Adware.Sogou

Short bio

Adware.Sogou is Malwarebytes’ detection name for adware that primarily targets Chinese users. Sogou is the name of one of the main search engines in China.

Symptoms

Users may notice a changed startpage or default search provider in their browser. They may also see advertisements that are not originating from the sites they are visiting.

Type and source of infection

Adware.Sogou started out as a Browser Helper Object for Internet Explorer but has adapted to the market for online searches by expanding to other browsers and Operating Systems. It shows advertisements in the form of popups.

Adware.Sogou is usually installed by bundlers.

Protection

Malwarebytes protects users from Adware.Sogou by using real-time protection.

Malwarebytes blocks Adware.Sogou

Business remediation

Malwarebytes can detect and remove Adware.Sogou on business machines without further user interaction.
To remove Adware.Sogou using Malwarebytes business products, follow the instructions below.

How to remove Adware.Sogou with Malwarebytes Endpoint Protection

1. Go to the Malwarebytes Cloud console.
2. To allow you to invoke a scan while the machine is off the network, go to Settings > Policies > your policy > General.
3. Under Endpoint Interface Options, turn ON:
   1. Show Malwarebytes icon in notification area
   2. Allow users to run a Threat Scan (all threats will be quarantined automatically)

If you have infected machines that are not registered endpoints in Malwarebytes Endpoint Protection, you can remove Adware.Sogou with our Breach Remediation tool (MBBR).

1. Log into your My Account page and copy your license key. The key is needed to activate MBBR tool.
2. Open your Cloud console.
3. From a clean and safe machine, go to Endpoints > Add > Malwarebytes Breach Remediation. This will download the MBBR zip package.
4. Unzip the package.
5. Access a Windows command line prompt and issue the following commands:
   mbbr register –key:<prodkey>
   mbbr update
   Note: You must substitute your license key for <prodkey>.
6. Copy the MBBR folder to a flash drive.
7. From an infected, offline machine, copy the MBBR folder from the flash drive.
8. Start a scan using the following command:
   mbbr scan –full –ark –remove –noreboot
9. Refer to the Malwarebytes Breach Remediation Windows Administrator Guide for all supported scanning commands.

How to remove Adware.Sogou with Malwarebytes Endpoint Security

You can use Malwarebytes Anti-Malware v1.80, which is included in your Malwarebytes Endpoint Security deployment to scan and remove Adware.Sogou.

Option 1

1. Remove the infected endpoint from the network.
2. On the infected machine, right click the system tray icon and click on Start Scanner.
   
3. Select Perform full scan.
   
4. Click on Scan button.

Option 2

1. Open CMD
2. CD to C:\Program Files (x86)\Malwarebytes’ Anti-Malware
3. Run mbamapi /scan –full –remove -reboot

Remediation

Malwarebytes can detect and remove Adware.Sogou without further user interaction.

1. Please download Malwarebytes to your desktop.
2. Double-click MBSetup.exe and follow the prompts to install the program.
3. When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
4. Click on the Get started button.
5. Click Scan to start a Threat Scan.
6. Click Quarantine to remove the found threats.
7. Reboot the system if prompted to complete the removal process.

Traces/IOCs

Registry keys:

HKCR\Software\SogouExplorer

HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\SogouExplorer

Folders:

• %PROGRAMFILES%\SogouExplorer
• %PROGRAMFILES%\PushWare
• %PROGRAMFILES%\SogouSoftware