SweetIM

Threat Scorecard

Ranking: 1,530
Threat Level: 20 % (Normal)
Infected Computers: 219,663
First Seen: May 3, 2010
Last Seen: September 30, 2024
OS(es) Affected: Windows

SweetIM Image

When PC security researchers see the message 'get free smilies', it immediately sets off multiple red flags. This is because the offer of free emoticons is one of the most common ways in which criminals entice inexperienced computer users into downloading and installing malware onto their computer system. SweetIM, associated with the website and toolbar search.sweetim.com, is one of many dodgy companies that lures its victims with the promise of free emoticons but delivers nothing but plenty of hassles and security risks. Because of this, security researchers strongly advise computer users to stay away from SweetIM or from the search.sweetim.com website. Contact with this 'free' service will do nothing but bring infections to your computer system and install a toolbar that cannot be removed through normal means.

The Main Problems with SweetIM

Computer users visiting websites that do not take care to make sure that advertisements they display are not associated with malware will often have come across obtrusive banner advertisements promising free emoticons for your computer. These obnoxious advertisements will often use pop-up windows or sound in order to obstruct computer users' normal online activity. SweetIM follows all of these tactics. If a computer user downloads SweetIM, SweetIM will immediately block all web browsers except Internet Explorer, since SweetIM is designed to take advantage of Internet Explorer's known vulnerabilities to Browser Helper Objects (that is, malicious toolbars designed to affect your web browser in some way or another). Then, once installed, SweetIM will not allow the victim to remove the SweetIM toolbar from the web browser through normal uninstall procedures. Since the search.sweetim.com toolbar has several obtrusive features (such as being associated with browser redirects and pop-ups, as well as containing elements that may be spying on your online activity), many computer users will quickly want to remove this obnoxious presence from the web browser.

Removing the SweetIM Toolbar

Since SweetIM does not allow removal through Internet Explorer's 'remove add-on' feature and it cannot be removed from the Control Panel, SweetIM may end up leaving a frown on many of its victims' faces. However, removing SweetIM can be done by downloading a particular tool which will erase this obtrusive presence from your computer system. Many anti-virus or anti-malware programs will not detect SweetIM for what SweetIM is, although some of the top anti-malware programs on the market will include tools that allow computer users to deal with infections similar to SweetIM. Downloading and installing the latest definitions for your anti-malware software should help in detecting any malware that may have entered your system as a result of installing SweetIM.

Aliases

15 security vendors flagged this file as malicious.

Anti-Virus Software Detection
AVG Sweetim.4FB
AVG MalSign.BitCocktail.0E0
Sophos BitCocktail
DrWeb Adware.SweetIM.2
TrendMicro TROJ_SPNR.16AM12
Comodo TrojWare.Win32.PkdKrap.Gx
Avast Win32:Downloader-MOM [Trj]
NOD32 a variant of Win32/Kryptik.ZBL
McAfee Artemis!B35054C47844
DrWeb BackDoor.Maxplus.470
BitDefender Gen:Variant.Graftor.12959
NOD32 a variant of Win32/Kryptik.ZCE
Antiy-AVL Trojan/win32.agent.gen
McAfee-GW-Edition Heuristic.BehavesLike.Win32.ModifiedUPX.J!87
McAfee GenericTRA-AC!1B37D00E7204

