Threat Explorer

The Threat Explorer is a comprehensive resource consumers can turn to for daily, accurate, up-to-date information on the latest threats, risks and vulnerabilities.

Adware.ClickAlchemy

Adware.ClickAlchemy

Updated:
February 13, 2007
Publisher:
ClickAlchemy.com
Risk Impact:
High
File Names:
Alchem.exe
Systems Affected:
Windows

Behavior


Adware.ClickAlchemy is a Browser Helper Object (BHO) that connects to various adware Web sites and downloads advertisements.

Symptoms


  • The files are detected as Adware.ClickAlchemy.
  • Unexplained connections to the Internet.
  • The Web browser attempts to download cookies from unknown Web sites, if notification is enabled.


Behavior


This is usually installed when specific Web sites are visited.

Antivirus Protection Dates

  • Initial Rapid Release version October 02, 2014 revision 022
  • Latest Rapid Release version October 02, 2014 revision 022
  • Initial Daily Certified version March 24, 2004
  • Latest Daily Certified version September 28, 2010 revision 036
  • Initial Weekly Certified release date March 24, 2004
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

This Browser Helper Object attempts to download files from predetermined Web sites. The files are adware, although it is possible that malicious programs could also be downloaded. The publisher of the software determines the exact files and locations.

When Adware.ClickAlchemy is installed, it does the following:
  1. Accesses a Web site (the URL is configurable) at predetermined intervals.

  2. Downloads information on what URL to access in the next interval.

  3. Downloads executables that have been added or updated since the last download. The configuration file names and cookies associated with the download are all configurable.

  4. Creates the value:

    "Alchem" = "Alchem.exe"  

    in the registry key:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

    so that the software runs when Windows is started.

  5. Creates the following files:

    • Alchem.inf
    • Alchem.ini



Removal Tool
Symantec Security Response has developed a removal tool for Adware.ClickAlchemy. Use this removal tool first, as it is the easiest way to remove this threat.

The tool can be found here:
http://securityresponse.symantec.com/avcenter/FixAlchm.exe

The current version of the tool is version 1.0.6. It will have a digital signature timestamp equivalent to 01/24/2005 04:20 AM PST.

Note: The date and time displayed will be adjusted to your time zone, if your computer is not set to the Pacific time zone.

It has been reported that a computer on which Adware.ClickAlchemy is installed may also have other security risks. Symantec recommends that the following steps be carried out:
    1. Apply the Adware.ClickAlchemy Removal Tool.
    2. Update the definitions by starting the Symantec program and running LiveUpdate.
    3. Run a full system scan to detect any other security risks on the computer.
    4. If the scan detects any further security risks, check for removal tools at http://securityresponse.symantec.com/avcenter/security.risks.tools.list.html.
    5. If there are no removal tools for the security risks that are detected, follow the manual removal instructions listed in the threat report.


Manual Removal

The following instructions pertain to all Symantec antivirus products that support Security Risk detection.
  1. Update the definitions.
  2. Run a full system scan and delete all the files detected as Adware.ClickAlchemy.
  3. Delete the value that was added to the registry.
For specific details on each of these steps, read the following instructions.

1. To update the definitions
To obtain the most recent definitions, start your Symantec program and run LiveUpdate.

2. To scan for and delete the files
  1. Start your Symantec antivirus program, and then run a full system scan.
  2. If any files are detected as Adware.ClickAlchemy, write down the path and file name, and then click Delete.


    Note: If your Symantec antivirus product reports that it cannot delete a detected file, write down the path and file name. Then use Windows Explorer to locate and delete the file.

3. To delete the value from the registry

WARNING: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry ," for instructions.
  1. Click Start, and then click Run.
  2. Type regedit

    Then click OK.

  3. Navigate to the key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

  4. In the right pane, delete the value:

    "Alchem" = "Alchem.exe"

  5. Exit the Registry Editor.