SweetIM

SweetIM Description

ScreenshotWhen PC security researchers see the message 'get free smilies', it immediately sets off multiple red flags. This is because the offer of free emoticons is one of the most common ways in which criminals entice inexperienced computer users into downloading and installing malware onto their computer system. SweetIM, associated with the website and toolbar search.sweetim.com, is one of many dodgy companies that lures its victims with the promise of free emoticons but delivers nothing but plenty of hassles and security risks. Because of this, security researchers strongly advise computer users to stay away from SweetIM or from the search.sweetim.com website. Contact with this 'free' service will do nothing but bring infections to your computer system and install a toolbar that cannot be removed through normal means.

The Main Problems with SweetIM

Computer users visiting websites that do not take care to make sure that advertisements they display are not associated with malware will often have come across obtrusive banner advertisements promising free emoticons for your computer. These obnoxious advertisements will often use pop-up windows or sound in order to obstruct computer users' normal online activity. SweetIM follows all of these tactics. If a computer user downloads SweetIM, SweetIM will immediately block all web browsers except Internet Explorer, since SweetIM is designed to take advantage of Internet Explorer's known vulnerabilities to Browser Helper Objects (that is, malicious toolbars designed to affect your web browser in some way or another). Then, once installed, SweetIM will not allow the victim to remove the SweetIM toolbar from the web browser through normal uninstall procedures. Since the search.sweetim.com toolbar has several obtrusive features (such as being associated with browser redirects and pop-ups, as well as containing elements that may be spying on your online activity), many computer users will quickly want to remove this obnoxious presence from the web browser.

Removing the SweetIM Toolbar

Since SweetIM does not allow removal through Internet Explorer's 'remove add-on' feature and it cannot be removed from the Control Panel, SweetIM may end up leaving a frown on many of its victims' faces. However, removing SweetIM can be done by downloading a particular tool which will erase this obtrusive presence from your computer system. Many anti-virus or anti-malware programs will not detect SweetIM for what SweetIM is, although some of the top anti-malware programs on the market will include tools that allow computer users to deal with infections similar to SweetIM. Downloading and installing the latest definitions for your anti-malware software should help in detecting any malware that may have entered your system as a result of installing SweetIM.

Aliases: Sweetim.4FB [AVG], Sweetpacks/SweetIM (fs) [VIPRE], a variant of Win32/SweetIM.B potentially unwanted [ESET-NOD32], W32.HfsAdware.3999 [Bkav], MalSign.BitCocktail.0E0 [AVG], a variant of Win32/Toolbar.BitCocktail.B [ESET-NOD32], Win32.Troj.Generic.a.(kcloud) [Kingsoft], BitCocktail [Sophos], PUP.Optional.SweetPacks.A [Malwarebytes], Trojan.Win32.A.Agent.188760 [ViRobot], Adware.SweetIM.2 [DrWeb], Artemis!B35054C47844 [McAfee], Win32:Downloader-MOM [Trj] [Avast], TrojWare.Win32.PkdKrap.Gx [Comodo] and a variant of Win32/Kryptik.ZBL [NOD32].

Infected with SweetIM? Scan Your PC

Download SpyHunter's Spyware Scanner
to Detect SweetIM
* SpyHunter's scanner is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware removal tool to remove the malware threats. Read more on SpyHunter. If you no longer wish to have SpyHunter installed on your computer, follow these steps to uninstall SpyHunter.

Security Doesn't Let You Download SpyHunter or Access the Internet?


Solutions: Your computer may have malware hiding in memory that prevents any program, including SpyHunter, from executing on your computer. Follow to download SpyHunter and gain access to the Internet:
  • Use an alternative browser. Malware may disable your browser. If you're using IE, for example, and having problems downloading SpyHunter, you should open Firefox, Chrome or Safari browser instead.
  • Use a removable media. Download SpyHunter on another clean computer, burn it to a USB flash drive, DVD/CD, or any preferred removable media, then install it on your infected computer and run SpyHunter's malware scanner.
  • Start Windows in Safe Mode. If you can not access your Window's desktop, reboot your computer in "Safe Mode with Networking" and install SpyHunter in Safe Mode.
  • IE Users: Disable proxy server for Internet Explorer to browse the web with Internet Explorer or update your anti-spyware program. Malware modifies your Windows settings to use a proxy server to prevent you from browsing the web with IE.

