SlikDealer New Tab

The SlikDealer New Tab is published on the Chrome Web Store in four identical flavors. All four releases of the SlikDealer New Tab point to the site Slikdealer.com, which claims to help Web surfers find the best deals on the Open Web. The SlikDealer New Tab extension may be promoted to Web surfers as a shopping adviser, but you should know that there are reports from users who claim it generates too many ads. The SlikDealer New Tab extension might overwhelm users with promotional messages, and some PC users may think they have been infected with adware. The SlikDealer New Tab is known to request the following rights under Google Chrome:

• Read and change all your data on the websites you visit.
• Replace the page you see when opening a new tab.
• Read and change your browsing history.

As mentioned above, the SlikDealer New Tab can be found on four pages on the Chrome Web Store, which include (at the time of research):

• SlikDealer New Tab on Chrome.google.com/webstore/detail/slikdealer-new-tab/copmmchebencocnbcdpkdanmbggaobec
• SlikDealer-B on Chrome.google.com/webstore/detail/slikdealer-b/daeeeededgpbonoidlmlcacnnpafkpbi
• SlikDealer-C on Chrome.google.com/webstore/detail/slikdealer-c/fmjecpjhbeiighnmcpgijphelkacoepm
• SlikDealer-D on Chrome.google.com/webstore/detail/slikdealer-d/omgonicgljlflogphbdlcjpmbchmjaij

Some computer researchers classify the SlikDealer New Tab as an adware considering the app changes your new tab to h[tt]p://www.slikdealer[.]com/ext/index.html?cfg=cfgA.json, which features links to Couponcabin.com, Savings.com, Coupons.com and Smartsource.com. The h[tt]p://www.slikdealer[.]com/ext/index.html?cfg=cfgA.json portal can be loaded without installing the SlikDealer New Tab extension and we found that the extension generates pop-up windows loaded with content from the 52.84.7.87 IP address. PC users may notice pop-up windows with the following URLs:

h[tt]p://sub.srcconfig[.]com/installers/cli/1410881692473/flvplayersetup-q9hee0v3y.exe
h[tt]p://d1pg43ots40sgg.cloudfront.net/bundle/ElectroLyrics/20140515120137/Bundle.exe
h[tt]p://d24w57zdpkb0ax.cloudfront[.]net/offer-kits/47/1378500199_GiganticSavings.exe
h[tt]p://d1pg43ots40sgg.cloudfront[.]net/bundle/SaveClicker/20140520100310/Nosibay_SaveClicker_new.exe
h[tt]ps://d3bxh2vomloo25.cloudfront[.]net/securerc/c6/spcmsetup8.exe
h[tt]p://d1pg43ots40sgg.cloudfront[.]net/bundle/Pricora/20140416141400/deeal.exe
h[tt]p://d22gqc0zdi1sju.cloudfront[.]net/offer-kits/114/1391689093_the_wedownload.exe

These URLs are used to introduce riskware, adware and browser hijackers to PC users. We do not recommend users to add the SlikDealer New Tab extension to Chrome and explore similar versions for Mozilla Firefox and Internet Explorer. There is no guarantee that the content generated via SlikDealer and its clones is verified and safe to download. You might be interested in using a trusted anti-malware utility that can purge all traces of the SlikDealer New Tab extension safely. AV companies detect and remove the objects downloaded from the 52.84.7.87 IP address, which may be marked as:

• ADW_TOMOS
• AdWare.W32.Agent.allm!c
• Adware.Win32.Amonetize.avh
• Gen:Variant.Adware.Graftor.174762
• PUA.Amonetize!
• PUP.Optional.Somoto
• TROJ_SPNR.15FI14
• Trojan ( 0049a68c1 )
• W32/Trojan.VNJN-8085