KeenValue.exe
keenvalue.exe is part of gator, an advertising program. This process monitors your browsing habits and distributes the data back to the authorīs servers for analyses. KeenValue.exe is located in "C: \ Program Files \ Common files \ KeenValue \ ".
It provides an adware / links and might redirect IE settings. When the install / setup file is being run manually by the user, no gui messageboxes appear, it runs silently, it puts multiple files in the \ Program Files \ Common Files \ KeenValue directory. Here are some of it files:
-
IESLIDERWIN32.DLL (94208 bytes)
-
KEENVALUE.EXE (167936)
-
KILLKEENVALUE.EXE (28672)
-
KV001.DAT (49)
-
KV002.DAT (2012)
-
KV099.DAT (72)
-
KVLHOOKWIN.DLL (24576)
-
KWM.EXE (32768)
-
SENDUNINSTALLINFO.EXE (90193)
-
UNINSTALL.EXE (33572)
Hijackthis Log: O4 - Global Startup: KeenValue.lnk = C:\Program Files\Common Files\KeenValue\keenvalue.exe
KeenValue PerfectNav Browser Hijacker
KeenValue PerfectNav is spyware that redirects your URL typing errors to PerfectNavs Web page. High risk threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction. May open up communication ports, use polymorphic tactics, stealth installations, and/or anti-spy counter measures. May us a security flaw in the operating system to gain access to your computer.
Infected files detected
Infected folders detected
Infected registry keys/values detected
HKEY_CLASSES_ROOT\bho.perfectnavbho.1
HKEY_CLASSES_ROOT\interface\{8b8f6968-2f24-41e3-b653-e9613226f14d}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{8b8f6968-2f24-41e3-b653-e9613226f14d}\TypeLib {DE289BFA-737B-4ABB-A4EC-F8753551B875}
HKEY_CLASSES_ROOT\interface\{8b8f6968-2f24-41e3-b653-e9613226f14d}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{8b8f6968-2f24-41e3-b653-e9613226f14d} IIncrediFindBHO
HKEY_CLASSES_ROOT\typelib\{de289bfa-737b-4abb-a4ec-f8753551b875}
HKEY_CLASSES_ROOT\typelib\{de289bfa-737b-4abb-a4ec-f8753551b875}\1.0\0\win32 D:\Program Files\NetGuide\BHO\NetGuideBHO170.dll
HKEY_CLASSES_ROOT\typelib\{de289bfa-737b-4abb-a4ec-f8753551b875}\1.0\FLAGS 0
HKEY_CLASSES_ROOT\typelib\{de289bfa-737b-4abb-a4ec-f8753551b875}\1.0\HELPDIR D:\Program Files\NetGuide\BHO\
HKEY_CLASSES_ROOT\typelib\{de289bfa-737b-4abb-a4ec-f8753551b875}\1.0 BHO 1.0 Type Library
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BHO.PerfectNavBHO.1
HKEY_CLASSES_ROOT\bho.perfectnavbho.1\CLSID {00D6A7E7-4A97-456f-848A-3B75BF7554D7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BHO.PerfectNavBHO.1\CLSID {00D6A7E7-4A97-456f-848A-3B75BF7554D7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BHO.PerfectNavBHO.1 PerfectNavBHO Class
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BHO.PerfectNavBHO
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BHO.PerfectNavBHO\CLSID {00D6A7E7-4A97-456f-848A-3B75BF7554D7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BHO.PerfectNavBHO\CurVer BHO.PerfectNavBHO.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BHO.PerfectNavBHO PerfectNavBHO Class
HKEY_CLASSES_ROOT\bho.perfectnavbho.1 PerfectNavBHO Class
HKEY_CLASSES_ROOT\bho.perfectnavbho
HKEY_CLASSES_ROOT\bho.perfectnavbho\CLSID {00D6A7E7-4A97-456f-848A-3B75BF7554D7}
HKEY_CLASSES_ROOT\bho.perfectnavbho\CurVer BHO.PerfectNavBHO.1
HKEY_CLASSES_ROOT\bho.perfectnavbho PerfectNavBHO Class
HKEY_CLASSES_ROOT\interface\{8b8f6968-2f24-41e3-b653-e9613226f14d}
HKEY_CLASSES_ROOT\interface\{8b8f6968-2f24-41e3-b653-e9613226f14d}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
|
Post your comment