If you still can't install SpyHunter? View other possible causes of installation issues.

Technical Information

Infection Statistics


Our MalwareTracker shows malware activity across the world. Explore real-time data of SweetIM outbreaks and other threats from global to local level.

File System Details

SweetIM creates the following file(s):
# File Name Size MD5 Detection Count
1 %PROGRAMFILES%\Updater By SweetPacks\ExtensionUpdaterService.exe 188,760 1ba417f51bf6715f2a98014e4c093eb4 660
2 %WINDIR%\System32\mjcm\dnkt.exe 640,304 b853bc1877798d51a644ec72f711dc0b 553
3 %PROGRAMFILES%\SweetIM\Toolbars\Internet Explorer\mgHelper.dll 187,192 e0a8ea5db2e02b3237e4fcd631a79c60 449
4 %PROGRAMFILES%\SweetIM\Messenger\SweetIM.exe 106,496 5b68d4e25382ea00bafdccd43e9531b2 180
5 %PROGRAMFILES%\Updater By SweetPacks\Extension32.dll 170,840 b5602f4db9b04e8bf14bd920ced81851 78
6 %PROGRAMFILES(x86)%\SweetIM\Communicator\SweetPacksUpdateManager.exe 219,952 813adb173b3c3cd5c7099e9a253bb344 78
7 %USERPROFILE%\Meus documentos\SweetImSetup.exe 436,648 6b6099faad32016c1a11f7a72dc12bb3 53
8 %PROGRAMFILES%\Updater By SweetPacks\Extension64.dll 215,384 2eb7771cff249d574b26b98ad0e9213e 35
9 %PROGRAMFILES%\Techno Design IP\Quebles Toolbar\QueblesAutoUpdate.exe 23,232 89b6f57510493ff50ac0dcf25eb1d899 27
10 %APPDATA%xmxt.exe 442,368 9c23ecf21c7d5ac34bbacbf23f537b3a 27
11 %WINDIR%eu2i.exe 71,564 43ad23c90590136f4ff51c097d28065d 26
12 %ALLUSERSPROFILE%\Application Data\hDNYrohYYsM.exe 451,356 cc813c29bf35e72fa8c1724773b7c3e7 26
13 %WINDIR%bclm.exe 71,557 8af4d2267051abe2f29769b0b64f6283 25
14 %USERPROFILE%\Local Settings\Application Data\Updater By SweetPacks\264dsse2.dll 872,448 39fad13f5cd84e1eaae3659a278cf313 5
15 %APPDATA%\Microsoft\xqfaji\xqfaji.exe 22,016 ca6551e16849718240091a1f4e7ae490 4
16 C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll N/A
17 C:\Program Files\Macrogaming\ N/A
18 C:\Program Files\Macrogaming\SweetIMBarForIE\Greetingcards_23x18.bmp N/A
19 C:\Program Files\Macrogaming\SweetIMBarForIE\SmileyWink.bmp N/A
20 C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.crc N/A
21 C:\Program Files\Macrogaming\SweetIMBarForIE\SmileySmile.bmp N/A
22 C:\Program Files\Macrogaming\SweetIMBarForIE\ N/A
23 C:\Program Files\Macrogaming\SweetIMBarForIE\Mobile_23x18.bmp N/A
24 C:\Program Files\Macrogaming\SweetIMBarForIE\version.txt N/A
25 C:\Program Files\Macrogaming\SweetIMBarForIE\Thumbs.db N/A
26 C:\Program Files\Macrogaming\SweetIMBarForIE\basis.xml N/A
27 C:\Program Files\Macrogaming\SweetIMBarForIE\Cache\ N/A
28 C:\Program Files\Macrogaming\SweetIMBarForIE\Games_23x18.bmp N/A
29 C:\Program Files\Macrogaming\SweetIMBarForIE\affid.dat N/A
30 C:\Program Files\Macrogaming\SweetIMBarForIE\sweetimicons.bmp N/A
31 C:\Program Files\Macrogaming\SweetIMBarForIE\Cache\cd2005c66fba47ff715ecc444d3bc1fb.xml N/A
More files

