Explorer Settings.exe
%Program Files%\Settings Manager\systemk\sysapcrt.dll
%Program Files%\Settings Manager\systemk\syskldr.dll
%Program Files%\Settings Manager\systemk\syskldr_u.dll
%Program Files%\Settings Manager\systemk\systemk.dll
%Program Files%\Settings Manager\systemk\systemkbho.dll
%Program Files%\Settings Manager\systemk\systemkChrome.dll
%Program Files%\Settings Manager\systemk\systemkmgrc1.cfg
%Program Files%\Settings Manager\systemk\SystemkService.exe
%Program Files%\Settings Manager\systemk\systemku.exe
%Program Files%\Settings Manager\systemk\tbicon.exe
%Program Files%\Settings Manager\systemk\Uninstall.exe
%Program Files%\Mozilla Firefox\searchplugins\default-search.xml

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)

It creates the following folders:

%Program Files%\Linkey
%Program Files%\LinkeyDeals
%Application Data%\systemk
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default
%Program Files%\Settings Manager\systemk
%User Temp%\nsj38
%User Temp%\nsq40
%User Temp%\nsz7

(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CLASSES_ROOT\Linkey.Linkey

HKEY_CLASSES_ROOT\SettingsManagerIEHelper.DNSGuard

HKEY_CLASSES_ROOT\SettingsManagerIEHelper.DNSGuard.1

HKEY_CLASSES_ROOT\AppID\iedll.dll

HKEY_CLASSES_ROOT\AppID\{6A7CD9EC-D8BD-4340-BCD0-77C09A282921}

HKEY_CLASSES_ROOT\CLSID\{4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47}

HKEY_CLASSES_ROOT\CLSID\{54739D49-AC03-4C57-9264-C5195596B3A1}

HKEY_CLASSES_ROOT\CLSID\{E1842850-FB16-4471-B327-7343FBAED55C}

HKEY_CLASSES_ROOT\Interface\{4613B1C1-FBC0-43C3-A4B9-B1D6CD360BB3}

HKEY_CLASSES_ROOT\Interface\{AA760BA8-5862-4BC5-9263-4452CBC0B264}

HKEY_CLASSES_ROOT\TypeLib\{726E90BE-DC22-4965-B215-E0784DC26F47}

HKEY_CLASSES_ROOT\TypeLib\{93D511B5-143B-4A99-ABFC-B5B78AD0AE1B}

HKEY_CURRENT_USER\Software\SystemK

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Approved Extensions

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Ext\
Settings\{4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47}

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Ext\
Settings\{54739D49-AC03-4C57-9264-C5195596B3A1}

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Linkey

HKEY_LOCAL_MACHINE\SOFTWARE\Linkey

HKEY_LOCAL_MACHINE\SOFTWARE\LinkeyDeals

HKEY_LOCAL_MACHINE\SOFTWARE\SystemK

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SystemkService

It adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
bitguard.exe
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
bprotect.exe
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
bpsvc.exe
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
browserdefender.exe
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
browserprotect.exe
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
browsersafeguard.exe
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
dprotectsvc.exe
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
jumpflip
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
protectedsearch.exe
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
searchinstaller.exe
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
searchprotection.exe
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
searchprotector.exe
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
searchsettings.exe
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
searchsettings64.exe
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
snapdo.exe
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
stinst32.exe
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
stinst64.exe
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
umbrella.exe
debugger = tasklist.exe

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Search
SearchAssistant = "http://www.default-search.net?sid=427&aid=0&itype=n&ver=12791&tm=539&src=ds&p="

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Search Bar = http://www.default-search.net?sid=427&aid=0&itype=n&ver=12791&tm=539&src=ds&p=

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Linkey Deals = %Program Files%\LinkeyDeals\msilnk.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Windows
LoadAppInit_DLLs = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
ESENT\Process\{malware filename}\
DEBUG
Trace Level = {blank}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
FrameAuto = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Toolbar
10 = 10

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
utiljumpflip.exe
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
volaro
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
vonteera
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
websteroids.exe
debugger = tasklist.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
websteroidsservice.exe
debugger = tasklist.exe

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Start Page = http://www.default-search.net?sid=427&aid=0&itype=n&ver=12791&tm=539&src=hmp

(Note: The default value data of the said registry entry is {user settings}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Windows
AppInit_DLLs = %Program Files%\Linkey\IEEXTE~1\iedll.dll

(Note: The default value data of the said registry entry is {blank}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Search
SearchAssistant = http://www.default-search.net?sid=427&aid=0&itype=n&ver=12791&tm=539&src=ds&p=

(Note: The default value data of the said registry entry is {user settings}.)

