Home Rogue Websites Be-secured2.com

Be-secured2.com

Posted: November 4, 2009

Be-secured2.com is a malicious website that advertises the rogue anti-spyware program Alpha Antivirus. This website will most likely appear if a PC has been infected with trojans which alter the browser settings. The website appears like a Windows Explorer window with a system scan. The scan will pretend to run and then falsely detect tons of spyware on the system. The user will be coaxed to download the Alpha Antivirus program in order to dispose of these fake threats.
Do not trust this website, and remove Alpha Antivirus immediately upon detection.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Program Files%\AlphaAV
    2 %Program Files%\AlphaAV\AlphaAV.exe
    3 %UserProfile%\Desktop\Alpha Antivirus.lnk
    4 %WINDOWS%\system32\msnaoladdon.dll
    5 %WINDOWS%\system32\ndisapi.dll
    6 %WINDOWS%\system32\NetFilter.exe
    7 msnaoladdon.dll
    8 ndisapi.dll

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Alpha AntivirusHKEY_LOCAL_MACHINE\Software\Alpha AntivirusHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run “Alpha Antivirus”HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run “AlphaAV”HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}Alpha
Loading...