We have found members of the Elex family to create an extra Firefox profile and wrote about it on our blog in a post called GsearchFinder hijackers add extra Firefox profile. Now they took on the task of doing the same for Chrome (and succeeded). They copy some settings from your current profile to create the new profile and give it a natural “feel”.
Background
Youndoo is named after the searchpage it tries to get its’ victims to use.
If there is one thing we must admit that this is a resourceful lot. They have come up with some very inventive methods to get us to use their search engine(s). Maybe if they had put all that creative power into improving said search engine they might have taken over the market lead by now. (hint, hint)
To name a few examples of their making:
- Qone8 – hijacking browser shortcuts
- HohoSearch – an extra Firefox profile
- The first Youndoo – using ShellExecuteHooks
- YesSearches – altered browser shortcuts, services, and Scheduled Tasks
The extra Chrome profile
This hijacker uses some other methods, but we will focus on the new Google Chrome profile here. If you are used to logging in to Chrome with your Google account you will see something like this under Settings:
Under “People” you will see the currently active account. If you are not logged in, the displayed account name will be “Person1” and the icon will be gray and not blue.
But, if you have been affected by this hijacker, you will see this instead:
A gray icon with the profile name “user0” is displayed as the current user. Your extensions and history were copied to this account, but your start-page has been changed to www.youndoo.com.
You will also find that your “Home Button” brings you to the same page and that Youndoo is now your default search engine in Chrome. But even changing all these settings manually will not prevent the Youndoo search site from opening when you start Chrome. Even removing the new profile will not undo that. But after editing the settings and a reboot, that part is cleared up. This is not a total removal though, we urgently revise to do a full Threat Scan with Malwarebytes Anti-Malware if you are dealing with this infection, since there are usually also a Scheduled Task and a service active on affected systems.
A full removal guide can be found on our forums, where you will notice most of the detections are done as PUP.Optional.FakeCHRProfile to get rid of the fake Chrome profile.
File properties
SHA1 dam_ay.exe a54ca8156ad9de6ae81231ba934284dffeb8d730
Malwarebytes Anti-Malware detected this installer as PUP.Optional.YesSearches even before it was released.
As often this file was offered as an installer for a VLC player.
Stay safe and get yourself protected.
Pieter
I know that there is a lot of “fake VLCplayer installers out there and also there are many fake webpage’s under “VLCplayer name” and also did you know that the “VLCplayer” it is got bundled with others freeware crap software’s and I was Remember this VLCplayer fake version by hotbar
so the VLCplayer is safe to use it or not ? and does mbam Identify of the fake version and the original version? and does Mbam scanning for web-browse’s fake profiles ? I think Combofix is does this …
MBAM does recognize most, if not all, the fake installers and if you are using the Premium version with the correct settings, it will stop you from installing them or the offending elements that the installer wants to put on your system.
when u download a software … download it from the original page … otherwise …
Like Pieter Arntz say: “…if you are using the Premium version with the correct settings …”