Other Details

This Trojan connects to the following possibly malicious URL:

http://{BLOCKED}e.{BLOCKED}e.com/install_statistics.php
http://{BLOCKED}d.{BLOCKED}e.com/login
http://{BLOCKED}e.{BLOCKED}project.com/install_statistics.php

SOLUTION

Minimum Scan Engine:

9.700

FIRST VSAPI PATTERN FILE:

10.888.04

FIRST VSAPI PATTERN DATE:

27 Jun 2014

VSAPI OPR PATTERN File:

10.889.00

VSAPI OPR PATTERN Date:

28 Jun 2014

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Identify and terminate files detected as TROJ_SRCHSUTE.AD

[ Learn More ]

Windows Task Manager may not display all running processes. In this case, please use a third-party process viewer, preferably Process Explorer, to terminate the malware/grayware/spyware file. You may download the said tool here.
If the detected file is displayed in either Windows Task Manager or Process Explorer but you cannot delete it, restart your computer in safe mode. To do this, refer to this link for the complete steps.
If the detected file is not displayed in either Windows Task Manager or Process Explorer, continue doing the next steps.

Step 3

Search and delete these folders

[ Learn More ]

Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result. %Program Files%\Linkey

%Program Files%\LinkeyDeals

%Application Data%\systemk

%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default

%Program Files%\Settings Manager\systemk

%User Temp%\nsj38

%User Temp%\nsq40

%User Temp%\nsz7

To delete malware/grayware/spyware folders:

For Windows 2000, Windows XP, and Windows Server 2003:

Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
In the File name* input box, type:

%Program Files%\Linkey
%Program Files%\LinkeyDeals
%Application Data%\systemk
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default
%Program Files%\Settings Manager\systemk
%User Temp%\nsj38
%User Temp%\nsq40
%User Temp%\nsz7
In the Look In drop-down list, select My Computer, then press Enter.
Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
Repeat steps 2 to 4 for the remaining folders: %Program Files%\Linkey
%Program Files%\LinkeyDeals
%Application Data%\systemk
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default
%Program Files%\Settings Manager\systemk
%User Temp%\nsj38
%User Temp%\nsq40
%User Temp%\nsz7

*Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

Open a Windows Explorer window.
- For Windows Vista, 7, and Server 2008 users, click Start>Computer.
- For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen, then click File Explorer.
In the Search Computer/This PC input box, type:
%Program Files%\Linkey
%Program Files%\LinkeyDeals
%Application Data%\systemk
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default
%Program Files%\Settings Manager\systemk
%User Temp%\nsj38
%User Temp%\nsq40
%User Temp%\nsz7
Once located, select the file then press SHIFT+DELETE to permanently delete the folder.
Repeat steps 2-3 for the remaining folders: %Program Files%\Linkey
%Program Files%\LinkeyDeals
%Application Data%\systemk
%Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default
%Program Files%\Settings Manager\systemk
%User Temp%\nsj38
%User Temp%\nsq40
%User Temp%\nsz7

*Note: Read the following Microsoft page if these steps do not work on Windows 7.

Step 4

Search and delete this file

[ Learn More ]

There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.

%User Temp%\followXXXXa01336

%Program Files%\Mozilla Firefox\searchplugins\default-search.xml

Step 5

Restore this modified registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
- From: Start Page = "http://www.default-search.net?sid=427&aid=0&itype=n&ver=12791&tm=539&src=hmp"
  To: Start Page = "{user settings}"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
- From: AppInit_DLLs = "C:\PROGRA~1\Linkey\IEEXTE~1\iedll.dll "
  To: AppInit_DLLs = ""
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search
- From: SearchAssistant = "http://www.default-search.net?sid=427&aid=0&itype=n&ver=12791&tm=539&src=ds&p="
  To: SearchAssistant = "{user settings}"

Step 6

Delete this registry key

[ Learn More ]

