Home Malware Programs Browser Hijackers Antivirusan.com

Antivirusan.com

Posted: May 9, 2011

ScreenshotAntivirusan.com is one of many malicious websites that market the fraudulent rogue security program Antivirus Protection. Exposure to Antivirusan.com or application related to Antivirusan.com has been known to infect the PC in question with a web browser hijacker that persistently redirects the browser back to Antivirusan.com. Browser hijacks may also create fake error messages that block access to normal websites or change your homepage without permission. If you're infected with Antivirusan.com's browser hijacker or Antivirus Protection, you should be ready to use the strongest anti-malware program that you can afford to remove these Antivirusan.com-linked threats.

Antivirusan.com is a New Domain Name for a Well-Seasoned Scam

Antivirusan.com is a simple copy of other websites that try to market Antivirus Protection or one of its many clones. Some samples of Antivirusan.com's 'twin' sites include Antivirvip.net, Antivirart.com, Antivirea.com and Antivirat.com. The main danger in these websites lies in your taking their fake marketing claims seriously and purchasing Antivirus Protection.

Antivirus Protection is itself known by other names like Antivirus Monitor and Antivirus Scan. Although these programs pretend to be good anti-virus scanners, they have functions that are not beneficial for your PC. Their primary symptoms are fake errors like the one you can see below:

Security Alert
Virus Alert!
Application can't be started! The file [application file] is damaged. Do you want to activate your anti-virus program now?

A variety of attacks may use these error messages to mislead you into believing that unrelated infections are causing other system problems. Antivirusan.com malware may change your system settings, stop you from accessing other programs, or hijack your web browser and redirect you to Antivirusan.com..

Purchasing an activation key for Antivirus Monitor or any other Antivirusan.com security product may reduce the program attacks, but this also places your credit card in danger of repetitive fraudulent charges. Removing Antivirusan.com threats by using appropriate anti-malware solutions is a more beneficial option in the long term.

Why You Should Stay on Your Toes Around Antivirusan.com

Although a deliberate download is one way to get infected by Antivirusan.com, you may become infected by other means, too. Visiting Antivirusan.com without downloading anything of your own free will still may subject your PC to forced downloads that operate via invisible script abuses. If you disable Flash and JavaScript you have a reduced chance of being attacked this way, although no defense is perfect.

You may also see errors like this one that can lead you into thinking that many different websites are dangerous:

Internet Explorer Warning – visiting this web site may harm your computer!
Most likely causes:
– The website contains exploits that can launch a malicious code on your computer
– Suspicious network activity detected
– There might be an active spyware running on your computer

This error is caused by Antivirusan.com hijackers and similar browser hijacker infections. You should treat it as completely erroneous, just as you should treat the fake infection messages from Antivirusan.com's rogue security program.

To delete Antivirusan.com threats with minimal hassle or side effects, you should switch to Safe Mode with Networking by hitting F8 during startup and choosing the appropriate menu option. This will disable the hijacker and other infections so that you can run an anti-malware scan and remove Antivirusan.com threats from your PC while they're down for the count.


ScreenshotScreenshotScreenshotScreenshot

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Temp%\[RANDOM CHARACTERS]\
    2 %Temp%\[RANDOM CHARACTERS]\[RANDOM CHARACTERS].exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = '1'HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter "Enabled" = '0'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyEnable" = '1'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyOverride" = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = '127.0.0.1:33554'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = '.exe'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARACTERS]"HKEY_CURRENT_USER\Software\[RANDOM CHARACTERS]
Loading...