A malicious plug-in for web browsers. Once installed, it can be detected on the list of extensions as SafeWeb. It is distributed using the Installmonster affiliate program organized by a creator of another suchlike program called Zipmonster that is employed for spreading Trojans belonging to the Trojan.SmsSend family.
This Trojan displays fake search results in the browser window and imitates pop-up messages from Vkontakte («В Контакте»). In addition to this, the malware can replace advertisements displayed on this popular Internet resource.
Moreover, this plug-in can execute other malicious actions; for example, if the user clicks in any place on a webpage, a new browser window with a website advertised by cybercriminals will open.