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- bitguard.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- bprotect.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- bpsvc.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- browserdefender.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- browserprotect.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- browsersafeguard.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- dprotectsvc.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- jumpflip
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- protectedsearch.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- searchinstaller.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- searchprotection.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- searchprotector.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- searchsettings.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- searchsettings64.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- snapdo.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- stinst32.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- stinst64.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- umbrella.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- utiljumpflip.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- volaro
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- vonteera
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- websteroids.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- websteroidsservice.exe
In HKEY_CLASSES_ROOT
- Linkey.Linkey
In HKEY_CLASSES_ROOT
- SettingsManagerIEHelper.DNSGuard
In HKEY_CLASSES_ROOT
- SettingsManagerIEHelper.DNSGuard.1
In HKEY_CLASSES_ROOT\AppID
- iedll.dll
In HKEY_CLASSES_ROOT\AppID
- {6A7CD9EC-D8BD-4340-BCD0-77C09A282921}
In HKEY_CLASSES_ROOT\CLSID
- {4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47}
In HKEY_CLASSES_ROOT\CLSID
- {54739D49-AC03-4C57-9264-C5195596B3A1}
In HKEY_CLASSES_ROOT\CLSID
- {E1842850-FB16-4471-B327-7343FBAED55C}
In HKEY_CLASSES_ROOT\Interface
- {4613B1C1-FBC0-43C3-A4B9-B1D6CD360BB3}
In HKEY_CLASSES_ROOT\Interface
- {AA760BA8-5862-4BC5-9263-4452CBC0B264}
In HKEY_CLASSES_ROOT\TypeLib
- {726E90BE-DC22-4965-B215-E0784DC26F47}
In HKEY_CLASSES_ROOT\TypeLib
- {93D511B5-143B-4A99-ABFC-B5B78AD0AE1B}
In HKEY_CURRENT_USER\Software
- SystemK
In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer
- Approved Extensions
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings
- {4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47}
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings
- {54739D49-AC03-4C57-9264-C5195596B3A1}
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall
- Linkey
In HKEY_LOCAL_MACHINE\SOFTWARE
- Linkey
In HKEY_LOCAL_MACHINE\SOFTWARE
- LinkeyDeals
In HKEY_LOCAL_MACHINE\SOFTWARE
- SystemK
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
- {4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47}
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- SystemkService

To delete registry keys this malware/grayware created:

Open Registry Editor. To do this:
» For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
» For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
» For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options
Still in the left panel, locate and delete the key:
bitguard.exe
Again Still in the left panel, locate and delete the key:
bprotect.exe
Again Still in the left panel, locate and delete the key:
bpsvc.exe
Again Still in the left panel, locate and delete the key:
browserdefender.exe
Again Still in the left panel, locate and delete the key:
browserprotect.exe
Again Still in the left panel, locate and delete the key:
browsersafeguard.exe
Again Still in the left panel, locate and delete the key:
dprotectsvc.exe
Again Still in the left panel, locate and delete the key:
jumpflip
Again Still in the left panel, locate and delete the key:
protectedsearch.exe
Again Still in the left panel, locate and delete the key:
searchinstaller.exe
Again Still in the left panel, locate and delete the key:
searchprotection.exe
Again Still in the left panel, locate and delete the key:
searchprotector.exe
Again Still in the left panel, locate and delete the key:
searchsettings.exe
Again Still in the left panel, locate and delete the key:
searchsettings64.exe
Again Still in the left panel, locate and delete the key:
snapdo.exe
Again Still in the left panel, locate and delete the key:
stinst32.exe
Again Still in the left panel, locate and delete the key:
stinst64.exe
Again Still in the left panel, locate and delete the key:
umbrella.exe
Again Still in the left panel, locate and delete the key:
utiljumpflip.exe
Again Still in the left panel, locate and delete the key:
volaro
Again Still in the left panel, locate and delete the key:
vonteera
Again Still in the left panel, locate and delete the key:
websteroids.exe
Again Still in the left panel, locate and delete the key:
websteroidsservice.exe
In the left panel of the Registry Editor window, double-click the following:
HKEY_CLASSES_ROOT
Still in the left panel, locate and delete the key:
Linkey.Linkey
Again Still in the left panel, locate and delete the key:
SettingsManagerIEHelper.DNSGuard
Again Still in the left panel, locate and delete the key:
SettingsManagerIEHelper.DNSGuard.1
In the left panel of the Registry Editor window, double-click the following:
HKEY_CLASSES_ROOT>AppID
Still in the left panel, locate and delete the key:
iedll.dll
Again Still in the left panel, locate and delete the key:
{6A7CD9EC-D8BD-4340-BCD0-77C09A282921}
In the left panel of the Registry Editor window, double-click the following:
HKEY_CLASSES_ROOT>CLSID
Still in the left panel, locate and delete the key:
{4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47}
Again Still in the left panel, locate and delete the key:
{54739D49-AC03-4C57-9264-C5195596B3A1}
Again Still in the left panel, locate and delete the key:
{E1842850-FB16-4471-B327-7343FBAED55C}
In the left panel of the Registry Editor window, double-click the following:
HKEY_CLASSES_ROOT>Interface
Still in the left panel, locate and delete the key:
{4613B1C1-FBC0-43C3-A4B9-B1D6CD360BB3}
Again Still in the left panel, locate and delete the key:
{AA760BA8-5862-4BC5-9263-4452CBC0B264}
In the left panel of the Registry Editor window, double-click the following:
HKEY_CLASSES_ROOT>TypeLib
Still in the left panel, locate and delete the key:
{726E90BE-DC22-4965-B215-E0784DC26F47}
Again Still in the left panel, locate and delete the key:
{93D511B5-143B-4A99-ABFC-B5B78AD0AE1B}
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software
Still in the left panel, locate and delete the key:
SystemK
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer
Still in the left panel, locate and delete the key:
Approved Extensions
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Ext>Settings
Still in the left panel, locate and delete the key:
{4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47}
Again Still in the left panel, locate and delete the key:
{54739D49-AC03-4C57-9264-C5195596B3A1}
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Uninstall
Still in the left panel, locate and delete the key:
Linkey
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE
Still in the left panel, locate and delete the key:
Linkey
Again Still in the left panel, locate and delete the key:
LinkeyDeals
Again Still in the left panel, locate and delete the key:
SystemK
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects
Still in the left panel, locate and delete the key:
{4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47}
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services
Still in the left panel, locate and delete the key:
SystemkService
Close Registry Editor.

