Seekdns.com

By JubileeX in Browser Hijackers

The Seekdns.com domain is associated with a fairly common online scam, which takes the form of fake search engines. While a legitimate search engine (such as Google, Yahoo, or Bing) displays websites that match the user's Internet search, websites like Seekdns.com display a list of malicious websites, regardless of the search that took place. Seekdns.com is associated with a browser hijacker with the same name, a malware infection designed to force its victims to visit Seekdns.com repeatedly. There are many clones of Seekdns.com, including Zinky, BarQuery.com, QueryExplorer.com, and QuestDNS.com. These websites are also associated with their own browser hijackers. The difference between Seekdns.com and its clones is minimal, limited only to slight changes in the interface and the websites' names. This kind of practice can drastically increase the difficulty of eradicating these kinds of scams from the Internet; each clone means that PC security researchers must update their own detection methods and identify the clone as a new version of Seekdns.com. ESG malware analysts strongly recommend taking a Seekdns.com browser hijacker infection very seriously. If your Internet browser is forcing you to visit Seekdns.com repeatedly, it generates revenue for the criminals behind Seekdns.com, after each visit. Visiting Seekdns.com carries the potential of further malware invading your computer system. Malware associated directly and indirectly with Seekdns.com may not limit itself to forcing your Internet browser to visit websites or display pop-up windows and advertisements. Malware acquired from Seekdns.com search results may have the potential to take over your computer system, allow criminals to control your computer from afar or steal of personal information (such as banking accounts and online passwords.)

Understanding the Seekdns.com Scam

If you consider that most websites generate their revenue from advertisement impressions, advertisement clicks and affiliate marketing practices, it is easy to see how criminals use Seekdns.com to make money. After all, it is easy to increase your traffic if you force people to visit your website, instead of creating interesting or useful content. However, it is important to understand that using browser hijackers like Seekdns.com in order to drive traffic to a specific web page, is an illegal practice. Websites having to rely on fake search engines like Seekdns.com have usually been banned from legitimate search engines, due to the nature of their content, usually associated with malware or with various online scams. Do not become a victim of Seekdns.com; protect your computer system with a legitimate, reliable and fully-updated anti-malware scanner.

File System Details

Seekdns.com may create the following file(s):
# File Name Detections
1. %AppData%SeekDNSstats.dat
2. %AppData%SeekDNSdtx.ini
3. %AppData%SeekDNSversion.xml
4. %AppData%SeekDNScouponsmerchants.xml
5. %AppData%SeekDNSstat.log
6. %AppData%SeekDNSuninstallStatIE.dat
7. %AppData%SeekDNSlog.txt
8. %AppData%SeekDNScouponscategories.xml
9. %AppData%SeekDNSpreferences.dat
10. %AppData%SeekDNSuninstallIE.dat
11. %AppData%SeekDNSguid.dat
12. %Temp%SeekDNS-manifest.xml
13. %AppData%SeekDNScouponsmerchants2.xml

Registry Details

Seekdns.com may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A40DC6C5-79D0-4ca8-A185-8FF989AF1115} "UrlHelper Class"
HKEY_LOCAL_MACHINESOFTWAREClassesQueryExplorerIEHelper.DNSGuard
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}VersionIndependentProgID "QueryExplorerIEHelper.UrlHelper"
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}ProgID "QueryExplorerIEHelper.UrlHelper.1"
HKEY_LOCAL_MACHINESOFTWAREClassesQueryExplorerIEHelper.DNSGuardCLSID
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{99079a25-328f-4bd4-be04-00955acaa0a7} "QueryExplorer Toolbar"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar "QueryExplorer Toolbar"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{99079a25-328f-4bd4-be04-00955acaa0a7} "QueryExplorer QueryExplorer Toolbar"
HKEY_LOCAL_MACHINESOFTWAREClassesQueryExplorerIEHelper.DNSGuardCurVer
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{99079a25-328f-4bd4-be04-00955acaa0a7}InprocServer32 "C:PROGRA~1WINDOW~4ToolBarQueryExplorerdtx.dll"
HKEY_LOCAL_MACHINESOFTWAREClassesQueryExplorerIEHelper.DNSGuard.1

Trending

Most Viewed

Loading...