Registry Details

SweetIM creates the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}
SweetIM Bundle by SweetPacks
{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}_is1
{C3E85EE9-5892-4142-B537-BCEB3DAC4C3D}
free-for-download bundle
{2F603A45-D956-496B-81B5-50D782424976}
{B85C4CB2-B352-4BD8-818C-BCE353599107}
{A0C9DF2B-89B5-4483-8983-18A68200F1B4}
Bubble Hit Bundle by SweetPacks
Bubble Hit by GamePacks
HKEY..\..\..\..{RegistryKeys}
Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Software\SweetIM
SWEETIE.IEToolbar
SWEETIE.IEToolbar.1
SweetIM_URLSearchHook.ToolbarURLSearchHook
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SweetIM Bundle by SweetPacks
SOFTWARE\Updater By SweetPacks
Toolbar3.SWEETIE
Toolbar3.SWEETIE.1
Software\Microsoft\Internet Explorer\Stats\{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}
Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7D4F1959-3F72-49D5-8E59-F02F8AA6815D}
Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}
SOFTWARE\Classes\Extension.ExtensionHelperObject.1
SOFTWARE\Classes\SWEETIE.IEToolbar
SOFTWARE\Classes\SWEETIE.IEToolbar.1
SOFTWARE\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook
SOFTWARE\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
SOFTWARE\Classes\Toolbar3.SWEETIE
SOFTWARE\Classes\Toolbar3.SWEETIE.1
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F4E33CE5-A7AB-4F68-A7E7-F0AA84EF2D9E}
SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions, value: {8E9E3331-D360-4f87-8803-52DE43566502}
SOFTWARE\Mozilla\Firefox\Extensions, value: {8E9E3331-D360-4f87-8803-52DE43566502}
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID, value: {EEE6C35B-6118-11DC-9C72-001320C79847}
SOFTWARE\Wow6432Node\Wow6432Node\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
SOFTWARE\Classes\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
SOFTWARE\Classes\Installer\Products\547B38670606DF14AA57B0BB83F3AE4D
SOFTWARE\Classes\Installer\Products\4340C4778499EED41AE496DC3D613EC6
SOFTWARE\Classes\Installer\Features\547B38670606DF14AA57B0BB83F3AE4D
Software\Mozilla\Firefox\Extensions, value: {7D4F1959-3F72-49d5-8E59-F02F8AA6815D}
Software\Wow6432Node\Mozilla\Firefox\Extensions, value: {7D4F1959-3F72-49d5-8E59-F02F8AA6815D}
SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\BUNDLESWEETIMSETUP.EXE
SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SWEETIMSETUP.EXE
SOFTWARE\Classes\Installer\Products\B2FD9C0A5B9838449838816A28001F4B
SOFTWARE\Classes\Installer\Features\B2FD9C0A5B9838449838816A28001F4B
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
The following CLSID's were found:
HKEY..\..\{CLSID Path}
{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}
{82AC53B4-164C-4B07-A016-437A8388B81A}
{8E9E3331-D360-4f87-8803-52DE43566502}
{DEDAF650-12B8-48F5-A843-BBA100716106}
{EEE6C358-6118-11DC-9C72-001320C79847}
{EEE6C359-6118-11DC-9C72-001320C79847}
{EEE6C35D-6118-11DC-9C72-001320C79847}
{EEE6C35E-6118-11DC-9C72-001320C79847}
{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}

Related Posts

Site Disclaimer

Leave a Reply

Please DO NOT use this comment system for support or billing questions. For SpyHunter technical support requests, please contact our technical support team directly by opening a customer support ticket via your SpyHunter. For billing issues, please refer to our "Billing Questions or Problems?" page. For general inquiries (complaints, legal, press, marketing, copyright), visit our "Inquiries and Feedback" page.

IMPORTANT! To be able to proceed, you need to solve the following simple math.
Please leave these two fields as is:
What is 9 + 15 ?