SpyHunter Detects & Remove SweetIM

File System Details

SweetIM may create the following file(s):
# File Name MD5 Detections
1. dnkt.exe#C1E705B306E2D6BE b2cf341204e5ff0353f6421e2d3c8701 5,058
2. dnkt.exe ec9efec1ff13e36ab9ccfd0b44e29fd8 4,854
3. dnkt.exe 7e7fdb89bbefacdc7427be389a041dad 4,723
4. dnkt.exe 64f276f23c20dc0902cca1d071a10949 4,538
5. dnkt.exe 4a7f002c3d01bb66c76b6dab3a54c940 3,916
6. dnkt.exe 746f1a728344af3fdb0d46755cafb518 3,316
7. dnkt.exe 6a44dfb2570558e7e84f3dd202db5c94 3,120
8. dnkt.exe 2f153dd300c4ce6c6fa3d84d098bebfd 2,613
9. dnkt.exe 957ac23bf94b5b5a1696cc5100c4304c 2,420
10. dnkt.exe.vir 1e1877ff0ece5d97b30c67470cea55ac 1,678
11. dnkt.exe 73f975a767801dd15b628f7028de399f 1,473
12. dnkt.exe 78910809e847cfe519a1016caf068d7c 949
13. dnkt.exe a5c70ff9a98b04a12454679cce7c1c76 893
14. lmrn.dll.vir a1939f2c611e9ddd3d3d9083bbfd0c0b 716
15. dnkt.exe efc1b0ac878077b2d63160a0976c25aa 698
16. dnkt.exe 931907b4eced283ce4e8af8f6ad7163c 549
17. dnkt.exe 8fec7ef6b8a65522f9472658d6c94d73 442
18. dnkt.exe 5ed43ba4b76ff163f4ec75a9c4a97d32 388
19. SweetNT.crx 189bf5cb9190caef035e00ca521433fb 365
20. dnkt.exe 4fa0251259abc98a0d475983778c5514 304
21. dnkt.exe db0b26104bc04d2a89dcfdf126befe34 211
22. dnkt.exe 9d336fec5433eb7773515229645cb145 150
23. dnkt.exe 6e171f8d075f499d2e1ba6bdf3ffb584 117
24. dnkt.exe 89ac1db015062b37f97f175e69ec57ee 12
25. mgToolbarIE.dll 7e91c45e2a134200a8ef31c5010539d9 5
26. mgToolbarIE.dll 33929d32afcb75b25c886c52947ab47e 2
27. mgToolbarIE.dll b77b048b498b0bc09621b63f0247c4c0 1
28. C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
29. C:\Program Files\Macrogaming\
30. C:\Program Files\Macrogaming\SweetIMBarForIE\Greetingcards_23x18.bmp
31. C:\Program Files\Macrogaming\SweetIMBarForIE\SmileyWink.bmp
32. C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.crc
33. C:\Program Files\Macrogaming\SweetIMBarForIE\SmileySmile.bmp
34. C:\Program Files\Macrogaming\SweetIMBarForIE\
35. C:\Program Files\Macrogaming\SweetIMBarForIE\Mobile_23x18.bmp
36. C:\Program Files\Macrogaming\SweetIMBarForIE\version.txt
37. C:\Program Files\Macrogaming\SweetIMBarForIE\Thumbs.db
38. C:\Program Files\Macrogaming\SweetIMBarForIE\basis.xml
39. C:\Program Files\Macrogaming\SweetIMBarForIE\Cache\
40. C:\Program Files\Macrogaming\SweetIMBarForIE\Games_23x18.bmp
41. C:\Program Files\Macrogaming\SweetIMBarForIE\affid.dat
42. C:\Program Files\Macrogaming\SweetIMBarForIE\sweetimicons.bmp
43. C:\Program Files\Macrogaming\SweetIMBarForIE\Cache\cd2005c66fba47ff715ecc444d3bc1fb.xml
More files