Step 7

Delete this registry value

[ Learn More ]

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search
- SearchAssistant = "http://www.default-search.net?sid=427&aid=0&itype=n&ver=12791&tm=539&src=ds&p="
In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
- Search Bar = "http://www.default-search.net?sid=427&aid=0&itype=n&ver=12791&tm=539&src=ds&p="
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- Linkey Deals = ""%Program Files%\LinkeyDeals\msilnk.exe""
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
- LoadAppInit_DLLs = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\{malware filename}\DEBUG
- Trace Level = ""
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
- FrameAuto = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
- 10 = "10"

To delete the registry value this malware/grayware created:

Open Registry Editor.
» For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
» For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
» For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Search
In the right panel, locate and delete the entry:
SearchAssistant = "http://www.default-search.net?sid=427&aid=0&itype=n&ver=12791&tm=539&src=ds&p="
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Main
In the right panel, locate and delete the entry:
Search Bar = "http://www.default-search.net?sid=427&aid=0&itype=n&ver=12791&tm=539&src=ds&p="
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
Linkey Deals = ""%Program Files%\LinkeyDeals\msilnk.exe""
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Windows
In the right panel, locate and delete the entry:
LoadAppInit_DLLs = 1
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>ESENT>Process>{malware filename}>DEBUG
In the right panel, locate and delete the entry:
Trace Level = ""
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Main
In the right panel, locate and delete the entry:
FrameAuto = 1
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Toolbar
In the right panel, locate and delete the entry:
10 = "10"
Close Registry Editor.

Step 8

Restart in normal mode and scan your computer with your Trend Micro product for files detected as TROJ_SRCHSUTE.AD. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

NOTES:
For Trend Micro Customers

Scanning your system with your registered Trend Micro security solution removes this malware.

Trend Micro products are powered by the Trend Micro™ Smart Protection Network™, a technology designed to protect you from all kinds of online security threats, regardless of type, attack vector, or behavior.

If you suspect a false positive (i.e. you believe the detected file to be non-malicious), kindly submit a sample of the detected file through the following channels for analysis:

For premium customers, click here.
For non-premium customers, click here.

For Non-Trend Micro Customers

You may download, install, and scan your system with HouseCall, our highly popular and capable on-demand scanner for identifying and removing viruses, Trojans, worms, unwanted browser plug-ins, and other malware.

Did this description help? Tell us how we did.

TROJ_SRCHSUTE.AD

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

TROJ_SRCHSUTE.AD

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

The Americas

Middle East & Africa

Europe

Asia & Pacific