Home Malware Programs Browser Hijackers Sukoku.com

Sukoku.com

Posted: January 31, 2012

Sukoku.com Screenshot 1Sukoku.com is a search site that offers results that are organized for the profit of its web masters – such as advertisements and sponsored links – in lieu of sorting results by the quality and safety of their content. Because Sukoku.com is a clone of a similar site, Seekeen.com, that's been confirmed to promote PC threats, SpywareRemove.com malware experts discourage any kind of visit to Sukoku.com or attempt to use its search feature. Sukoku.com may also be promoted as an online destination by web browser hijackers such as the OneStepSearch toolbar. If your browser redirects itself to Sukoku.com or you've recently installed a malicious toolbar like the above, you should suppress the urge to use normal uninstall methods and, instead, scan your computer with an anti-malware program of good repute.

Don't Get Bitten by the Aftertaste of Sukoku.com's Search Results

Sukoku.com has a pleasing appearance on the outside, and by presenting a privacy policy may even look legitimate, but anyone who's familiar with Sukoku.com's sister site, Seekeen.com, will be aware that Sukoku.com is a definitive threat to his or her PC. Sukoku.com has been ranked as 'suspicious' by a variety of PC security companies, in addition to being a confirmed destination for browser hijackers, particularly those that are marketed in the form of search-enhancing toolbars. Because similar sites have been known to distribute PC threats, SpywareRemove.com malware experts caution that you should strongly consider scanning your PC after any encounter with Sukoku.com regardless of its brevity, even if you avoid using Sukoku.com's search feature.

Redirects to Sukoku.com and similar sites (such as Seekeen.com) are the most common means of contact with Sukoku.com, and often occur after the installation of a malicious search toolbar that can be bundled with unrelated applications. SpywareRemove.com malware experts have confirmed that the OneStepSearch toolbar, a product for Internet Explorer, has been caught redirecting browsers to sites that are linked to Sukoku.com. You should consider any OneStepSearch-based redirect to be hostile and potentially damaging to your PC, even if your browser only loads a site that looks like Sukoku.com with a different domain or uses Sukoku.com as a midway point before reaching a final destination.

Getting Wrestling Back Your Freedom of Choice from Sukoku.com's Browser Hijackers

Although browser hijackers for Sukoku.com, particularly those that are installed in the form of toolbars, may include normal options for their removal, SpywareRemove.com malware researchers don't encourage you to trust a PC threat's own removal utility. To insure that all components of a Sukoku.com-aligned browser hijacker are expunged, the safest course of action is to scan your PC with trustworthy anti-malware programs – particularly since such browser hijackers may also have extra functions, such as the ability to expose you to other PC threats or disable your browser's security settings.

If you've given away personal information to a site or entity that's promoted by Sukoku.com, SpywareRemove.com malware researchers recommend that you step in to avoid the possibility of fraudulent bills, account break-ins, identity theft and other crimes in the future. You may want to consider changing compromised passwords and being alert for the possibility of 'spam' e-mail attacks for any type of compromised e-mail address.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%AppData%[trojan name]toolbarversion.xml File name: %AppData%[trojan name]toolbarversion.xml
Mime Type: unknown/xml
%Temp%[trojan name]toolbar-manifest.xml File name: %Temp%[trojan name]toolbar-manifest.xml
Mime Type: unknown/xml
%AppData%[trojan name]toolbarcouponsmerchants2.xml File name: %AppData%[trojan name]toolbarcouponsmerchants2.xml
Mime Type: unknown/xml
%AppData%[trojan name]toolbardtx.ini File name: %AppData%[trojan name]toolbardtx.ini
Mime Type: unknown/ini
%AppData%[trojan name]toolbarcouponscategories.xml File name: %AppData%[trojan name]toolbarcouponscategories.xml
Mime Type: unknown/xml
%AppData%[trojan name]toolbarcouponsmerchants.xml File name: %AppData%[trojan name]toolbarcouponsmerchants.xml
Mime Type: unknown/xml
%AppData%[trojan name]toolbarguid.dat File name: %AppData%[trojan name]toolbarguid.dat
File type: Data file
Mime Type: unknown/dat
%AppData%[trojan name]toolbarlog.txt File name: %AppData%[trojan name]toolbarlog.txt
Mime Type: unknown/txt
%AppData%[trojan name]toolbarpreferences.dat File name: %AppData%[trojan name]toolbarpreferences.dat
File type: Data file
Mime Type: unknown/dat
%AppData%[trojan name]toolbaruninstallIE.dat File name: %AppData%[trojan name]toolbaruninstallIE.dat
File type: Data file
Mime Type: unknown/dat
%AppData%[trojan name]toolbaruninstallStatIE.dat File name: %AppData%[trojan name]toolbaruninstallStatIE.dat
File type: Data file
Mime Type: unknown/dat
%AppData%[trojan name]toolbarstat.log File name: %AppData%[trojan name]toolbarstat.log
Mime Type: unknown/log
%AppData%[trojan name]toolbarstats.dat File name: %AppData%[trojan name]toolbarstats.dat
File type: Data file
Mime Type: unknown/dat

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{99079a25-328f-4bd4-be04-00955acaa0a7} "[trojan name] Toolbar"HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}VersionIndependentProgID "[trojan name]IEHelper.UrlHelper"HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{99079a25-328f-4bd4-be04-00955acaa0a7}InprocServer32 "C:PROGRA~1WINDOW~4ToolBar[trojan name]dtx.dll"HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A40DC6C5-79D0-4ca8-A185-8FF989AF1115} "UrlHelper Class"HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}ProgID "[trojan name]IEHelper.UrlHelper.1"HKEY_LOCAL_MACHINESOFTWAREClasses[trojan name]IEHelper.DNSGuardCurVerHKEY_LOCAL_MACHINESOFTWAREClasses[trojan name]IEHelper.DNSGuardCLSIDHKEY_LOCAL_MACHINESOFTWAREClasses[trojan name]IEHelper.DNSGuardHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{99079a25-328f-4bd4-be04-00955acaa0a7} "[trojan name] Toolbar"HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar "[trojan name] Toolbar"HKEY_LOCAL_MACHINESOFTWAREClasses[trojan name]IEHelper.DNSGuard.1
Loading...