Registry Details

SweetIM may create the following registry entry or registry entries:
CLSID
{1D5A4199-956E-49BC-B89F-6A35C57C0D13}
{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}
{82AC53B4-164C-4B07-A016-437A8388B81A}
{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
{A439801C-961D-452C-AB42-7848E9CBD289}
{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
{DEDAF650-12B8-48F5-A843-BBA100716106}
{EEE6C358-6118-11DC-9C72-001320C79847}
{EEE6C359-6118-11DC-9C72-001320C79847}
{EEE6C35B-6118-11DC-9C72-001320C79847}
{EEE6C35C-6118-11DC-9C72-001320C79847}
{EEE6C35D-6118-11DC-9C72-001320C79847}
{EEE6C35E-6118-11DC-9C72-001320C79847}
{EEE6C35F-6118-11DC-9C72-001320C79847}
{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
File name without path
Bubble Hit by GamePacks.lnk
Continue SweetIM Installation.lnk
sweetimsetup[1].7z
Regexp file mask
%TEMP%\[RANDOM CHARACTERS]sweetim[RANDOM CHARACTERS]
SOFTWARE\Classes\Extension.ExtensionHelperObject
SOFTWARE\Classes\Extension.ExtensionHelperObject.1
SOFTWARE\Classes\Installer\Features\4340C4778499EED41AE496DC3D613EC6
SOFTWARE\Classes\Installer\Features\547B38670606DF14AA57B0BB83F3AE4D
SOFTWARE\Classes\Installer\Features\B2FD9C0A5B9838449838816A28001F4B
SOFTWARE\Classes\Installer\Products\4340C4778499EED41AE496DC3D613EC6
SOFTWARE\Classes\Installer\Products\547B38670606DF14AA57B0BB83F3AE4D
SOFTWARE\Classes\Installer\Products\B2FD9C0A5B9838449838816A28001F4B
SOFTWARE\Classes\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
SOFTWARE\Classes\SWEETIE.IEToolbar
SOFTWARE\Classes\SWEETIE.IEToolbar.1
SOFTWARE\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook
SOFTWARE\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
SOFTWARE\Classes\Toolbar3.SWEETIE
SOFTWARE\Classes\Toolbar3.SWEETIE.1
SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Software\Microsoft\Internet Explorer\Stats\{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}
SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\BUNDLESWEETIMSETUP.EXE
SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SWEETIMSETUP.EXE
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7D4F1959-3F72-49D5-8E59-F02F8AA6815D}
Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}
Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
Software\Mozilla\Firefox\Extensions\{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}
SOFTWARE\Mozilla\Firefox\Extensions\{8E9E3331-D360-4f87-8803-52DE43566502}
Software\SweetIM
SOFTWARE\Updater By SweetPacks
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{EEE6C35B-6118-11DC-9C72-001320C79847}
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
Software\Wow6432Node\Mozilla\Firefox\Extensions\{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}
SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions\{8E9E3331-D360-4f87-8803-52DE43566502}
SOFTWARE\Wow6432Node\SweetIM
Bubble Hit Bundle by SweetPacks
Bubble Hit by GamePacks
free-for-download bundle
SweetIM Bundle by SweetPacks
{2F603A45-D956-496B-81B5-50D782424976}
{7683B745-6060-41FD-AA75-0BBB383FEAD4}
{774C0434-9948-4DEE-A14E-69CDD316E36C}
{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}_is1
{953AA732-9AFB-49C9-84A4-7F96CA0A08DA}
{A0C9DF2B-89B5-4483-8983-18A68200F1B4}
{B85C4CB2-B352-4BD8-818C-BCE353599107}
{C3E85EE9-5892-4142-B537-BCEB3DAC4C3D}
{F4E33CE5-A7AB-4F68-A7E7-F0AA84EF2D9E}

Directories

SweetIM may create the following directory or directories:

%ALLUSERSPROFILE%\Application Data\SweetIM
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\free-for-download bundle
%ALLUSERSPROFILE%\SweetIM
%LOCALAPPDATA%\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}
%PROGRAMFILES%\SweetIM
%PROGRAMFILES%\sweetpacks bundle uninstaller
%PROGRAMFILES(x86)%\SweetIM
%PROGRAMFILES(x86)%\sweetpacks bundle uninstaller
%ProgramFiles%\Updater By SweetPacks
%ProgramFiles(x86)%\Updater By SweetPacks
%UserProfile%\AppData\LocalLow\SweetIM
%UserProfile%\Local Settings\Application Data\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}
%WINDIR%\SysWOW64\mjcm
%WINDIR%\SysWOW64\tprb
%WINDIR%\System32\mjcm
%WINDIR%\System32\tprb

URLs

SweetIM may call the following URLs:

http://sweetpacks-search.com/

Related Posts

Trending

Most Viewed

Loading...