Adware.ClickAlchemy

SUMMARY

Behavior

Adware.ClickAlchemy is a Browser Helper Object (BHO) that connects to various adware Web sites and downloads advertisements.

Symptoms

• The files are detected as Adware.ClickAlchemy.
• Unexplained connections to the Internet.
• The Web browser attempts to download cookies from unknown Web sites, if notification is enabled.

Transmission

This is usually installed when specific Web sites are visited.

Protection

• Virus Definitions (LiveUpdate™ Weekly) March 24, 2004
• Virus Definitions (Intelligent Updater) March 24, 2004

TECHNICAL DETAILS

This Browser Helper Object attempts to download files from predetermined Web sites. The files are adware, although it is possible that malicious programs could also be downloaded. The publisher of the software determines the exact files and locations.

When Adware.ClickAlchemy is installed, it does the following:

1. Accesses a Web site (the URL is configurable) at predetermined intervals.
   
   
2. Downloads information on what URL to access in the next interval.
   
   
3. Downloads executables that have been added or updated since the last download. The configuration file names and cookies associated with the download are all configurable.
   
   
4. Creates the value:
   
   "Alchem" = "Alchem.exe"  
   
   in the registry key:
   
   HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
   
   so that the software runs when Windows is started.
   
   
5. Creates the following files:
   
   
   • Alchem.inf
   • Alchem.ini

REMOVAL

Removal Tool
Symantec Security Response has developed a removal tool for Adware.ClickAlchemy. Use this removal tool first, as it is the easiest way to remove this threat.

The tool can be found here:
http://securityresponse.symantec.com/avcenter/FixAlchm.exe

The current version of the tool is version 1.0.6. It will have a digital signature timestamp equivalent to 01/24/2005 04:20 AM PST.

Note: The date and time displayed will be adjusted to your time zone, if your computer is not set to the Pacific time zone.

It has been reported that a computer on which Adware.ClickAlchemy is installed may also have other security risks. Symantec recommends that the following steps be carried out:

1. Apply the Adware.ClickAlchemy Removal Tool.
2. Update the definitions by starting the Symantec program and running LiveUpdate.
3. Run a full system scan to detect any other security risks on the computer.
4. If the scan detects any further security risks, check for removal tools at http://securityresponse.symantec.com/avcenter/security.risks.tools.list.html.
5. If there are no removal tools for the security risks that are detected, follow the manual removal instructions listed in the threat report.

Manual Removal

The following instructions pertain to all Symantec antivirus products that support Security Risk detection.

1. Update the definitions.
2. Run a full system scan and delete all the files detected as Adware.ClickAlchemy.
3. Delete the value that was added to the registry.
   

For specific details on each of these steps, read the following instructions.

1. To update the definitions
To obtain the most recent definitions, start your Symantec program and run LiveUpdate.

2. To scan for and delete the files

1. Start your Symantec antivirus program, and then run a full system scan.
2. If any files are detected as Adware.ClickAlchemy, write down the path and file name, and then click Delete.
   
   

   ---

   Note: If your Symantec antivirus product reports that it cannot delete a detected file, write down the path and file name. Then use Windows Explorer to locate and delete the file.

   ---

3. To delete the value from the registry

---

WARNING: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.

---

1. Click Start, and then click Run.
2. Type regedit
   
   Then click OK.
   
   
3. Navigate to the key:
   
   HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
   
   
4. In the right pane, delete the value:
   
   "Alchem" = "Alchem.exe"
   
   
5. Exit the Registry Editor.