Follow:

 

Adware:Win32/Feven


Microsoft security software detects and removes this unwanted software.

This adware program shows ads as you browse the web. You can see examples of these ads on the Technical information tab.

It can be downloaded from the program's website or installed by software bundlers that offer free applications or games.

Find out more about how and why we identify unwanted software.



What to do now

This program poses a high threat to your PC.

This program may create an uninstaller that can be accessed from the Control Panel. Running this uninstaller may remove some or all of the files related to the program:
  • For Windows 8, open the Start screen, type Uninstall and then go to Settings. In the search results, go to Uninstall a program.
  • For Windows 7 and Vista, open the Start menu and navigate to Control Panel then Programs and then Uninstall a Program.
  • For XP, open the Start menu and navigate to Control Panel then Add or Remove Programs.

Choose the program you want to remove, and then click or tap Uninstall or Uninstall/Change and follow the prompts.

The entry for this program may be called "Feven Pro" or something similar and might look like this:

If an uninstaller is not available, does not work properly, or you do not want to use it, you can use the following free tools to detect and remove this program and other unwanted software from your PC:

You can also visit the Microsoft virus and malware community for more help.

Threat behavior

Installation

Adware:Win32/Feven is usually installed by software bundlers that offer free applications or games.

When run, the installer can add a plugin to Internet Explorer, Firefox, or Chrome. An example of the Internet Explorer plugin is shown below:

The Mozilla Firefox can look similar to the following:

The program installs itself into one of the following folders:

Where <program name> can be one of the following:

  • feven 1.1
  • feven 1.2
  • feven 1.5
  • feven 1.7
  • feven 1.8
  • feven 2.1
  • feven 2.2
  • feven 2.5
  • feven pro
  • feven pro 1.1
  • feven pro 1.2
  • feven pro 1.3
  • fiv en
  • free ven
  • freeven

We have seen the following files created in the above folder:

  • 51680.crx
  • 51680.xpi
  • Background.thml
  • Feven Pro 1.1-bg.exe
  • Feven Pro 1.1-bho.dll
  • Feven Pro 1.1-bho64.dll
  • Feven Pro 1.1-chromeinstaller.exe
  • Feven Pro 1.1-codedownloader.exe
  • Feven Pro 1.1-enabler.exe
  • Feven Pro 1.1-firefoxinstaller.exe
  • Feven Pro 1.1-updater.exe
  • Feven Pro 1.1.ico
  • Installer.log
  • Uninstall.exe
  • utils.exe

One of the following folders is also created for the Chrome browser extension:

  • %LOCALAPPDATA% \Google\Chrome\User Data\Default\Extensions\hjghiofiijcepdnocbgefbdlbckjfheg
  • %LOCALAPPDATA% \Google\Chrome\User Data\Default\Extensions\kpjdjfkkmlgacmnenfhafmkldaogiglb
  • %LOCALAPPDATA% \Google\Chrome\User Data\Default\Extensions\hjmimgeipgjgdblgkjpgaknjeidbnjdb
  • %LOCALAPPDATA% \Google\Chrome\User Data\Default\Extensions\dimhcblkpgmkpldmpfimhkhfcnmckodj
  • %LOCALAPPDATA% \Google\Chrome\User Data\Default\Extensions\pigkdicgnehbfjnaopalgpelkbkcnbfa
  • %LOCALAPPDATA% \Google\Chrome\User Data\Default\Extensions\fglhnbihmeinbfgalpnaiembmdhfijli
  • %LOCALAPPDATA% \Google\Chrome\User Data\Default\Extensions\baodmgdpdoelldjmkhknbolcldnfjegg
  • %LOCALAPPDATA% \Google\Chrome\User Data\Default\Extensions\gcjbopemebdnolilndkpjfmhakccapkh
Behavior

Adware:Win32/Feven shows you ads as you browse the Internet. The ads can appear in both websites and search engine results, as shown in the following examples:

It can also redirect you to a different website than the one you wanted to visit. The redirect page can ask you to complete surveys or install software on your PC. An example of a redirection to a website that tries to convince you to download software is shown below:

Downloading and running this update can install more unwanted applications on your PC.

Analysis by Geoff McDonald

 


Symptoms

The following could indicate that you have this program on your PC:

  • You might see the following when using your Internet browser:
    • Extra advertisements when using search engines such as Bing and Google
    • Advertisements when you visit a number of websites, including Amazon and BestBuy
  • Your web browser is redirected to websites that ask you to complete surveys or install other programs
  • You have one of the following folders in the %ProgramFiles% folder on your PC:
    • feven 1.1
    • feven 1.2
    • feven 1.5
    • feven 1.7
    • feven 1.8
    • feven 2.1
    • feven 2.2
    • feven 2.5
    • feven pro
    • feven pro 1.1
    • feven pro 1.2
    • feven pro 1.3
    • fiv en
    • free ven
    • freeven

 


Prevention


Alert level: High
First detected by definition: 1.167.1914.0
Latest detected by definition: 1.185.1642.0 and higher
First detected on: Mar 14, 2014
This entry was first published on: Mar 16, 2014
This entry was updated on: Sep 24, 2014

This threat is also detected as:
No known aliases