7Search association questionable on site? Adware?

Viruses and worms
1

See: https://www.virustotal.com/nl/url/f569342d08a0e4795657bdcd59e7257cb2dbb69b4319674fa613a629b0011d4c/analysis/1386610474/
See recent reports here: http://urlquery.net/report.php?id=8280244
Consider this on the 7Search link: https://www.mywot.com/en/scorecard/conversion.7search.com?utm_source=addon&utm_content=popup-donuts
7search get a lot of their traffic from adware and browser hijacking and is a scam in so far as it is as useful as a chocolate fireguard (click = /.003)
Site given benign here:
http://zulu.zscaler.com/submission/show/d6bbd21be7303ae47e4fd39445be8b94-1386611212

polonus

2

Im setting up a new VM with Avast at the moment i can take a look. :wink:

3

First submission was 2 months ago.

File has a valid signature. 0 detections on virustotal: https://www.virustotal.com/de/file/38a09e1ade00d0aa4949bbaa7456c90c0cb296c8f756cce28a5995a8e76967f7/analysis/1386611977/

Web site category:education, potentially unwanted software.
Sophos URL descriptionURL: subjected to threat Mal/HTMLGen-A.
Websense ThreatSeeker URL category:potentially unwanted software

4

Hi Steven Winderlich,

Listed in mvps.org host file & conversion.7search.com is listed in OpenDNS’s Block Tool http://forums.opendns.com
Whenever we find associations with 7search that spells adware trouble,

pol

5

Here are 2 screenshots.

Looks like a PUP to me.

No Adware or toolbars on the VM, also not visible in installation.

But it wants a Activation Key.

When you click register now you get the site in screenshot 3. Website is identified by VeriSign and trusted by IE.

Only one folder detected in Roaming by ADWCleaner.

6

Most likely this PUP/adware is not added/listed by the average av solution.
It is more of a detection to be flagged by proggies like MBAM, SAS or good old Spyware Blaster,

polonus

7

Yep.

And then everyone complains. WHY HAS MY ANTIVIRUS NOT STOPPED THIS?WHY DO I HAVE IT THEN? :smiley: :smiley: :smiley: